Your data, handled like a good object. Carefully, and not passed around.

INICI BV, Kapellei 31, 2980 Zoersel, enterprise number 0667.947.938, is the controller. We have no data protection officer; you reach us directly at nick@inici.be.

We collect only what is needed for what you ask of us.

• Contact and quotation forms: name, email address, telephone number if you give it, your message and the piece you ask about. Purpose: answering your question, preparing a quotation and planning a visit. Legal basis: steps prior to a contract, at your request.
• Offering an object: name, contact details, description and photographs of the object. Purpose: assessing whether the piece fits the collection. Legal basis: steps prior to a contract.
• Order and delivery: name, address, contact details, order and payment details and delivery instructions. Purpose: performing the contract, delivering, invoicing and handling guarantee and complaints. Legal basis: the contract and our legal obligations on accounting, VAT and guarantee.
• Newsletter: email address. Purpose: news about new pieces a few times a year. Legal basis: your consent, which you withdraw at any time through the link in every email or by writing to us.
• Visiting the site: technical data such as IP address, browser and requested pages, in the logs of our hosting partner. Purpose: keeping the site secure and available. Legal basis: our legitimate interest.
• Statistics: with Google Analytics we measure which pages are visited, which ad or search brought you in and whether you made a request, without your name or email address. Purpose: improving the site and our ads. Legal basis: our legitimate interest. You decline this at any time through the cookie settings at the bottom of every page.
• Business contacts: name, role, company and contact details of customers, suppliers and partners. Purpose: cooperation and invoicing. Legal basis: the contract and our legitimate interest.

We do not use your data for profiling or automated decisions, and we never sell it.

We keep your data no longer than needed:

• Enquiries without an order: 2 years after our last contact.
• Customer and order data: 10 years after the last order, because of the accounting retention duty and the guarantee.
• Newsletter: until you unsubscribe; after that we keep only the proof of your unsubscription.
• Site logs: a short period according to the settings of our hosting partner, at most a few weeks.
• Statistics in Google Analytics: 14 months.

We pass your data only to partners who need it to help us, under a processing agreement or as an independent controller where the law provides for it:

• Hosting of the site and the forms: Railway Corp. (United States).
• Sending the emails from the forms: Resend, Inc. (United States).
• Statistics and ad measurement, unless you decline: Google Ireland Limited (Ireland), with possible transfer to Google LLC (United States).
• The maker, designwerk AG, and the carrier: only what is needed to make and deliver an order, such as the delivery address and a telephone number for the delivery.
• Our accountant, bank and payment provider: for invoicing and payments.
• Authorities: only where the law obliges us.

For a transfer outside the European Economic Area we rely on an adequacy decision, such as the EU-US Data Privacy Framework, or on the standard contractual clauses of the European Commission.

The site always uses technically necessary storage, for instance to secure the forms and to remember your choice about cookies. The site also sets Google Analytics cookies (_ga and related) to count visits and requests, including those through a Google Ads advertisement. On your first visit the site says so; you can decline them through the cookie settings at the bottom of every page. Personalised advertising is off. You change your choice at any time through the cookie settings at the bottom of every page; declining removes those cookies again. The site uses no social media buttons that follow you.

We protect your data with encrypted connections (https), access control and a careful choice of partners. A data breach that poses a risk to you is reported to the supervisory authority and, where the law requires it, to you.

You can ask at any time for:

• access to the data we hold about you;
• correction of inaccurate data;
• erasure, when we no longer need it or when you withdraw your consent;
• restriction of processing during a dispute;
• portability of the data you gave us, in a common format;
• objection to processing based on our legitimate interest, and always to direct marketing.

Email your request to nick@inici.be; we reply within a month and may ask you to prove your identity. You can also lodge a complaint with the Belgian Data Protection Authority. If you live in the Netherlands, you can turn to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We update this notice when our way of working or the law changes. The date at the top says which version applies; important changes are announced on the site.