Privacy Policy
Version 30 September 2026
1. Who is responsible
As Things Develop bv, trading as Brouwerij Hoppug, is the controller for the processing of personal data described below. Contact address: Bel 32, 2440 Geel, Belgium. Company and VAT number: BE 0729.994.383. For privacy questions or requests: info@hoppug.be.
2. What data we use and why
- Orders, payments and delivery: your name, billing and delivery addresses, email, any phone number supplied, products ordered, amounts, payment status, transaction references and 18+ confirmation. We use these to perform the contract and communicate about your order. We also process invoicing and accounting data to comply with legal obligations.
- Contact and keg enquiries: the contact details and message you provide. For quotations or preparing an order, processing is necessary to take steps at your request before entering a contract. For other enquiries, we rely on our legitimate interest in being available and answering your question.
- Withdrawal, returns and complaints: your name, email, order reference, relevant products, statement and receipt date. We use these to give effect to consumer rights and to demonstrate how a request was handled. The legal bases are contract performance, legal obligations and our legitimate interest in retaining evidence in a dispute.
- Security: technical data such as IP address, time, browser information and errors may be processed in server logs to identify faults and abuse. Local form protection temporarily uses an IP-derived identifier protected with a secret key and submission counts. We rely on our legitimate interest in securing the website and forms.
- Instagram: we load external media through Elfsight only with your consent. These services may then receive your IP address, device and browser details, the widget visited and usage data. You may withdraw consent at any time.
You need to provide the information necessary to fulfil an order or enquiry; for example, we cannot ship without a delivery address. Optional fields are identified as such. We do not sell your personal data or automatically use order details for newsletters.
3. Payments and other recipients
Online payments are handled by Stripe and your chosen payment service or bank. Stripe receives the information needed for payment and fraud prevention. Hoppug receives information including payment status and a transaction reference, but does not store full card numbers or card security codes. Stripe may also act as an independent controller for its own legal and security purposes. Our bank processes payment information for bank transfers.
For delivery, we share the necessary name, address and contact details with the carrier handling your parcel. Hosting and email providers support the website, storage and correspondence. Our accountant and, where legally required, competent authorities receive the necessary administrative information. Access is limited to people and providers who need the data for their tasks.
When you allow external media, Elfsight and Instagram/Meta are recipients. Following a link to Instagram, Facebook or another website takes you to that service, where its own privacy policy applies.
4. Processing outside the European Economic Area
International services such as Stripe and Instagram/Meta may process data outside the EEA, including in the United States. Such transfers require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses. Stripe describes its mechanisms in its Data Transfer Addendum; Meta explains these in its privacy policy. Information about the relevant services is linked above. You may request an explanation and a copy of, or reference to, the applicable safeguards at info@hoppug.be. Consent to a widget is not treated as a general exemption from these transfer rules.
5. How long we keep data
- Order and accounting records: data needed for tax evidence is retained for the ten years following the taxable period concerned. Unnecessary data is not automatically subject to this period.
- Enquiries and keg requests that do not lead to an order: for as long as the enquiry or quotation remains open and follow-up is needed. Once closed, we remove data no longer needed. If an order follows, necessary supporting records are retained for the order-related periods.
- Withdrawals and complaints: during handling; records evidencing a refund or accounting adjustment follow the tax retention period. For an ongoing dispute, relevant evidence is retained until final resolution and expiry of the applicable limitation period.
- Local form protection: submission counters expire after one hour. A withdrawal confirmation form remains usable for one hour. Server logs are kept only as needed for fault and incident investigation; records of an identified incident may be needed longer while the investigation continues.
- Browser storage: see the overview below. Retention periods for data independently controlled by Stripe or Meta are described in their own privacy policies.
When closing a case, we assess what data remains necessary. Backups are for recovery and are not intended as an active customer archive.
6. Cookies and similar storage
Functional storage supports your basket, preferences and secure payments. WooCommerce visit-attribution tracking is disabled. The contact form uses local spam protection and does not load Google reCAPTCHA.
| Storage | Purpose | Retention |
|---|---|---|
| hoppug_consent_v1 | Your cookie choice | 6 months |
| hoppug_age_v1 (sessionStorage) | Your age-gate answer; no date of birth | Tab session |
| woocommerce_items_in_cart / woocommerce_cart_hash | Basket contents and changes | Browser session |
| wp_woocommerce_session_* | Links your browser to your basket | Normally 2 days as a guest; up to 7 days when logged in |
| __stripe_mid / __stripe_sid | Stripe payment security and fraud prevention | 1 year / 30 minutes respectively |
| elfsight_viewed_recently / Instagram | Elfsight/Instagram, only after consent | Elfsight: 15 seconds; Instagram: depends on the cookie and your account, see the linked cookie policy |
More information: Stripe, Elfsight, Instagram/Meta.
7. Changing your choice
Instagram content stays disabled until you consent. Use Cookie settings at the bottom of any page to allow or reject external media and withdraw consent just as easily. Withdrawing consent reloads the page without the widget. You can also remove cookies already placed by external services in your browser. You can order without allowing external media.
8. Your rights
You may request access, correction, erasure or restriction of your personal data. Where applicable, you may object to processing based on legitimate interests and receive your data in a portable format. You may withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal. Erasure is not unlimited: data required by law or needed for legal claims may be exempt.
Send requests to info@hoppug.be. We normally respond within one month. For complex requests, the statutory period may be extended; we will explain why within that first month. If there is reasonable doubt about your identity, we ask only for additional information necessary to verify it, rather than routinely requesting a copy of your identity card.
You may complain to the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, or another competent supervisory authority.
9. Security and automated checks
We apply appropriate technical and organisational safeguards, including encrypted connections and restricted access, proportionate to the data and risks. No system can guarantee absolute security. Local spam checks may block a form; if so, email us directly. Payment services may use automated fraud assessment. If a payment is declined, contact us or choose another available payment method. Hoppug does not use its own automated profiling to make decisions with legal effects about you.
10. Changes
We update this policy and its version date when needed. Where required, we inform you of material changes before the new processing starts.