How we handle your personal data

1. Controller

E. Van Ranst, Zonen, with its registered office at Industriepark Brechtsebaan 3, 2900, Schoten (KBO 0403.750.721, VAT BE0403.750.721), is responsible for the processing of your personal data. If you have any questions about this statement or about your data, you can contact us at info@vanranst.be.

2. What data we process

• Identity and contact details: name, company name, VAT number, email address, telephone number.
• Order data: the orders you submit and the details needed for them.
• Delivery details: for shipments we receive a contact person and a delivery address through our webshop.
• Engraving content you provide: texts, logos and — when you order this — an image of a fingerprint that is engraved into a piece of jewellery.
• Language preference: the language you choose for the customer portal and for our emails to you (Dutch, English or French), stored on your customer account.

3. Fingerprint engraving (biometric data)

An image of a fingerprint is biometric data and falls under the special categories of personal data (Article 9 GDPR). We process a fingerprint for one purpose only: producing the engraving you ordered. We never use the fingerprint for identification, authentication or any other purpose.

Our customers are professional jewellers (B2B). When you, as a jeweller, submit a fingerprint, it is usually the fingerprint of your own end customer. When uploading, you therefore expressly confirm that you have obtained the valid, explicit consent of the person concerned to provide their fingerprint to us for this purpose and to have it processed (Article 9(2)(a) GDPR). In doing so, you act as controller towards your end customer; E. Van Ranst, Zonen processes the fingerprint only on your instructions, to carry out the order.

Submitted fingerprint files are kept for as long as necessary to produce the engraving and to complete the order, and are deleted afterwards. The person concerned may withdraw their consent at any time; please contact the jeweller who placed the order or contact us directly at info@vanranst.be.

4. Purposes and legal basis

• Performance of the contract — processing and following up your orders and managing your portal account.
• Legal obligation — accounting and tax obligations (including invoicing).
• Legitimate interest — the proper functioning and security of the portal.

5. Recipients and processors

We do not share your data with third parties for commercial purposes. To run our services and the portal we rely solely on specialised processors, who process your data only on our behalf and in accordance with strict instructions:

• Database and account provider (Supabase) — for the secure storage of your account data and the management of your logins.
• Hosting provider (Vercel) — for running and delivering the portal and the web application itself.
• Error monitoring and diagnostics services (Sentry) — to detect technical errors in the portal and to ensure stability.
• ERP and invoicing software partners (Optedo) — for the administrative handling, processing and invoicing of your orders.
• Cache and security service (Upstash) — to slow down repeated requests when logging in and on certain forms, and so prevent abuse. Your IP address is processed for this purpose; when logging in with a staff badge, the IP address is kept for a maximum of 15 minutes, and an irreversibly encrypted form of the badge identifier is also kept for a maximum of 24 hours in order to detect repeated failed attempts. Legal basis: legitimate interest (security).
• Backup service (Cloudflare R2) — for a daily safety copy of the file storage (photos, engraving files, submissions, 3D files (STL)). A file that we delete (including following a deletion request) disappears from the backup mirror at the next nightly synchronisation; the previous version remains in a protected retention folder for up to 365 days, after which it is permanently deleted.
• Analytics service (Vercel Analytics and Vercel Speed Insights) — for anonymised visit and performance statistics (e.g. loading times) about the use of our website and the portal, without cookies and without personal profiles.
• Email service (Microsoft 365) — for sending portal notifications and order-related emails from our company domain.

Where is your data processed? Our database and account data (Supabase) are processed in London (United Kingdom), on the basis of the European Commission's adequacy decision for the United Kingdom; Vercel hosts the application. Our backup service (Cloudflare R2) also keeps the safety copy in the EU (Western Europe region). Error monitoring (Sentry) runs on European, German infrastructure. Email is handled by Microsoft 365. Our cache and security service (Upstash) runs in the EU region of Frankfurt, Germany (region code eu-central-1).

6. Retention period

We do not keep your data for longer than necessary for the purposes described above. Invoicing and accounting data are kept for the legally required period of 10 years. Other order data are kept for 10 years after your last order or after the end of our contractual relationship, after which they are deleted or anonymised. Requests, lists and submissions that you send in through the customer portal and that remain unprocessed for 28 days are closed automatically; for archived requests, orders and multi-orders we as a rule erase the free text, such as engraving texts, names, remarks, delivery information and the reason for a rejection (also for a rejected list or submission), and the attached files 28 days after archiving (for a rejected order, after 7 days), while the business data (number, customer, quantities) are kept. Maker’s marks that you upload through the customer portal stay in your stamp library until you ask us to delete them; the file name is kept as the label of the stamp. For every entry on the precious metal account we also keep an audit trail (what, when, through which channel and which staff member carried it out) for 10 years, in line with the accounting retention obligation. For administrative actions on your account (approval, blocking, linking to your customer file) we keep an administration log showing which staff member did what and when; we keep that log for 2 years. We keep your language preference for as long as your customer account exists; it disappears together with the account. Data in our registers of custom tooling (striking dies and moulds), such as the customer’s name and the design, are kept for as long as the tooling can remain in use.

7. Your rights

You have the right of access, rectification, erasure and restriction of your data, the right to data portability and the right to object to certain processing. You exercise these rights by sending an email to info@vanranst.be. We respond within 30 days of receiving your request.

8. Cookies

We use strictly necessary, functional cookies only. These are the session cookie for your authentication (keeping you logged in), which expires automatically at the latest 30 days after your last visit, and the vr_taal cookie, which remembers the language preference of the portal (Dutch, English or French) and remains valid for one year. The language cookie contains no personal data and is not used to track you. We do not use analytical or marketing cookies — our visit statistics (see point 5) are also collected without cookies. This is why no cookie consent is required.

9. Lodging a complaint

If you believe that we are not processing your data correctly, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels — gegevensbeschermingsautoriteit.be.