Privacy Policy of this website

This Privacy Policy applies to the processing of personal data of visitors/users of the website https://www.internationaldutyfreeonlineshop.com (the “Website”).

1. Why is this Privacy Policy important?

We value your right to privacy and are committed to protect your personal data in accordance with applicable data protection legislation and more specifically with the General Data Protection Regulation 2016/679 (“GDPR”) and the applicable national data protection legislation.

The information in this Privacy Policy will help you better understand what personal data we collect, why we collect it and what we do with it. Further, this Privacy Policy includes important information regarding your rights with respect to the processing of your personal data. 

Therefore, we encourage you to carefully read it, in conjunction with our Cookie Policy and this Website’s Terms of Use.  

By browsing on this website and sharing your personal data with us, you are deemed to accept the terms of this Privacy Policy and the way in which we collect and process your personal data. If, at any time, we require your express consent to process your personal data for a particular purpose, your specific additional consent will be sought.

2. Who is controlling your personal data?

This Website is the property of International Duty Free SA (“IDF”), a Luxembourg company with registered office at Rue de Namur 1, 2211 Luxembourg, Grand-Duché of Luxembourg (registered in Luxembourg with company number B 186199).

The daily operation of this Website (and the web shop operated on this Website) however takes place in the framework of the activities of IDF’s Belgian subsidiary, International Duty Free Belgium NV/SA (“IDF Belgium”), with registered office at Vliegveld 132a, 1820 Steenokkerzeel, and registered in the Belgian Company Register with number 0424.748.350.  In relation to the sale of products through this Website, a contract is concluded between IDF Belgium as seller and passengers as buyers. IDF Belgium therefore largely determines the purposes and the means of the collection of personal data through this Website.


IDF Belgium qualify as “joint data controller” with respect to the personal data they collect in the context of the Website (including the web shop operated under it).

Any reference in this Privacy Policy “we”, “us” or “our” will be meant to designate IDF Belgium. 

3. How is your personal data collected?

We collect your personal data (your name, address, e-mail, phone number, flight data, IP address, personal preferences, and order history) directly from you whenever you contact us (by ordinary mail, e-mail or telephone), when you browse our Website , whenever you register/login to our web shop and whenever place an order in our web shop. Some of these personal data are collected by cookies. For more information on which data these cookies collect, read our Cookie Policy.

We also receive certain data directly from your airline. For example, when you are logged in on their website and you click through to our web shop, some data (such as your name, address, flight number) will already be pre-filled-in. This allows us to enhance your user experience. It also allows us to check your reservation number and flight destination in order to determine the applicable VAT regime. In addition, by connecting to Brussels Airlines’ Miles & More database, we allow you to collect Miles by purchasing certain products on our website. 

4. Why is your data collected and how is it used?

We collect personal data about you insofar as this information is relevant for the purposes for which we have identified, as explained below. 

Anytime certain information is mandatory and other information is optional, this shall be clearly indicated by an asterisk (“*”), so that you can choose whether or not to provide us such information.

We use your personal data for the following purposes: 

Types of personal data

Purpose

Legal Ground

Full name, date of birth, e-mail address, chosen password, gender, Miles & More card number, purpose of travel

Creation of an account on our web shop

Legitimate commercial interests to identify web shop registrants/members

Flight details (airport of departure/arrival, airline, date of travel), chosen delivery method, content of shopping basket, chosen payment method, full name and address, date of birth, e-mail address, telephone/mobile number, chosen password, gender, Miles & More card number, purpose of travel

Follow-up (incl. invoicing) and delivery of orders placed via web shop

Execution of sale/purchase contract

Full name, contact details (incl. telephone/mobile number, full address and e-mail address), purchase history, payment method

Follow-up of (re)payments, product returns and other after-sales services (incl. complaint handling)

Execution of sale/purchase contract

Full name, contact details (incl. telephone/mobile number, full address and e-mail address), purchase history, payment method

Compliance with legal (e.g. product recall) obligations

Legal obligation to ensure product recalls in certain situations

Flight details (airport of departure/arrival, airline, date of travel), chosen delivery method, content of shopping basket, full name and address, date of birth, e-mail address, telephone/mobile number, gender, purpose of travel, purchase history

Advertising and promotional purposes (incl. direct marketing and profiling for targeted advertising - we will in particular retain your shopping history and use details of the products you have previously purchased to make suggestions to you for other products which we believe you will also be interested in)

Legitimate commercial interests to inform you of our products and services, promotions, etc. (insofar as you are our direct customer and have not opted out.

Opt-in consent (in all other cases)

Miles & More number, details of your travel and purchase

Exchanges with Brussels Airlines’ Miles & More database

Legitimate commercial interests to contribute to collection of ‘Miles’ by passengers

IP address and other information collected by specific cookies (e.g. information on your navigation on our Website) – see our Cookie Policy

Aggregation and anonymizing of personal data for statistical/analytical purposes (incl. via cookies)

Consent for tracking/analytical cookies obtained via cookie consent banner

IP address and other information collected by specific cookies (e.g. content of shopping basket, language chosen) – see our Cookie Policy

Proper functioning and improvement of our Website (incl. via cookies - we will in particular retain and evaluate information on your recent visits to our website and how you move around different sections of our website to understand how people use our website so that we can make it more intuitive)

Legitimate commercial interests to operate a functional and visitor-friendly Website

Consent for tracking/analytical cookies obtained via cookie consent banner


For the data processing operations listed above that are based on our legitimate commercial interests (balanced against your privacy interests), more information on the balancing test we carried out can be obtained from us upon request.
For the data processing operations listed above that are based on our legitimate commercial interests (balanced against your privacy interests), more information on the balancing test we carried out can be obtained from us upon request.For the data processing operations listed above that are based on our legitimate commercial interests (balanced against your privacy interests), more information on the balancing test we carried out can be obtained from us upon request. For the data processing operations listed above that are based on our legitimate commercial interests (balanced against your privacy interests), more information on the balancing test we carried out can be obtained from us upon request.

5. Who will have access to your personal data? 

a. IDF Belgium and entities of the IDF Group

IDF Belgium has access to your personal data, as one of the joint data controllers and administrator of the web shop on the Website. We share your personal data with other entities of the IDF Group, including International Duty Free SA in Luxembourg, in the context of the purposes as mentioned above which are managed at group level.

b. our partners (incl. Brussels Airlines)
We share your personal data with Brussels Airlines (in the context of their “Miles & More” loyalty programme), and with our contractual partners (such as logistic firms, airport operating firms), in order to ensure the proper follow-up of orders and deliveries.

d. our service providers (‘data processors’)
In the context of our activities as described above, we share your personal data with third parties, in particular with service providers (IT/cloud service providers, PR/marketing agencies who organise mailing campaigns for us, sales service providers or creative agencies) that act as our ‘data processors’. 
One of our data processors is Worldline (processer of payments). For more information please read the Privacy Notice of Worldline via the following link: https://be.worldline.com/content/dam/worldline-be/terms-and-conditions/en/Privacy-Notice-Worldline-EN-2018-5.pdf.
c. our external auditors, consultants and law firms
Further, we share your personal data with auditors, consultants law firms in case of (threatened) litigation or for the execution of their legal assignments.  
d. government authorities
Finally, we share your personal data with the government, police authorities or the judiciary in case we have a legal obligation to do so.
Note that we will always implement appropriate safeguards when transferring your personal data to third parties. If necessary, we will for example conclude a data transfer or a processing agreement specifying the limitations to the use of your personal data and obligations with respect to the security of your personal data.  
We can also assure you that your personal data will not be transferred to any recipients located in a country outside the European Economic Area.

6. How long do we store your personal data?

Your personal data will not be stored for longer than is necessary in relation to the purposes for which we process them (as listed above). Afterwards it is still possible that they can be found in our (secured) back-ups or archives, but they will no longer be actively processed in a file.
More specifically, the following retention guidelines are applied by us:

• personal data included in accounting, financial or other official documents will be retained for as long as such documents legally need to be kept,
• personal data required for the execution and follow-up of a contractual relationship will be kept for the entire duration of that relationship and for 10 years following termination thereof,
• personal data obtained in the context of complaint handling will be deleted (or anonymised) as soon as the complaint is closed, and
• any personal data used for marketing purposes will be retained for as long as we are sending you relevant mailings and for a maximum of 1 year thereafter. As soon as we note that your contact details are no longer accurate or active, or whenever you decide to use your unsubscribe right, we will no longer keep your personal data for these purposes.

Only where we are legally obliged to, or where this is necessary for defending our interests in the context of judicial proceedings, we can store your personal data for longer periods. 
More information on our retention periods is available upon simple request.

7. What are your legal rights?

Within the limits defined by articles 15-22 of the GDPR, you have the statutory right to: 

• receive information about and access your personal data; 
• rectify your personal data;
• erasure of your personal data (‘right to be forgotten’);
• request restriction of processing of your personal data;
• object to the processing of your personal data; 
• receive your personal data in a structured, commonly used and machine readable format and to (have) transmit(ted) your personal data to another organisation. 

Finally, you have the right to lodge a complaint relating to the processing of your personal data by us with the data protection authority in your country.
These rights can be exercised by contacting ecustomerservice@idfgroup.be

In principle you can exercise these rights free of charge. Only where requests are manifestly unfounded or excessive we can charge a reasonable fee. We also aim to respond as quickly as possible to your requests or questions. We can request a proof of identity in advance in order to double-check your request.
To read more about these rights, and circumstances under which you can use these rights, in particular your right to object (this is your ‘opt-out’ right for our electronic newsletter), please also read the Annex to this Privacy Policy. 

8. Privacy Policy subject to amendments

We may have to amend this Privacy Policy from time to time, you can always view the latest version of our Privacy Policy (date of last amendment: 20-07-2018). Important amendments will be announced on our Website. If you have created an account with us or subscribed to our updates, we will also notify you individually of any changes.

9. Contact

If you have any questions or concerns about this Privacy Policy or the processing of your personal data by us, please feel free to contact us by sending an e-mail to ecustomerservice@idfgroup.be, by submitting a request through the contact form on our Website or by writing to the address mentioned under title 1 above.

Annex – More information about your rights as a data subject (cf. articles 15-22 GDPR)

Right to information and access to your personal data

You may at any time request more information on our processing activities and the personal data that we are keeping from you.

Right to rectification of inaccurate or incomplete personal data

You have the right to require us to, without undue delay, rectify or complete any of your personal data that is inaccurate or incomplete.

Right to deletion of personal data (‘right to be forgotten’)

You may request us to delete (part of) your personal data in the following situations:

- when the processing is no longer necessary for achieving the purposes for which they we collected or otherwise processed these; or

- when the processing was based on your consent and you have decided to withdraw that consent;

- when you have other reasonable grounds to object to the processing of your personal data;

- when we would unlawfully process your personal data;

- when your personal data have to be erased in compliance with a legal obligation directed to us.

We can refuse to delete your personal data: (i) for exercising the right of freedom of expression and information; (ii) for compliance with a legal obligation; or (iii) for the establishment, exercise or defence of legal claims.

Right to restriction of processing

You may request us to (temporarily) restrict the processing of your personal data in the following situations:

- when you have contested the accuracy of your personal data, for a period enabling us to verify this accuracy; or

- when the processing appears to be unlawful and you request us the restriction of use of your data instead of the deletion of this data; or

- when we no longer need the personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims; or

- pending verification whether our legitimate grounds override yours in the framework of an objection.

Right to object to the processing of personal data

You may under certain circumstances object to the processing of your personal data, when such processing is based on our “legitimate interests”. If we agree, we will no longer process your personal data, unless we have compelling legitimate grounds to do so, or because such a processing is necessary.

Where we process your personal data for direct marketing purposes (in particular for sending our electronic newsletter or personalised advertisements), you may at any time object to the processing thereof or withdraw your consent thereto. You also have the right not to be subject to profiling for direct marketing purposes.

Right to data portability

You have the right to receive all your personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.

This right applies only:

- in case the processing is based on consent or on the necessity for the performance of a contract; and

- in case the processing is carried out by automated means.



Cookie Policy of this website

This Cookie Policy serves to inform you of the cookies we use on this website (the “Website”), so that you can easily manage your cookie-settings and preferences. 
This Cookie Policy should always be read together with our Privacy Policy.

1. What are cookies?

Cookies are small text files placed on the hard disk of Website visitors' computers and/or devices. They retain certain information, such as visitors’ language preference or the contents of the shopping basket. Other cookies collect statistics about our Website’s users or make sure that the graphics on the Website appear correctly and that the Website applications work properly.

Our Website’s server will only have access to the information contained in the cookie text file, it will not have access to any other information stored on your computer or device. 

Cookies do not always contain personal data. All cookies contain a unique code (“name of the server that placed the cookie + expiration data + unique number/value”) that allows us to recognize your browser, either during the visit to our Website (‘session cookies’), or at the occasion of repeated visits to our Website (‘permanent cookies’). A permanent cookie remains on your system, although you can always delete or disable it through your browser preferences (as explained under title 3 below).

2. Which types of cookies does this Website use?

We use the following types of cookies on our Website:

Strictly necessary / technical cookies
These are cookies that are essential for the operation of our Website, they enable you to move around our Website and use our features.

Statistical / analytical cookies
These cookies allow us to recognise and count the number of visitors and to see how visitors move around the Website when they’re using it. This helps us to improve the way our Website works, for example by making sure users are finding what they need easily.

Performance cookies 
These cookies collect information about how visitors use our Website, help us understand how visitors interact with our Website, and enable us to understand if any errors have occurred and to test new features. We only use this information to improve the performance of our Website.

Functionality cookies

These cookies help enable specific functionality on the Website to improve your experience, for example remembering your choices and preferences (e.g. chosen language, user name), detecting if a service has already been offered to you (such as surveys), or storing more complex decisions (such as the specific products you are interested in).

Tracking / advertising cookies
These cookies record your visit to our Website, the pages you have visited and the links you have followed. We will use this information to deliver content that is more relevant to you and your interests. These cookies can also be used to deliver targeted advertising, to limit the number of times you see an advertisement, or to track the effectiveness of advertising campaigns. We can also share this information with other parties (including advertisers and our agencies or subcontractors) for this purpose.

Third party cookies
As indicated below, some cookies will not be placed by us, but by our contractual partners. We aim to identify these cookies before they are used, so that you can decide whether or not you wish to accept them. More information about these cookies is available on the relevant third party's website.

The following cookies in particular are used on this Website:

Name of cookie

Type of cookie 

What does the cookie do? How long will the cookie be stored?

What type of information does the cookie collect? Does it collect my personal data / identify me?

Links to more information about this cookie

 .ASPXAUTH

Session Cookie

 Helps to distinguish the logged-in visitor.
Until the end of the browsing session.

 Identifies the current user, does not store personal data.

 https://msdn.microsoft.com/en-us/library/ee920427.aspx

 VisitorId

Session Cookie

 Helps to distinguish the visitor.
Until the end of the browsing session.

 Identifies the current user, does not store personal data.

 /

InternationalDutyFree

Expiration Cookie

 Used to show/hide cookiebar.
10 days

 Does not store personal data nor identifies the current user.

 /

internationaldutyfree#lang

Session Cookie

 Stores language user.
Until the end of the browsing session.

 Does not store personal data nor identifies the current user.

 /

 SiteEntrance*

Session Cookie

 Used to persist site entrance pop-up data.
Until the end of the browsing session

 Does not store personal data nor identifies the current user.

 /

 ShowSiteEntrance

Session Cookie

 Used to show/hide site entrance pop-up.
Untill the end of the browsing session.

 Does not store personal data nor identifies the current user.

 /

 _ga*

Expiration Cookie

 Used for google analytics.
Is stored for 2 years or 10 minutes (depending on the type).

 See documentation in link.

 https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage 

 ai*

ai_session lasts the duration of the session; ai_user lasts for 1 year.

We use Microsoft Azure Application Insights to monitor and improve the performance of the IDF web application.

For more information, see the Application Insights data retention and storage article.

https://docs.microsoft.com/en-us/azure/application-insights/app-insights-data-retention-privacy




3. How do I manage / disable these cookies?

All major Internet browsers allow you to control the cookies that are stored on your computer / device. 

If you do not want this Website to place certain (or any) cookies on your computer / device, you can easily manage or remove them by adapting your browser settings accordingly (even though you will then not be able to take advantage of all the possibilities offered by this Website). You can also set your browser to sending you a notice when you receive a cookie, allowing you to decide whether you want to accept this cookie or not. 

To opt out of being tracked by Google Analytics across all websites, you can visit http://tools.google.com/dlpage/gaoptout.

Please keep in mind that, when you disable certain cookies that we use, graphics may not appear correctly or you may be unable to properly use certain applications on this Website. This may impact your user experience and you may not be able to visit certain areas of our Website.


4. Cookie Policy subject to amendments

We may have to amend this Cookie Policy from time to time. We therefore encourage you to regularly review the content of this Cookie Policy. Important amendments will be announced on our Website. On this web page, you can always view the latest version of our Cookie Policy (date of last amendment: 20/07/2018).

5. Contact

In case you would have any questions about this Cookie Policy or the cookies we use on our Website, do not hesitate to contact us by sending an e-mail to ecustomerservice@idfgroup.be, by submitting a request through the contact form on our Website or by writing to the address mentioned in our Privacy Policy.
ecustomerservice@idfgroup.be