1. Controller

Graphitex SRL, Rue de l’Estampage 3, 4340 Awans, Belgium, VAT BE0476.391.447, is the controller for personal data collected on the site.

Privacy requests can be sent by post to the address above or by email to info{'@'}graphitex.com.

2. General principle

You can usually access the public information on the site without providing personal data such as your name, postal address or email address.

Some data may be requested when you use extra services: account creation, information or quote request, order, delivery, customer service, commercial communication or preference management.

3. Data we may collect

Depending on how you use the site, Graphitex SRL may process the following categories of data.

Identification and contact data: first name, last name, company, email address, phone number, billing or delivery address.
Professional data: company name, VAT number, role or information needed to prepare a quote. Some company data may be prefilled from public company registers when you use VAT lookup.
Order data: selected products, sizes, colors, quantities, personalization options, quote history, cart, order, invoicing and delivery.
Files provided: logos, artwork, mockups, documents or other files needed for textile personalization, plus metadata such as filename, file type, size or file count.
Payment data: payment status, method and technical references received from payment providers, without Graphitex SRL storing full card details.
Technical browsing data: IP address when received by our providers, date and time, pages viewed, URL, UTM or campaign parameters, browser type, device, platform or operating system, technical errors and security context.
Analytics and event data: page views, session, scroll depth, link or button clicks, element labels, forms started or submitted, completed field names and types, searches, favorites, cart, checkout, quote request, product customization, order confirmation, payment status and invoice downloads.
Analytics identity data when you are logged in and have accepted analytics: user ID, email, account type and whether a company is attached, so journeys can be linked to a customer account.
Preferences: language, display theme, cookie preferences and user-experience choices.

4. Purposes and legal bases

Data is collected and processed only for specific, explicit and legitimate purposes. Depending on the case, processing is based on contract performance or pre-contractual steps, legal obligations, Graphitex SRL’s legitimate interest or your consent.

Reply to information, quote or contact requests.
Manage customer accounts, carts, orders, payments, invoices, deliveries, returns and complaints.
Provide the requested personalization services, including from files you send.
Handle customer support, administration and accounting.
Secure the site, prevent fraud and keep the service technically operational.
Measure traffic, understand journeys, detect friction in catalog, cart, quote and checkout flows, and improve the experience when consent is required and given.
Send commercial communications only when legal conditions are met, including consent where required.

5. Cookies, PostHog, dataLayer and browsing

The site uses essential cookies required for operation, for example session, cart, security and remembering your cookie choices.

When you accept analytics cookies, the site may load PostHog Cloud EU through the eu.i.posthog.com host. PostHog receives the browsing and journey events described above to help us measure real site usage and improve services.

Events are also pushed to window.dataLayer, reused by Google Tag Manager when configured. Google Tag Manager manages tags and may send events to tools enabled in the container. Vercel Analytics is not used on the Graphitex storefront.

Form tracking does not intentionally send the values typed into fields: it sends the form name, field names or types, completed-field counts and submission state. Data entered in forms is still processed separately to answer your request, create your account, prepare a quote or manage an order.

You can manage preferences from the cookie banner or cookie settings. Withdrawing consent disables PostHog capture and prevents future analytics loading to the extent controlled by the site.

6. Recipients and processors

Data is accessible only to authorized people at Graphitex SRL and to providers acting for Graphitex SRL when necessary to provide the service.

These providers may cover hosting, database, technical maintenance, email delivery, file storage, payment, delivery, accounting, security, analytics or tag management.

Hosting, deployment and file storage: Vercel and Vercel Blob.
Database and application infrastructure: Neon/PostgreSQL and associated technical providers.
Payment: Mollie.
Transactional emails: Resend.
Analytics and journeys: PostHog Cloud EU.
Analytics tag management: Google Tag Manager, only when configured and after analytics consent.
Technical monitoring and errors: Sentry when production monitoring is enabled.
Delivery, accounting, administrative services and professional advisers when necessary.

7. Retention

Data is kept for as long as necessary for the purposes for which it was collected, then deleted or archived according to applicable legal obligations.

Invoicing and accounting data may be kept for legal retention periods. Contact, quote and order data is kept for a period proportionate to the business relationship or handled request.

Cookie preferences are kept for 12 months. Analytics data is retained according to analytics tool settings and the criteria needed for audience measurement, service improvement and incident resolution.

8. Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area or use entities located in other countries. Where this occurs, Graphitex SRL ensures appropriate safeguards are in place, such as an adequacy decision, standard contractual clauses or another mechanism recognized by applicable law.

The current PostHog configuration uses the European host eu.i.posthog.com. Other technical providers, including Google, Vercel, Resend or Sentry, may involve international processing or access depending on their own infrastructure and contractual commitments.

9. Your rights

Within the limits of applicable law, you have rights of access, rectification, erasure, restriction, objection and portability over your personal data.

Where processing is based on consent, you can withdraw consent at any time, including through cookie settings for analytics or unsubscribe mechanisms for commercial communications.

You can exercise your rights by writing to info{'@'}graphitex.com. To protect your data, Graphitex SRL may request proof of identity when necessary.

You may also lodge a complaint with the competent data protection authority if you believe your rights are not respected.

10. Automated decision-making

Graphitex SRL does not make decisions producing legal effects or similarly significant effects concerning you solely on the basis of automated processing of data collected through the site.

11. Security

Graphitex SRL takes reasonable technical and organizational measures to prevent unauthorized access, loss, alteration or misuse of personal data provided.

No data transmission over the internet can be guaranteed as fully secure. If an incident presents a risk to your rights and freedoms, Graphitex SRL will apply the procedures required by applicable law.

Privacy policy