Secure checkout

Back to cart

Privacy policy

Privacy policy

Last updated: October 2026

In short

  • We use your data to process your orders, manage your account and answer you. Nothing else.
  • We never sell or rent your data.
  • Statistics and video cookies are only turned on with your consent. You can change your mind at any time.
  • You can ask us at any time to see, correct or delete your data: This email address is being protected from spambots. You need JavaScript enabled to view it..

1. Who is responsible for your data?

The data controller is Seven Foxes SRL, which runs the Grimages.com shop:

  • Avenue de Marlagne 24, 5000 Namur, Belgium
  • Company number: BE 0747.727.270
  • E-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.

For any question about your data, write to us at this address: a real person will answer you, not a robot.

2. What data, why and for how long?

We only collect what we need. The GDPR requires us to explain, for each use, which « legal basis » it relies on: performing your contract (your order), our legitimate interest, a legal obligation or your consent.

Your orders and their delivery

Data
Name, delivery and billing addresses, e-mail, phone, order contents, chosen shipping and payment methods, VAT number if you have one.
Why
Prepare and ship your order, keep you updated, issue the invoice, handle a return or refund.
Legal basis
Performance of the contract; legal obligation for invoicing and accounting.
Duration
7 years for invoices and accounting records (Belgian law), then deleted.

Your customer account

Data
Username, e-mail, password (encrypted, we never see it), address book, order history, favourites, saved carts, loyalty points.
Why
Let you order faster, find your orders and invoices, keep your favourites and use your points.
Legal basis
Performance of the contract (the terms of the account you create).
Duration
As long as your account exists. You can ask for its deletion at any time; invoices are kept for 7 years.

Payment

Data
Amount, order reference, payment status. Your bank details (card, account) are entered with our payment provider: we do not see them and do not keep them.
Why
Collect payment for your order and prevent fraud.
Legal basis
Performance of the contract; legal obligation.
Duration
7 years (accounting records).

Your messages: contact form, e-mail, phone, social networks

Data
Name, e-mail, possibly phone, and the content of your messages.
Why
Answer you and follow up on your request.
Legal basis
Your request (pre-contractual steps) or our legitimate interest in answering you.
Duration
3 years after our last exchange.

Paillette, the site's assistant (« Help »)

Data
The questions you ask Paillette and her answers; if you are logged in and your question needs it, your own account data: first name, orders and products bought, loyalty points, favourites, cart, downloadable files, city and country of your addresses (never your phone number, street or payment details). Don't share sensitive data with her (health, bank details).
Why
To answer you straight away from the site's pages (FAQ, shipping, terms of sale, catalogue).
Who
The answers are written by Claude, an artificial intelligence model by Anthropic, PBC (United States), our processor. Anthropic does not use these conversations to train its models and deletes them from its servers within 30 days.
Legal basis
Your request (you choose to write to Paillette) and our legitimate interest in answering you quickly.
How long
On our side, the conversation is only kept during your visit (it is erased when you close the tab). If you click « Write to Stéphanie », it is attached to your message and kept like it (3 years after our last exchange).

Appointments in the shop

Data
Name, e-mail, phone, type of appointment, chosen date and time, your optional message for Stéphanie, the date of a cancellation.
Why
Check that the e-mail address is really yours (one click in the confirmation e-mail, otherwise nothing is booked), book your slot, confirm the appointment and remind you the day before. If you don't have an account yet, confirming your appointment opens your customer account with this address: it's used for your purchases at the shop and your loyalty points.
Who
Stéphanie and the Grimages team. The appointment (name, phone, e-mail, message) is also written in the shop's Google calendar (Google Ireland Ltd., our processor).
Legal basis
Your request (pre-contractual measures); for the customer account, the performance of our sales in the shop.
Duration
The history of your appointments is kept with your customer account. You can ask for its deletion at any time at This email address is being protected from spambots. You need JavaScript enabled to view it.. A request never confirmed expires after 30 minutes.

Automatic e-mails

Data
Name, e-mail, products concerned.
Why
  • Confirmations and updates (account, order, shipping): needed for the service.
  • « Back in stock » alert: only if you asked for it on a product page.
  • Cart reminder: one e-mail if you left a cart while logged in.
  • Invitation to leave a review after an order, through Trustindex (see below).
Legal basis
Performance of the contract for confirmations; your request for the stock alert; our legitimate interest for the cart reminder and the review invitation.
Your choice
You can refuse the cart reminder and review invitations: a simple e-mail to This email address is being protected from spambots. You need JavaScript enabled to view it. is enough.

Website security

Data
IP address, browser, pages requested, answers to the anti-robot checks (Google reCAPTCHA) on the contact and registration forms.
Why
Protect the shop and your data against spam, robots, fraud and attacks.
Legal basis
Our legitimate interest in securing the website.
Duration
Technical logs are deleted after a few months.

Visit statistics

Data
Pages viewed, products viewed, device type, approximate country and city, where the visit came from. Google Analytics 4 does not store your IP address.
Why
Understand what interests you and improve the shop.
Legal basis
Your consent (« Audience measurement » category of the cookie banner).
Duration
14 months at most at Google.

We do no profiling and make no automated decisions about you, and we use no advertising cookies.

3. Cookies and external services

A cookie is a small file stored by your browser. On your first visit, a banner lets you accept everything, refuse everything or choose category by category. Until you have made your choice, no external service that needs your consent is loaded. Your choice is kept for 6 months, then the banner asks again.

You can also use the « Manage cookies » link at the bottom of every page, or delete cookies in your browser settings.

Necessary Always on

The shop does not work without them, so they do not need your consent.

Session (random name)
Your cart, your login, the chosen language and currency. Deleted when you close the browser.
joomla_remember_me_*
Only if you tick « Remember me » when logging in. Up to 60 days.
gri_consent
Remember your cookie choice. 6 months.
gri-bot (tab storage)
Show your conversation with Paillette from page to page. Erased when you close the tab.
Google reCAPTCHA (_GRECAPTCHA)
Check that the contact and registration forms are filled in by a human. Google Ireland Ltd. 6 months.

Audience measurement With your consent

Google Analytics 4, Google Ireland Ltd. Visit statistics (see point 2).

_ga, _ga_131HPW38R0
Tell visits apart. 2 years.

Without your consent, Google Analytics is not loaded at all.

Videos With your consent

YouTube, Google Ireland Ltd. The demonstrations on the product pages, in « privacy-enhanced mode » (youtube-nocookie.com).

YouTube cookies
Playing the video and the player's preferences. Up to 6 months.

Without your consent, we show a plain picture: the video only loads when you click it.

Other external content, without tracking cookies

  • Trustindex customer reviews (Trustindex Kft., Hungary): the reviews and rating shown on the site come from their servers, which therefore receive your technical IP address.
  • Links to Facebook, Instagram and TikTok: these are plain links. Nothing is sent to these networks until you click. Once on their site, their own privacy policy applies.

Fonts and icons are hosted on our own server: no data is sent to Google Fonts or Font Awesome.

4. Who your data is shared with

Your data is only accessible to the people in our team who need it, and to the providers below, only for the service they provide to us. Each one only receives what is strictly necessary and commits to complying with the GDPR.

Website and e-mail hosting

Infomaniak Network SA, Switzerland.

Payment

Mollie B.V., Netherlands (Bancontact, cards, banking apps); PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, if you choose PayPal.

Delivery

bpost SA, Belgium; PostNL B.V., Netherlands; Mondial Relay SAS, France. Depending on the method chosen: name, address, phone and e-mail for parcel tracking.

Invoicing and accounting

Billit NV, Belgium (electronic invoicing) and our accountant.

Customer reviews

Trustindex Kft., Hungary: your name and e-mail after an order, to invite you to leave a review.

Website services

Google Ireland Ltd (Analytics, reCAPTCHA, YouTube); Anthropic, PBC, United States (site assistant).

We may also pass data to the authorities (tax, courts, police) when the law requires it. We never sell, rent or hand over your data to anyone.

5. Transfers outside the European Union

  • Switzerland (Infomaniak): a country recognised by the European Commission as offering equivalent protection.
  • United States (Google, Anthropic): only for the services listed above, with the safeguards provided by the GDPR: the EU–US Data Privacy Framework for Google, and the European Commission's standard contractual clauses.

6. Security

The website is fully encrypted (HTTPS), passwords are encrypted, access to the administration is protected and reserved to our team, and regular backups are made. No system is infallible: in case of a breach that would put you at risk, we inform you and the Data Protection Authority, as the law requires.

7. Your rights

At any time, you can ask us for:

  • access to your data and a copy (free, also in electronic form);
  • rectification of inaccurate data (most can also be changed in your account);
  • erasure of your data (« right to be forgotten »), except what we must keep by law, such as invoices;
  • restriction of a processing, or to object to it, in particular for the cart reminder and the review invitations;
  • portability: receive your data in a common format to pass it on to someone else;
  • withdrawal of your consent, as easily as you gave it (« Manage my cookies » button). This does not affect what was done before.

Write to us at This email address is being protected from spambots. You need JavaScript enabled to view it. or by post to Seven Foxes SRL, Avenue de Marlagne 24, 5000 Namur, Belgium. We may ask you to prove your identity, so as not to give your data to someone else. We answer within one month.

If you are not satisfied with our answer, you can lodge a complaint with the Belgian Data Protection Authority: Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, This email address is being protected from spambots. You need JavaScript enabled to view it..

8. Minors

To create an account and order, you must be at least 16 years old or have a parent's consent. If you think a child has given us data without this consent, let us know and we will delete it.

9. Changes to this policy

We may update this policy, for example if we add a service to the website. The date at the top shows the latest version. In case of an important change, we let you know on the website or by e-mail.