Privacy Policy

Who is responsible

Kerala Keuken Spices, Kloosterstraat 19, Drongen 9031, Gent, Belgium, rageenajomon@keralakeukenspices.com is the controller for personal data processed through this webshop.

What we process and why

• Orders (name, email, phone, delivery address, purchase details): to fulfil your order — legal basis: contract.
• Customer accounts (email, name, saved address, order history, loyalty points): to provide your account — legal basis: contract.
• Order confirmations and service emails: legal basis: contract. We do not send marketing email without your consent.
• One thank-you email after your order is handed over, inviting you to review us: legal basis: legitimate interest in feedback about your own purchase. Every one of these carries an unsubscribe link, and unsubscribing never affects your order emails.
• Checkouts we could not complete (name, email, phone, and the items that were out of stock): so we can offer you an alternative or tell you when the item is back — legal basis: legitimate interest in recovering a sale you were trying to make. You can ask us to delete this at any time; see Your rights.
• The network address your order was placed from, with the network it belongs to, your browser's identification and the random number from the "order check" cookie described in our Cookie Policy: used only to spot repeated fake orders — cash-on-handover costs the person placing it nothing, so a run of orders nobody can confirm is both a cost to us and stock other customers cannot buy. Legal basis: legitimate interest in preventing fraud. We do not use it to profile you, we do not combine it with anything else, and it is deleted after 90 days.
• Technical data strictly needed to run the site (see Cookie Policy).

Who receives your data

Our technical providers process data on our behalf under data processing agreements: Cloudflare (hosting; our database and images are stored on servers in the European Union), Stripe (online payments), Resend (transactional email), GitHub (encrypted off-site backups of the shop's data) and Google (only if you sign in with Google). We never sell personal data.

Some of these providers are based outside the European Union. Where that is the case, the transfer is covered by the data processing agreement we have with them, including the European Commission's standard contractual clauses.

Retention

Order data is kept as long as required by Belgian accounting law (7 years). Account data is kept until you ask us to remove it. Details of a checkout we could not complete, and the network address an order was placed from, are deleted automatically after 90 days — they are kept separately from the order itself so that the shorter period really applies to them.

Your rights

You can request access, correction, deletion, restriction and portability of your data, and object to processing, by emailing rageenajomon@keralakeukenspices.com. We handle these requests by hand and will reply within one month. Deleting your account does not remove invoice data we are legally required to keep for 7 years. If you subscribed to our mailing list, email us and we will remove you. You can complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).