CAA Media SRL, with registered office at Jan Van Rijswijcklaan 228, 2020 Antwerp, Belgium, holds the intellectual property of the ICONYC Group and owns and operates www.iconyc.cc (the "Website"). Together with the ICONYC Group companies listed in our Terms and Conditions, we take the confidentiality and security of your personal data seriously.

This Privacy Policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. Our use of cookies is explained separately in our Cookie Policy.

CAA Media SRL is the controller for personal data processed to run the Website and keep it secure, for customer accounts, the newsletter and marketing communications, contact and trade enquiries, and job applications submitted through the Website.

When you place an order, the ICONYC Group company named as the seller at checkout and in your order confirmation is the controller for the personal data needed to perform your purchase, including payment, delivery, returns and invoicing.

Several ICONYC Group companies are established outside the European Union, in the United Kingdom, Switzerland, Japan, South Korea, the United States and the United Arab Emirates. Where they process personal data of people in the European Union, CAA Media SRL acts as their representative in the European Union under Article 27 GDPR, and can be contacted at privacy@iconyc.cc.

When you visit the Website, our servers automatically record technical data such as your IP address, browser and device type, the pages requested and the time of each request. We use it to operate the Website and keep it secure, not to identify you. To apply the right legal drinking age, your approximate country is derived from your IP address. Some forms are protected against automated abuse by Cloudflare Turnstile, which analyses technical signals from your browser.

If you accept analytics cookies, Google Analytics collects information about how you use the Website, such as the pages you visit, how you arrived, your device and browser type, your approximate location and a random online identifier stored in a cookie. Google Analytics is not loaded unless you accept, and you can withdraw your consent at any time through Cookie Settings at the bottom of every page. Details are in our Cookie Policy.

To enter the drinks pages you are asked for your year of birth. It is not stored. Only a confirmation that you passed the check is kept in your browser for the duration of your visit.

When you create an account, we collect your name, email address, date of birth, country, telephone number and password. Your date of birth is used to confirm that you are of legal age to buy alcohol. Your password is stored only in encrypted form.

When you buy something, we collect your name, billing and delivery addresses, email address, telephone number and order details. Payments are processed by Stripe, including card payments, Apple Pay, Google Pay, Klarna and PayPal. We do not receive or store your full card details. Stripe tells us whether a payment succeeded and whether it was flagged as a fraud risk.

When you use our contact form, we collect your name, surname, email address, the department you write to and your message. For trade enquiries we also collect your company, position and telephone number.

When you subscribe, we collect your email address and a record of your consent. Our newsletter is designed and sent with our own mailing system, so your email address is not passed to an external mailing service.

When you apply for a position, we collect your name, location, email address, telephone number, the position you apply for, your salary expectations, preferred work arrangement, portfolio link, your answers to our questions and your CV. Please do not include sensitive information, such as health data, in your application unless we ask for it.

To provide the Website, prevent misuse and fraud, and protect our systems. Legal basis. Article 6(1)(f) GDPR, our legitimate interest in a secure and functioning Website.

To make sure alcohol content and products are only offered to people of legal drinking age in their country. Legal basis. Article 6(1)(c) GDPR, compliance with legal obligations on the sale and promotion of alcohol, and Article 6(1)(f) GDPR.

To measure how the Website is used, in aggregated form, so we can improve it. Google signals and ad personalisation are switched off and the data is not used for advertising. Legal basis. Article 6(1)(a) GDPR, your consent given through the cookie banner, which you can withdraw at any time.

To create and manage your account and give you access to members only content. Legal basis. Article 6(1)(b) GDPR, performance of the contract for your account.

To process your order and payment, deliver your purchase, handle returns, warranty claims and disputes, and prevent payment fraud. Legal basis. Article 6(1)(b) GDPR, performance of a contract, Article 6(1)(c) GDPR, accounting and tax obligations, and Article 6(1)(f) GDPR, our legitimate interest in preventing fraud. The controller is the company that sells to you.

To answer your questions and handle trade and business enquiries. Legal basis. Article 6(1)(b) GDPR, steps taken at your request before entering into a contract, and Article 6(1)(f) GDPR, our legitimate interest in responding to enquiries.

To send you news, invitations and offers about ICONYC Group products and events by email or other channels you have chosen. Legal basis. Article 6(1)(a) GDPR, your consent. If you are already a customer, we may also send you information about similar products by email under Article 6(1)(f) GDPR, as permitted by the Belgian Royal Decree of 4 April 2003. You can unsubscribe at any time through the link in every message.

To assess your application and, if you agree, keep it for future openings. Legal basis. Article 6(1)(b) GDPR, steps taken at your request before entering into an employment contract, and Article 6(1)(a) GDPR, your consent for keeping your application for future openings.

To comply with the law, respond to requests from authorities and establish, exercise or defend legal claims. Legal basis. Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.

Providing your personal data is voluntary. Fields marked as mandatory are needed to provide the service you request, such as an account, an order or a reply to your message. If you do not complete them, we cannot provide that service.

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. The only exception is fraud screening by Stripe, which may automatically decline a payment that appears fraudulent, as necessary to perform the contract. In that case you can contact us to obtain human review, express your point of view and contest the decision.

We only share personal data where necessary for the purposes above, with the following recipients.

• ICONYC Group companies, as controllers for the orders they sell to you, or where needed to provide a service you request or to assess a job application.
• ICONYC Solutions SL, Spain, which hosts the Website on its own servers in Spain, managed from its office in Zaragoza, develops and maintains the Website, runs our newsletter system and operates the IP geolocation service for the age check, as our processor.
• DigitalOcean, which stores media files for the Website in Frankfurt, Germany, as our processor.
• Stripe, our payment processor, which also acts as an independent controller for fraud prevention data. Klarna and PayPal act as independent controllers when you choose them.
• Google Ireland Limited, for Google Analytics, as our processor and only if you accept analytics cookies.
• Cloudflare for protection against automated abuse, and Font Awesome for the icons on the Website.
• Carriers and delivery partners, to deliver your orders.
• Professional advisers and authorities, such as lawyers, auditors, courts and public authorities, where required by law or to defend our rights.

Our processors act only on our instructions under written agreements that meet Article 28 GDPR. We do not sell your personal data and do not share it with third parties for their own advertising.

Some recipients are located outside the European Economic Area. Transfers to the United Kingdom, Switzerland, Japan and South Korea rely on adequacy decisions of the European Commission. Transfers to the United States rely on the EU US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses approved by the European Commission. Transfers to the United Arab Emirates rely on the Standard Contractual Clauses.

You can request a copy of the safeguards that apply to your data at privacy@iconyc.cc.

We keep personal data only for as long as needed for the purpose for which it was collected, after which it is deleted or anonymised.

• Customer accounts. While your account is active, and deleted two years after your last activity or when you close your account.
• Orders and invoices. Ten years, as required by Belgian accounting law. Group companies outside Belgium keep these records for the period required by their local law.
• Contact and trade enquiries. Two years after our last exchange.
• Newsletter. Until you unsubscribe. We keep a record of your consent and its withdrawal for as long as needed to prove it.
• Job applications. Six months after the recruitment process ends, or up to two years if you agree that we keep your application for future openings.
• Technical logs. 30 days, unless needed longer to investigate a security incident.
• Website analytics. 14 months in Google Analytics. The analytics cookies themselves expire after two years, or as soon as you withdraw your consent.
• Age check and country. Only in your browser, for the duration of your visit.

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encrypted connections, access controls and encrypted storage of passwords. Only authorised staff who need the data for their work can access it. If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.

Under Articles 15 to 22 of the GDPR, you have the following rights in relation to your personal data.

Our shop and drinks pages are for adults only. We do not knowingly collect personal data from children under 13, the age of digital consent in Belgium. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy when our processing or the law changes. The version published on this Website is the one in force. If you have an account or subscription, we will inform you of material changes by email before they take effect.