Geode-Concept SRL Privacy Policy – Last updated: February 2026

Geode-Concept SRL attaches great importance to the protection of your personal data. This privacy policy explains what data we collect, why, how we use it, with whom we share it, how long we keep it, and what your rights are. It applies to all processing of personal data carried out via our website [www.vwx-plants.com] (hereinafter the "Site"), as well as within the framework of our commercial relationships (B2B and B2C customers).

1. Who is the data controller?

Data Controller: Geode-Concept SRL

Registered Office: Rue de la Chapelle, 47 - B-6990 Hotton

Company Number (BCE): BE 0838 443 056

VAT Number: BE 0838 443 056

GDPR Contact Email: support@vwx-plants.com

2. What personal data do we collect?

We only collect data necessary for the purposes described below. Depending on the case, we process:

Data collected automatically

• IP address

• Browser type and version

• Operating system

• Referral source (referrer)

• Pages visited and navigation path on the site

• Date and time of connection

• Session duration

• Language preferences

Data you provide directly to us

• Title, first name, last name

• Email address

• Phone number (optional)

• Full postal address (billing and/or delivery if applicable)

• Company name and VAT number (professional customers)

• Payment data (not stored by us – managed by Stripe/Mollie/PayPal/etc.)

• Content of your messages (support, pre-purchase, claims)

Purchase data

• Products ordered

• Amount and date of the transaction

• Order number

• Order status

3. Why do we collect this data? (Purposes and legal basis)

4. Cookies and trackers

We use cookies and other trackers. You will find all the details in our Cookie Policy (link to be inserted on the site). Strictly necessary cookies are exempt from consent. All others (statistics, marketing, social networks, etc.) are subject to your prior consent via our cookie banner.

5. With whom do we share your data?

We never sell your personal data. Possible recipients:

• Technical service providers (web hosting, maintenance, emailing)

• Payment service providers (Stripe, Mollie, PayPal, etc.)

• File delivery / CDN providers (if applicable)

• Accountant / auditor (strictly limited data)

• Judicial or administrative authorities in case of legal obligation or proceedings

All our sub-processors are located within the European Union or provide adequate safeguards (Standard Contractual Clauses, BCR, adequacy decision, etc.).

6. Transfers outside the European Union

No transfer of personal data outside the EEA is carried out to date. Should such a transfer take place in the future, we would inform you and implement appropriate safeguards (Art. 44 et seq. GDPR).

7. Retention period

Retention periods are indicated in the table in Section 3. At the end of these periods, data is either deleted or irreversibly anonymized.

8. Your GDPR rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access

• Right to rectification

• Right to erasure ("right to be forgotten")

• Right to restriction of processing

• Right to data portability

• Right to object (notably to commercial prospecting)

• Right to withdraw consent at any time (when processing is based on consent)

• Right to lodge a complaint with a supervisory authority

Competent supervisory authority in Belgium: Data Protection Authority (APD/GBA) Rue de la Presse 35, 1000 Brussels https://www.dataprotectionauthority.be contact@apd-gba.be

9. How to exercise your rights?

You can exercise your rights by contacting us:

• By email: support@vwx-plants.com

• By mail: Rue de la Chapelle, 47 - B-6990 Hotton (Belgium)

We will respond within one month (extendable by two months in case of complexity). We may request proof of identity.

10. Data security

We implement appropriate technical and organizational measures to ensure a level of security adapted to the risk (encryption of connections, restricted access, backups, regular updates, etc.).

11. Modification of the policy

We may modify this policy from time to time. The applicable version is the one published on the Site at the time of data collection or order placement.