Last updated 19 August 2026
What we hold about you, why we hold it, and who else sees it. Short version: we sell you a bed, we take a card payment for it, and we do not track you around the internet.
For anything about your data, write to info@rochehowl.be.
Still to confirm. The registered legal name, address and enterprise number of the organising entity, and whether there is a named contact for data requests. Without this the page cannot legally identify its own data controller.
There is no analytics on this site. No Google Analytics, no tag manager, no session recorder, no advertising pixel, and no error reporting service. We have not put one in and we are not planning to.
The fonts are served from our own server rather than from Google. The only third party your browser talks to on the public pages is Mapbox, which draws the map on the venue page, and it only loads when that map does.
The cookies we set are the session cookie that keeps you signed in, and a small one remembering whether you chose light or dark. Both are functional. That is why there is no cookie banner in your way.
Still to confirm. Confirmation that Mapbox on the marketing pages does not itself require consent. It is the only open question on this section.
Rather than summarise this vaguely, here is the actual list.
Most of it because you are buying a place at an event and we cannot sell you one otherwise. Invoices because Belgian law requires us to issue and keep them. Sign-in records because an account without them is not secure. The emergency contact because it is a house in the Ardennes in January and if something happens to you we need to be able to ring somebody.
Still to confirm. Why full postal address and date of birth are collected, given neither is strictly needed to sell a bed. If the address is only for invoicing and the birth date only for an age check, the page should say exactly that.
Your card number never reaches us. It is typed into a form served by Stripe and goes straight to them. What comes back to us is the amount, whether it worked, and a reference we can use to look the payment up.
These are the companies involved in running the site, and what reaches each of them.
Still to confirm. The production identity and hosting location of the mail provider, the object storage provider, the database and the applications themselves, plus whether any offsite backup exists. Also the mechanism relied on for transfers outside the EEA.
Invoices are kept for as long as Belgian law requires.
Still to confirm. Retention periods for everything else: account data, registration data, sign-in sessions including IP addresses, OAuth tokens, and the organisers’ free-text notes about attendees. Also raw payment provider webhook records, which are currently kept indefinitely because nothing deletes them. Either a deletion job is added or the real retention is stated here honestly.
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to us holding it. Write to info@rochehowl.be.
Still to confirm. Deleting an account does not currently remove the registrations and orders attached to it, because those rows are not linked back to the user by a database constraint. That has to be fixed before this page promises erasure, with a stated exception for invoices we are legally required to keep.
If you think we have handled your data badly, tell us first and we will try to fix it. You also have the right to complain to the Belgian Data Protection Authority, the Autorité de protection des données / Gegevensbeschermingsautoriteit, in Brussels.