Privacy Policy

Last updated: 29 September 2026

Who we are

This privacy policy explains how Cuppy ("we", "us") handles your personal data when you visit cuppy.online, place an order, sign up for emails or contact us. C-Light Projects BV, trading as Cuppy, is the data controller.

Cuppy is a trade name of C-Light Projects BV, Molenweg 132, 3660 Oudsbergen (Opglabbeek), Belgium. Enterprise number 0834.221.180, VAT BE0834.221.180. Email: sales2@c-lp.be.

What we collect and why

Data	Why	Legal basis (GDPR)
Name, email, delivery and billing address, phone number (optional), order contents	To process, ship and support your order, and to handle returns, withdrawals and guarantee claims	Contract (Art. 6(1)(b))
Payment details	To take payment. Card data is processed by the payment provider; we never see or store your full card number	Contract (Art. 6(1)(b))
Invoices and order records	To keep the accounts we are legally required to keep	Legal obligation (Art. 6(1)(c))
Email address for news and offers	Only if you sign up. You can unsubscribe with one click in every email	Consent (Art. 6(1)(a))
Messages you send us	To answer your question	Legitimate interest (Art. 6(1)(f)) or contract
Technical data (IP address, browser, pages visited)	To run the shop securely and prevent fraud	Legitimate interest (Art. 6(1)(f))
Analytics and marketing cookies	Only if you accept them in the cookie banner	Consent (Art. 6(1)(a))

We only ask for what we need. A phone number is optional unless a carrier needs it for delivery. We do not sell your personal data.

Cookies

When you first visit, a cookie banner lets you accept or decline non-essential cookies. Essential cookies (for example your cart and checkout) are always on because the shop cannot work without them. Our website also stores one small setting in your browser so the welcome-discount pop-up does not keep reappearing; it contains no personal data. You can change your cookie choice at any time with the "Cookie preferences" link in the footer.

Who we share data with

Shopify hosts our shop and checkout (Shopify International Ltd., Ireland, and its group companies). Read the Shopify privacy policy.
Payment providers selected at checkout process your payment.
Suppliers and fulfilment partners pack and ship your order. They receive your name, delivery address, phone number (if given) and the items ordered.
Carriers receive what they need to deliver your parcel and send tracking updates.
Our email provider stores the messages you send us.
Authorities, if the law requires it.

Transfers outside the EU

Some products ship directly from a supplier outside the EU, for example in China. For those orders we share your name, delivery address, phone number (if given) and order contents with that supplier, because this is necessary to deliver the order you placed (Art. 49(1)(b) GDPR). The product page tells you when an item ships from outside the EU. Shopify may process data outside the EU under the European Commission's Standard Contractual Clauses or an adequacy decision.

AI and automated decisions

We do not use your personal data for automated decision-making or profiling that has legal or similarly significant effects on you. Some illustrations and texts on this website were created with the help of AI tools and reviewed by us. We do not feed your personal data into AI tools.

How long we keep data

Order and invoice data: as long as Belgian accounting and tax law requires.
Newsletter: until you unsubscribe.
Customer service messages: as long as needed to handle your question, and no longer than 2 years after the last contact.
Cookie data: as set out in the cookie banner.

Your rights

You have the right to access, correct, delete or port your data, to restrict or object to processing, and to withdraw consent at any time without affecting earlier processing. Use our privacy request form or email sales2@c-lp.be. We reply within one month. We may ask you to confirm your identity first.

You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be, or to the authority in your own EU country.

Children

Our shop is not aimed at children. You must be 18 or older to place an order. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.