Privacy Policy

Your data belongs to you. We collect only what we need, keep it only as long as we must, and never sell it. This document details exactly what happens.

The house behind the data

LIMINATE SRL is the data controller for all personal data collected via liminate.com.

Registered office: Avenue Reine Astrid 59 A, 1780 Wemmel, Belgium.
VAT: BE 0787.743.829
Contact: contact@liminate.com

Only what is necessary. Nothing more.

When you visit the site — IP address, browser type, pages visited, referrer. Purpose: security and audience analysis.

When you create an account — email, first name, last name, chosen password (encrypted, we never see it).

When you order — shipping address, billing address, phone number (optional), payment method (never stored by us — handled by Stripe / Mollie / Shopify Payments certified PCI-DSS).

When you subscribe to the newsletter — email, first name, preferred language.

When you contact us — the email you send and its content, kept in our support inbox.

Six purposes, all declared

• Order execution — process, prepare, and ship your order (contractual basis)
• Customer support — respond to your questions (legitimate interest)
• Legal compliance — issue and archive invoices for 10 years (legal obligation)
• Analytics — understand how the site is used and improve it (consent)
• Personalization — offer relevant recommendations (consent)
• Marketing — send newsletters and promotions if you opted in (consent)

Never longer than necessary

Active account — kept as long as your account is active + 3 years of inactivity, then anonymized.

Order history and invoices — 10 years (legal obligation Belgian tax law).

Email marketing (Klaviyo) — as long as your consent is active. Deleted immediately upon unsubscribe. Automatic suppression after 24 months of no engagement.

Navigation data (analytics) — 14 months, then anonymized.

Support conversations — 3 years.

Cookies — never more than 13 months. See our Cookie Policy.

A short list, no more

Your data is accessed only by:

• LIMINATE team — Andreas Couscouras and future employees (with strict access controls)
• Shopify — our e-commerce platform (data processor, contractually bound)
• Klaviyo — our email marketing platform (data processor, contractually bound)
• Stripe / Mollie / Shopify Payments — payment processors (never stored by us)
• Shipping carriers (Bpost, DPD, DHL) — only shipping address, only when relevant
• Legal authorities — only if legally required by court order

Where your data travels

Some of our data processors (Klaviyo, Google Analytics, Meta) are US-based companies. Data transfers to the United States are protected by:

• Standard Contractual Clauses (SCC) approved by the European Commission
• Data Privacy Framework (DPF) certification for each provider
• Encryption in transit and at rest
• Pseudonymization of identifiers whenever possible

Six rights, always active

Under GDPR, you hold at all times:

• The right to access your data
• The right to rectification of inaccurate data
• The right to deletion (right to be forgotten)
• The right to portability in a machine-readable format
• The right to object to processing
• The right to restriction of processing

To exercise any of these rights, write to contact@liminate.com. We respond within 30 days maximum.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (APD): autoriteprotectiondonnees.be

What we do to protect your data

• All connections encrypted via HTTPS/TLS 1.3
• Two-factor authentication on all admin accounts
• Password manager with unique 20+ character passwords
• Regular backups (Shopify + Klaviyo)
• Cloudflare protection against attacks
• Documented data breach response plan (72h notification obligation)
• Annual security audit

In the event of a data breach that presents a risk to your rights, we notify the Belgian Data Protection Authority within 72 hours and inform you directly if the risk is high.

Not for under-18s

LIMINATE products are designed for adults (18+). We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, contact us at contact@liminate.com and we will delete it.

This document evolves with our practices

This policy may be modified at any time to reflect legal or technical developments. The last update date is indicated at the top of this page. Substantial changes are communicated via a banner on the site during the 30 days following the update, and via email if you have an active account.