Privacy policy

Working draft — 18 October 2026

1. Controller

TSH INVEST SRL, trading as VLUGER, Place Madou 7, 1210 Brussels, Belgium, company number 0506.845.487, VAT BE 0506.845.487. Email: contact@vluger.com.

2. Personal data collected

We may collect names, date of birth where requested, contact details, account identifiers, business and VAT details, billing and delivery addresses, orders, subscription and payment references, project briefs, uploaded files, communications, and security and access logs.

3. Purposes and legal bases

We process data to perform contracts (accounts, orders, projects, delivery and subscriptions), meet legal obligations (tax and accounting), pursue legitimate interests (security, fraud prevention and support) and, where required, on the basis of consent (non-essential cookies or marketing).

4. Payments and billing

Payments are processed through Stripe and billing may be managed through Odoo. VLUGER does not intend to store full payment-card numbers in its own systems.

5. Recipients and processors

Authorised personnel and technical providers, including Stripe, Odoo and OVHcloud, may access information as needed. Other processors and any transfers outside the EEA must be assessed and documented before final publication. VLUGER does not sell personal data.

6. Retention

Information is retained only as necessary for contractual performance, statutory accounting and tax retention, security and support, and agreed project-file availability. Specific retention periods must be documented before final publication.

7. Security

VLUGER implements appropriate technical and organisational security measures. No system is completely risk-free.

8. Your rights

Subject to the GDPR, individuals may request access, rectification, erasure, restriction, objection, and portability where applicable; consent may be withdrawn. Contact contact@vluger.com. Complaints may be lodged with the Belgian Data Protection Authority at autoriteprotectiondonnees.be.

9. Cookies

Essential cookies may support login and security. Non-essential cookies require appropriate information and consent where legally required. A technical cookie inventory must be completed before publication.

10. Client-provided third-party data

Clients must have a lawful basis to provide personal data relating to others. Where VLUGER acts as processor, the parties will enter into an Article 28 GDPR data processing agreement where required.

11. Updates

We may update this policy to reflect changes in services, processing or applicable law.