Privacy policy
This policy explains how Better Merch CO. SRL processes your personal data, in accordance with the General Data Protection Regulation (GDPR).
Last updated: 21 October 2026
Data controller
Better Merch CO. SRL, Rue des Anciens Étangs 55, 1190 Brussels, Belgium. Privacy contact: info@sustainity.co.
Data collected
Through our forms (contact, quote request, project brief): name, email address, company, phone (optional) and the content of your message or request. No data is collected without your knowledge. If you attach a file to your request from a form, it is passed on to us with the request and is not stored on the site. If you drop a logo in PDF, PNG or JPG format into the preview tool on a product page, it is passed on to us as soon as you drop it, with the position and size you chose; an SVG stays on your device. Your file is kept for 30 days, even if you remove it from the preview, then deleted. We use it to prepare your quote and to know which companies are interested in our products; it is linked to your name and email address only if you send a request from the same tab. If you subscribe to our newsletter, we collect your email address in order to send it to you. If you request our welcome offer, that same address also serves to check that this is indeed a first order and to send you our commercial communications. When you send a request, we attach to it the origin of your visit, so that we know which advertisement or campaign prompted it: the click identifier and the campaign parameters (for example the source, campaign or keyword of the advertisement) that the advertising platform or the link you followed adds to the page address, the first page of the site you viewed, the site you came from (its domain only) and the page from which you send the form. If you refuse the “Advertising” category or have not chosen yet, none of this is stored on your device: this information exists only for the duration of your visit and is attached to a request only if you send it during that visit. If you accept the “Advertising” category, it is also stored on your device for ninety days at most, counted from when it is placed, so that it stays attached to a request sent during a later visit; we keep the first known origin and, if you come back from another advertisement or campaign, the most recent one. It is deleted from your device as soon as you withdraw that consent. It is kept with your request, in our systems and with the providers that track our requests, Brevo and HubSpot, for 24 months, like the request itself. The click identifier is passed on to Google, to measure how effective our advertisements are, only if you have accepted the “Advertising” category. If you agree to audience measurement, we also collect browsing data: pages viewed, where the visit came from, device type, and an identifier placed on your device. This data carries neither your name nor your address. There is one exception, if you have also accepted the “Advertising” category: when you send a quote request or a project brief, the email address and, where provided, the phone number you give are added to it in hashed form (see “Audience measurement and advertising”).
Purposes
To handle and respond to your contact, quote and brief requests; to get back to you about them; to prepare a commercial proposal. Sending you our newsletter if you have asked for it. Sending you our welcome offer and checking its conditions, then sending you our commercial communications (offers, news, sourcing tips), if you have asked for them.
Legal basis
Pre-contractual measures taken at your request (Art. 6.1.b GDPR) and legitimate interest in responding to your enquiries (Art. 6.1.f GDPR). Sending the newsletter and sending our commercial communications each rest on your consent (art. 6.1.a GDPR), obtained through a box that is never pre-ticked, time-stamped, and withdrawable at any time. These two consents are distinct: the one given in the footer covers the newsletter only. Audience measurement and advertising rest on your consent (art. 6.1.a GDPR), obtained through the banner shown when you arrive and withdrawable at any time through the “Manage cookies” link. The origin of your visit attached to your request rests on our legitimate interest in knowing which advertisements and campaigns lead to requests (Art. 6.1.f GDPR). Storing it on your device and passing the click identifier to Google rest on your consent to the “Advertising” category.
Recipients and transfers
Your data is shared with Brevo (Sendinblue SAS, France, European Union), our provider for sending emails and tracking requests. Tracking of your quote, project and contact requests is also handled by HubSpot Ireland Limited (Dublin, Ireland), whose data is hosted in the European Union. The site is hosted by Vercel Inc. (United States): this transfer outside the EU is governed by the European Commission’s Standard Contractual Clauses. A copy of your requests is kept in a Redis database provided by Upstash, a sub-processor of Vercel, under the same terms. No data is sold or shared with third parties for commercial purposes. If you agree to audience measurement and advertising, your browsing data is also passed to Google Ireland Limited (Ireland), for measurement as well as for advertising, and to LinkedIn Ireland Unlimited Company (Ireland) for advertising. With your consent to “Advertising”, Google also receives, in hashed form, the email address and, where provided, the phone number given in a quote request or a project brief: for Google Ads and, if you have also accepted audience measurement, for Google Analytics. These providers may transfer data to the United States; those transfers are governed by the European Commission’s standard contractual clauses.
Retention period
Your data is kept 24 months, then deleted or anonymised. Addresses subscribed to the newsletter or to our commercial communications are kept until you unsubscribe.
Your rights
You have the right to access, rectify, erase, object, restrict and port your data. To exercise it, write to info@sustainity.co. You may lodge a complaint with the Data Protection Authority (DPA, Belgium: dataprotectionauthority.be).
Cookies and local storage
Three families of trackers, and you decide about two of them. Strictly necessary trackers do not ask for your agreement: they remember the display language, and your browser keeps locally the quote you are preparing, your list of favourites, and the fact that our welcome offer has already been shown to you, so as not to show it twice, which leave your device only if you send your request. When you drop a logo into the preview tool, your browser also keeps, for as long as the tab is open, a random identifier used only to link your logos to the request you send; it is erased when you close the tab and is not read by any audience measurement. Audience measurement and advertising, on the other hand, are placed only after you agree, never before: until you have chosen, nothing is loaded. You can change your mind at any time through the “Manage cookies” link in the footer. Our measurement trackers are kept for fourteen months at most, and our advertising tracker for four hundred days at most, counted from when it is placed; the ones that keep the origin of your visit, for ninety days at most, also counted from when they are placed. Google and LinkedIn also place advertising trackers of their own, for which they alone set the duration; it is stated in their privacy policies.
Audience measurement and advertising
If you agree to it, we measure traffic to the site with Google Analytics, in order to know which pages are useful and which are not. We also measure how well our advertisements work, with Google Ads and LinkedIn, which means recognising that a visit came from an advertisement and led to a request. If you have accepted the “Advertising” category, the email address and, where provided, the phone number you enter when sending a quote request or a project brief are also passed on to Google Ads and, if you have also accepted audience measurement, to Google Analytics, to measure how effective our advertisements are. They are hashed in your browser before being sent, so Google does not receive them in plain text. Without your consent to “Advertising”, neither receives them. These tools place trackers on your device. If you refuse, they are not loaded at all, and the site works exactly the same: no feature depends on them.