01 Who is responsible for your data
The controller of your personal data is:
BLOXI TM SRL
Company number (CBE): 1028.365.591
Registered office: Chaussée de Mons 33/04, 7090 Braine-le-Comte, Belgium
Privacy contact: privacy@bloxi.be
For any question about this policy or the exercise of your rights, you can write to us at the address above.
02 What data we collect
Depending on the services you use, we collect:
- Account data — surname, first name, email address, login credentials, preferences.
- Order data — address, telephone, content and history of your purchases.
- Payment data — amount, reference and transaction status (card numbers are not stored by BLOXI).
- Connect journey data — information about your telecom needs and your address, solely for diagnosis and referral purposes.
- Browsing data — pages viewed, audience measurement and cookies (see section 7).
- Contact data — the information you send us via our forms.
We apply the principle of data minimisation : we only collect the data necessary for the purpose pursued.
03 Why we use it, and on what basis
Each processing operation is based on a legal basis provided for by the GDPR:
| Purpose | Legal basis |
|---|---|
| Manage your account and customer area | Performance of the contract |
| Process your orders and invoice you | Contract + legal obligation (accounting) |
| Collect your payments | Contract + legal obligation |
| Provide support and manage the customer relationship (CRM) | Legitimate interest or consent |
| Measure website audience | Consent (except strictly anonymous measurement) |
| Putting you in touch with a provider (Connect) | Consent / pre-contractual measures |
| Respond to your contact requests | Legitimate interest |
| Send you communications | Consent (marketing) / contract (transactional) |
Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing already carried out.
04 How long we keep it
We keep your data only for as long as necessary for the purposes described:
- Account & customer area — for the lifetime of the account, then 3 years after the last activity.
- Invoicing & accounting — 7 years, in accordance with Belgian legislation.
- Prospects with no follow-up — 3 years after the last contact.
- Non-essential trackers / cookies — 13 months maximum.
At the end of these periods, your data is deleted or anonymised.
05 Who has access to your data
Your data is never sold. It may be processed by service providers (« processors ») acting on our behalf, under contract and within the European Union:
| Provider | Role |
|---|---|
| EasyHost | Website hosting (Belgium / EU) |
| Mollie | Payment service provider (EU) |
| Supabase | Database for certain services (EU) |
| [email provider] | Sending emails |
Your data may also be passed on to a partner telecom provider when you choose to subscribe via the Connect service — and only in that case, with only the information needed for that subscription. BLOXI acts as broker, and not as a provider.
06 Transfers outside the European Union
We favour providers established and hosted in the European Union. In principle, your data is not transferred outside the EU. Should such a transfer take place, it would be governed by the safeguards provided for by the GDPR (standard contractual clauses or adequacy decision).
07 Cookies & trackers
Our site uses two categories of cookies:
Strictly necessary cookies
Essential for the site to work (session, basket, logging into your account, payment security, remembering your theme choice and consent). They do not require your consent.
Measurement and personalisation cookies
Used to measure audience and improve our services. They are only placed after your consent. You can accept it, refuse it just as easily, or change your choice at any time via the button Manage my cookies.
No measurement cookie is activated until you have given your consent.
08 Identity data (eID)
Some services may require verification of your identity using your electronic identity card (eID).
High-protection processing. Identity data from the eID is particularly sensitive. It is: processed solely for verification purposes, kept for the strict minimum necessary, stored encrypted, and accessible to a very limited number of authorised persons.
This processing is subject to enhanced protection measures and is only carried out when strictly necessary for the service concerned.
09 Your rights
In accordance with the GDPR, you have the following rights over your data:
- Access — obtain a copy of the data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request the deletion of your data, within legal limits.
- Restriction — request the temporary suspension of processing.
- Objection — object to processing based on legitimate interest.
- Portability — receive your data in a reusable format.
- Withdrawal of consent — at any time, for processing that depends on it.
To exercise these rights, write to us at privacy@bloxi.be. We will reply within one month. Some of these actions are also directly available from your customer area.
10 How we protect your data
We implement appropriate technical and organisational measures: encrypted connections (HTTPS), password hashing, restricted and logged access, data minimisation, and enhanced encryption for the most sensitive data.
11 Changes to this policy
This policy may change along with our services or regulations. Any substantial change will be notified, and the date of the last update appears at the top of this page.
12 Contact & complaints
For any question, contact us at privacy@bloxi.be.
If you believe your rights are not being respected, you may lodge a complaint with the Belgian supervisory authority:
Data Protection Authority (DPA)
Rue de la Presse 35, 1000 Brussels
dataprotectionauthority.be