Privacy policy

Policy version: 29 July 2026 | www.kostr.be

This Privacy Policy explains how KOSTR collects, uses, stores and shares personal data when you visit our website, place an order, request a quotation or contact us.

1. Who is responsible for your personal data?

SCREEN DESIGN BV, trading under the name KOSTR, is responsible for processing personal data in connection with www.kostr.be, orders, quotations, customer support and services.

In this Privacy Policy, “KOSTR”, “we”, “us” and “our” refer to SCREEN DESIGN BV trading under the name KOSTR.

2. What personal data do we process?

Depending on how you interact with KOSTR, we may process the following categories of personal data:

  • Identification and contact details: name, billing address, delivery address, email address, telephone number and language.
  • Business information: company name, professional role, company number, VAT number, billing details and publicly available company information.
  • Order and transaction data: products and services ordered, variants, quantities, prices, discount codes, payment status, delivery method, returns, warranties and order-related communications.
  • Payment data: selected payment method, payment status and payment reference. Full payment-card or bank-account details are generally processed directly by the payment provider and are not stored by KOSTR.
  • Customer account data: account information, order history and preferences when you use a customer account.
  • Project and service data: quotations, plans, photographs, measurements, site addresses, technical information, access details, scheduling details and work records.
  • Communications: messages sent by email, telephone, website forms, social media or other communication channels.
  • Website and device data: IP address, browser type, device type, session information, pages viewed, shopping-cart activity, checkout activity, security information and cookie choices.
  • Marketing preferences: newsletter subscriptions, consent provided or withdrawn and interactions with marketing communications where permitted by law.

KOSTR does not normally request special-category personal data, such as health data, or criminal-offence data. Please do not provide such information unless it is strictly necessary for a specific request.

3. How do we obtain personal data?

We obtain personal data directly from you when you visit our website, place an order, create an account, request a quotation, book a service, contact us or submit a return, complaint or warranty request.

We may also receive personal data from Shopify, payment providers, delivery partners, manufacturers, suppliers and, for professional customers, public sources such as the Belgian Crossroads Bank for Enterprises and VAT-number validation systems.

4. Why do we process personal data?

Orders, quotations and services

We process contact, order, project, payment-status and delivery information to answer your request, prepare a quotation, perform a contract, deliver products, schedule services and handle returns, warranties or support.

Legal basis: performance of a contract or steps taken at your request before entering into a contract.

Payments, invoicing and administration

We process transaction, billing and identification information to monitor payments, issue invoices, maintain our accounts and comply with tax, accounting, product-safety and other legal obligations.

Legal basis: performance of a contract and compliance with legal obligations.

Customer service, quality and disputes

We process relevant communications and case information to answer questions, manage complaints, resolve technical issues, improve our services and establish, exercise or defend legal claims.

Legal basis: performance of a contract, compliance with legal obligations and our legitimate interests in providing customer service and protecting our legal rights.

Security and fraud prevention

We process technical, account and transaction information to protect our online store, payments, customer accounts and business operations, prevent misuse and investigate suspected fraud.

Legal basis: our legitimate interests and, where applicable, compliance with legal obligations.

Newsletter and direct marketing

We send electronic marketing communications on the basis of your consent or another legally permitted basis. You may unsubscribe at any time, free of charge, by using the unsubscribe link in the communication or by emailing info.kostrexterior@gmail.com.

Withdrawing consent does not affect processing that was lawful before the withdrawal.

Analytics and marketing technologies

Non-essential analytics, personalisation and marketing technologies are used only after valid consent has been obtained where required by law.

Legal basis: consent.

5. With whom do we share personal data?

We share personal data only when necessary for the purposes described in this Privacy Policy. Possible recipients include:

  • Shopify: for website hosting, online-store functionality, checkout, customer accounts, security and order management.
  • Payment service providers: to process the payment method selected during checkout, such as Bancontact, payment cards or PayPal when available.
  • Carriers and delivery partners: to plan, track and deliver orders.
  • Manufacturers and suppliers: where necessary for product availability, direct delivery, technical support, product safety or warranty claims.
  • Professional advisers and service providers: such as accountants, legal advisers, insurers, IT providers, security providers and selected software providers.
  • Marketing and analytics providers: only for activated services and where the required consent has been obtained.
  • Public authorities, regulators and courts: where disclosure is required by law or necessary to protect legal rights and safety.

KOSTR does not sell personal data in the ordinary meaning of the term. Service providers acting on our behalf may process personal data only in accordance with their agreements and applicable data-protection law.

6. Shopify

Our online store is hosted by Shopify. Shopify processes personal data on our behalf to operate and secure the store. Depending on the Shopify services you use and the settings activated for the store, Shopify may also process certain personal data for its own purposes.

More information is available in the Shopify Consumer Privacy Policy.

7. Transfers outside the European Economic Area

Some service providers or their group companies may process personal data outside the European Economic Area. In such cases, KOSTR or the relevant provider uses an appropriate legal transfer mechanism, such as an adequacy decision, binding corporate rules or standard contractual clauses approved by the European Commission, together with additional safeguards where necessary.

8. How long do we retain personal data?

We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of statutory retention obligations, warranties, product safety and possible legal claims.

  • Orders, invoices and accounting documents: for the applicable statutory retention period, generally 10 years following the relevant taxable period, or longer where required by a specific legal rule.
  • OSS and cross-border VAT records: for the applicable statutory period, generally 10 years after the end of the year in which the transaction took place.
  • Quotations and commercial enquiries that do not result in an order: generally for up to 3 years after the last substantive contact, unless a contract follows or longer retention is necessary for a legal claim.
  • Project, installation, warranty and complaint records: for as long as necessary for performance, warranty, safety and evidence and, where appropriate, for up to 10 years after the file is closed.
  • Customer accounts: while the account remains active. After deletion, order and invoice information may be retained where a legal or legitimate retention requirement applies.
  • Newsletter data: until you unsubscribe. A minimal record may then be retained to respect your choice and demonstrate compliance.
  • Cookie and consent records: for as long as necessary to record and respect your choices and demonstrate compliance.

Where a dispute, audit or investigation is ongoing, relevant personal data may be retained until the matter has been finally resolved.

9. Security

KOSTR takes reasonable technical and organisational measures to protect personal data against loss, unauthorised access, alteration or disclosure. However, no electronic system can be guaranteed to be completely secure.

Please report any suspected privacy or security issue as soon as possible to info.kostrexterior@gmail.com.

10. Your rights

Subject to the conditions established by law, you may:

  • request access to and a copy of your personal data;
  • request the correction of inaccurate or incomplete personal data;
  • request the deletion of your personal data;
  • request restriction of processing;
  • request data portability;
  • object to processing based on legitimate interests;
  • object to direct marketing at any time; and
  • withdraw your consent at any time where processing is based on consent.

To exercise your rights, email info.kostrexterior@gmail.com. We may request reasonable information to verify your identity.

We respond without undue delay and generally within one month. This period may be extended by up to two additional months for complex or numerous requests. If an extension is necessary, we will inform you in good time.

11. Automated checks

Payment and security providers may automatically screen transactions for fraud or security risks. KOSTR does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects, except where permitted by law and subject to appropriate safeguards.

Please contact us if you believe that a payment or order was blocked incorrectly.

12. Children

Our online store is not specifically directed at children. KOSTR does not knowingly collect personal data from children who cannot independently enter into a valid contract or provide valid consent.

A parent or legal guardian may contact us if they believe that a child’s personal data has been processed incorrectly.

13. Complaints

Please contact KOSTR first where possible so that we can investigate your concern. You also have the right to lodge a complaint with the Belgian Data Protection Authority:

14. Changes to this Privacy Policy

We may update this Privacy Policy when our online store, service providers, processing activities or legal obligations change. The latest version will be published on www.kostr.be and will state the date of the most recent update.

Where required by law or otherwise appropriate, we will inform affected individuals of material changes.

15. Contact

Questions about this Privacy Policy or the processing of your personal data may be sent to:

SCREEN DESIGN BV, trading under the name KOSTR
Alsembergsesteenweg 842
1180 Uccle, Belgium
Company and VAT number: BE 0881.844.915
Email: info.kostrexterior@gmail.com
Telephone: +32 474 21 49 12