Privacy policy

This English version is a translation provided for your convenience. The French version is the only legally binding text and prevails in the event of any difference.

At Vert Sapin, we sell real Christmas trees and Christmas decorations. To take your order and deliver it on the date you have chosen, we need some information about you. This page explains which information, why we use it, who it is passed on to, how long we keep it, and what you can ask of us at any time.

This text follows the General Data Protection Regulation (GDPR) and the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1. Who is responsible for your data

The controller is the company that operates the Vert Sapin shop:

  • ONLY WAY SRL, trading under the name Vert Sapin
  • Registered office: Rue du Pinson 64, 1170 Watermael-Boitsfort, Belgium
  • Company number and VAT number: BE 1029.126.052
  • Register of Legal Entities (RPM): Brussels
  • Website: https://vertsapin.be
  • Email: info@vertsapin.be
  • Telephone: +32 479 73 03 49

It is this company that decides which data is collected and how it is used. For any question about this policy, write to info@vertsapin.be.

We have not appointed a data protection officer: the law does not require one for a business of our size and activity. Your questions and requests are handled directly by the management, at info@vertsapin.be, in French.

2. What data we collect

Your order data

When you order a tree or a decoration: your surname and first name, your email address, your telephone number, the details of the items ordered, the amount, the date of the order and, if you order for a company, your company name and your VAT number.

Your delivery and pick-up data

The delivery address, the floor or the access details you give us, as well as the date and the time slot you choose. If you have entrusted us with a home service by quote, for business or private purposes, we also keep your instructions for setting up the tree and for the pick-up after the holidays: this pick-up is part of those projects and is included in their quote; it does not apply to orders placed on the online shop.

Your payment data

Online payment goes through Shopify Payments and PayPal. Your bank card details are entered directly with these providers. We do not see them and we do not store them. We keep only the proof of payment: the amount, the date, the payment method used and the status of the transaction.

Your browsing data

Like any online shop, our shop records technical information: IP address, type of device and browser, pages viewed, products added to the basket, date and time of the visit. This information comes from cookies and from the platform that hosts the shop.

Your messages

If you write to us or call us, we keep the content of your message and your contact details for as long as it takes to deal with your request.

3. Why we use this data, and on what legal basis

The GDPR requires each use to rest on a specific legal basis. Here are ours:

  • Processing your order: recording the purchase, collecting the payment, preparing the tree and delivering it on the date and in the time slot you have chosen. As part of a home service by quote, the same data is also used to set up the tree and then to pick it up after the holidays, as provided for in the quote. Legal basis: the performance of the contract of sale concluded with you.
  • Keeping you informed about your order: confirmation, reminder of the delivery time slot, notice of a delivery attempt. Legal basis: the performance of the contract.
  • Issuing and keeping our invoices: Belgian law requires us to keep accounts and to retain the supporting documents. Legal basis: compliance with a legal obligation.
  • Answering your questions and handling a problem after delivery: exchange, replacement, legal guarantee of conformity, complaint. Legal basis: the performance of the contract and our legitimate interest in defending our rights.
  • Securing the shop and preventing fraud: detecting fraudulent orders and intrusion attempts. Legal basis: our legitimate interest in protecting our business and our customers.
  • Improving the shop, measuring its audience and personalising our advertising: understanding which pages are viewed and where visitors leave, measuring what our advertising brings in and showing you, on Facebook and Instagram, products related to your visit. Legal basis: your consent, which you can withdraw at any time.
  • Sending you offers or news of the season, if you have subscribed to our newsletter. Legal basis: your consent, which you can withdraw at any time without giving a reason.

This newsletter exists: the footer of the site invites you to subscribe to receive our offers. Subscriptions and mailings go through Shopify, the platform that hosts the shop, and every message contains an unsubscribe link.

4. Who receives your data

We do not sell your data and we do not trade it. It is passed on only to those who need it for your order to be completed:

  • Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify hosts the shop and processes the data on our behalf, as a processor, in accordance with our instructions.
  • Shopify Payments and PayPal, for collecting the online payment. These providers process your payment data under their own responsibility, within the framework of financial regulation.
  • Our delivery staff, who receive your name, your address, your telephone number and the chosen time slot, in order to carry out the delivery and, as part of a home service by quote, the setting up and then the pick-up of the tree.
  • Google, on the pages that display the map of our stalls (the home page and Our stalls). The map loads with the page: your IP address and technical data are then transmitted to Google, which processes them under its own responsibility. If you accept measurement and advertising cookies, Google also receives browsing data, for Google Analytics and the measurement of our Google ads.
  • Meta Platforms Ireland Limited (Facebook, Instagram), only if you accept advertising cookies: browsing and order data (pages viewed, products viewed or added to the basket, purchase) and, when you place an order, your email address and your telephone number in hashed form, made unreadable, are transmitted to it in order to measure and personalise our advertising.
  • Our accountant and, where applicable, the tax authorities, for invoices and accounting documents.
  • A lawyer or a judicial authority, only in the event of a dispute and to the extent necessary.

Trees are delivered by the Vert Sapin team itself: no external carrier is involved. If an order of decorations has to be sent to you as a parcel, it may be entrusted to a postal service provider, which then receives your name, your address and your telephone number, and nothing else.

5. How long we keep it

  • Invoices and supporting documents: ten years from 1 January of the year following the close of the financial year concerned. This period is imposed by Belgian law and we cannot shorten it, even if you ask for your data to be deleted.
  • Order history and delivery preferences: kept for as long as your customer account exists, then erased. If you ordered without creating an account, this data is erased once the order has been fully performed and once the legal guarantee and complaint periods have expired.
  • Customer account: kept for as long as you use it. You can ask for it to be deleted at any time by writing to info@vertsapin.be. If you no longer use it, we will notify you by email before deleting it.
  • Emails and messages received through the site: kept for as long as it takes to deal with your request, then erased once the matter is closed. If your message relates to an order, it is kept for as long as that order.
  • Offers and news of the season: your contact details are removed from the mailing list as soon as you unsubscribe or withdraw your consent. We then keep only the record of that unsubscription, so that we do not write to you again by mistake.
  • Cookies: each cookie has its own lifespan. Necessary cookies remain only for as long as it takes to make the shop work. Without your consent, the shop places only the cookies necessary for it to function: localization (country and language, 12 months), cart_currency (basket currency, 14 days), cart (basket identifier, 14 days) and _shopify_essential (technical session cookie, erased when the browser is closed). Audience measurement and advertising cookies (Shopify, Google Analytics and Google ads, Meta) are placed only after your consent, each with the lifespan set by its provider. The only exception: the Google map on the home page and on the Our stalls page, described in section 7.

Once these periods have expired, the data is erased or anonymised.

6. Does your data leave the European Union?

The shop is hosted by a company established in Ireland, and therefore in the European Union. Some of our providers, however, belong to international groups whose technical teams may, for maintenance or support, access the data from a country outside the European Union. This is also the case for the Google map on the home page and on the Our stalls page and, if you accept measurement and advertising cookies, for the Google and Meta tools.

In that case, the transfer is permitted only if it is covered by safeguards, either by an adequacy decision of the European Commission, or by the standard contractual clauses adopted by the European Commission, supplemented by security measures. You can ask us for a copy of these safeguards by writing to info@vertsapin.be.

The providers concerned are as follows:

  • Shopify: hosting of the shop, processing of orders and payments. The entity responsible for Europe is Shopify International Limited, established in Ireland, and therefore in the European Union. Its technical teams may access the data from Canada, a country recognised by the European Commission as offering adequate protection, and from the United States, access covered by the European Commission's standard contractual clauses.
  • Google: on the home page and the Our stalls page, which display the map of our stalls, and, if you accept measurement and advertising cookies, for Google Analytics and our Google ads; to the United States, transfer covered by the standard contractual clauses.
  • Meta: if you accept advertising cookies; Meta Platforms Ireland Limited, established in Ireland, may transfer this data to the United States, transfer covered by the European Commission's standard contractual clauses.

No other provider receives your data: the site uses no other audience measurement tool, no other advertising network and no font loaded from a third-party server.

7. Cookies

A cookie is a small file placed on your device when you visit the site.

Necessary cookies

They make the shop work: keeping your basket, securing checkout, remembering your language. Without them, ordering is impossible. They do not require your consent.

The Google map of our stalls

The home page and the Our stalls page display a Google Maps map of our stalls. It loads with the page, and Google may place its own cookies through it. The addresses of the stalls are also written out in full on these pages.

Audience measurement and advertising

If you accept them, three tools place measurement and advertising cookies: the statistics of Shopify, the platform that hosts the shop; Google Analytics and the measurement of Google ads; the Meta pixel, for our advertising on Facebook and Instagram. These cookies are not necessary for the shop to function: they are placed only after your consent, and none is placed if you refuse.

These three tools are connected to the consent banner by the platform itself: until you have accepted, they load nothing and transmit nothing. Apart from the map of our stalls, no call to a Google domain or to a measurement tool from another provider takes place when the pages load. This page will be updated if another tool is added.

Your choice

A banner appears on your first visit. There you accept or refuse the cookies that are not necessary, with an equally simple action in both cases. Until you have made your choice, no measurement or advertising cookie is placed. You can change your decision at any time using the “Cookie preferences” link, under “Terms and Policies”, at the bottom of the page.

You also remain in control through your browser: all browsers allow you to refuse third-party cookies, to delete them, or to browse in private mode.

8. Your rights

You have the following rights over your data at any time:

  • The right of access: to know what data we hold about you and to receive a copy of it.
  • The right to rectification: to correct an address, a misspelt name, a telephone number.
  • The right to erasure: to ask for your data to be deleted, except the data the law obliges us to keep, such as invoices.
  • The right to restriction: to ask for your data to be frozen while a dispute is being checked.
  • The right to object: to object to processing based on our legitimate interest, on grounds relating to your particular situation. And if we send you offers, you can object to this at any time, without giving a reason: we stop immediately.
  • The right to data portability: to receive the data you have provided to us in a machine-readable format, or to ask us to transmit it to another provider.
  • The right to withdraw your consent, at any time, where the processing is based on your consent. Withdrawal does not affect what was done before it.

We do not take any automated decision producing legal effects concerning you.

9. How to exercise your rights

Simply write to info@vertsapin.be, or by post to ONLY WAY SRL, Rue du Pinson 64, 1170 Watermael-Boitsfort. State what you are requesting and the email address used for your order, so that we can find your file.

We reply within one month. If your request is complex, this period may be extended by two months, and we will inform you of this. The procedure is free of charge. If we have serious doubts about your identity, we may ask you for an additional proof of identity.

10. Lodging a complaint

If our reply does not satisfy you, you can lodge a complaint with the Belgian supervisory authority:

  • Data Protection Authority (Autorité de protection des données)
  • Rue de la Presse 35, 1000 Brussels
  • https://www.autoriteprotectiondonnees.be

You also retain the right to bring the matter before the courts.

11. The security of your data

The shop runs over an encrypted connection (HTTPS). Access to orders is restricted to the members of the team who need it, through personal accounts. Bank card data never passes through our computers: it remains with the payment providers.

12. Children

Our shop is intended for adults. We do not knowingly collect data concerning children. If you find that a child has given us their data, write to info@vertsapin.be: we will delete it.

13. Changes to this policy

We may adapt this text, for example if we change provider or add a service. The online version is always the applicable version.

If we change this text on an important point, for example a new purpose or a new recipient, we will inform you before the change applies, by a notice on the site and, if the change concerns you directly, by email. Data already collected is never used for a new purpose without your being informed beforehand and, where the law requires it, without your consent.

25 October 2026