Privacy Policy

Hexade VOF
Rombautstraat 2 bus C, 1760 Strijtem, Belgium
Company / VAT number: BE 0805.495.720
E-mail: hello@starrednight.com

Given our size, we are not legally required to appoint a Data Protection Officer. For any question about this policy, please contact us at the address above.

• Order and contact data: name, e-mail address, phone number (if provided), billing and delivery address.
• Poster content: the date, time, location, title, names and any quote you enter.
• Payment data: handled directly by Shopify / Shopify Payments. We never see raw card details.
• Technical data: IP address, browser type, device, language setting and pages visited.
• Cookies and tracking pixels: see our Cookie Policy.

We process your data on the following legal bases (GDPR art. 6):

• Performance of the contract (art. 6.1.b): processing your order, fulfilment, customer service and after-sales.
• Legal obligation (art. 6.1.c): retaining accounting and tax records as required by Belgian law (7 years).
• Consent (art. 6.1.a): marketing cookies, newsletter, Meta and Google Analytics tracking beyond strictly necessary cookies.
• Legitimate interest (art. 6.1.f): security, fraud prevention, and basic statistics.

We share your data only with processors required to deliver our service. We have a data-processing agreement in place with each of them.

• Shopify International Ltd. (Ireland) — checkout and order management.
• Shopify Payments — card payments; StarredNight never sees raw card numbers.
• An EU-based print and shipping partner — receives your name, address, e-mail and the rendered artwork file in order to produce and ship your poster.
• Cloudflare Inc. (USA) — CDN and object storage (R2); covered by the EU-US Data Privacy Framework.
• Vercel Inc. (USA) — website hosting; also DPF-compliant.
• Google Ireland Ltd. — analytics (GA4) where you have consented. We use both the client-side gtag.js tag and the server-side Google Analytics 4 Measurement Protocol so that our statistics remain accurate even when browser-based trackers are blocked. Personal data (email, phone, address) is SHA-256 hashed before leaving our servers.
• Meta Platforms Ireland Ltd. — advertising cookies / Meta Pixel where you have consented. In parallel we send the same conversion events server-side via the Meta Conversions API; personal data is SHA-256 hashed before leaving our servers. The server-side Purchase event is deduplicated against the Pixel using a shared event id, so no conversion is counted twice.
• Our e-mail delivery provider — transactional e-mails such as order confirmation and shipping notifications.

We do not sell your personal data to third parties.

Some of our processors are located outside the European Economic Area (notably in the United States). Such transfers take place under the EU-US Data Privacy Framework or, where applicable, under the European Commission's Standard Contractual Clauses.

• Customer account: until you delete it, or after 3 years of inactivity.
• Order and invoice data: 7 years (Belgian tax law).
• Analytics (GA4): a maximum of 14 months.
• Marketing cookies: a maximum of 13 months.
• Support correspondence: up to 3 years after the last contact.

Under the GDPR you have the following rights (art. 15–22):

• The right of access to your data.
• The right to rectification of inaccurate data.
• The right to erasure ("right to be forgotten").
• The right to restriction of processing.
• The right to data portability.
• The right to object to processing based on legitimate interest.
• The right to withdraw your consent at any time.

You can exercise these rights by e-mailing hello@starrednight.com. We may ask you to confirm your identity before we act on your request.

Lodging a complaint

You always have the right to lodge a complaint with the Belgian Data Protection Authority: www.gegevensbeschermingsautoriteit.be.

We do not make decisions about you based solely on automated processing that would produce significant effects on you.

We take appropriate technical and organisational measures to protect your data against loss, unauthorised access and misuse. All connections to our website use TLS encryption.

We may update this policy from time to time. The most recent version is always available on this page, with the date of the last update at the top.