What personal data we hold, why we hold it, how long we keep it, and what you can ask us to do about it.
Privacy policy — Anthracite Brussels
Version 1.0 — 4 August 2026
This page says what personal data we hold, why we hold it, how long we keep it, and what you can ask us to do about it. It covers this website and the service sold on it. It is written to be read, not to be survived.
In one minute
- We are a very small company. One person runs it. We hold a customer file and an accounting ledger, and that is close to all.
- We run no advertising and no audience measurement on this site. Nothing profiles you, and we embed nobody who does it for us. The cookie page lists every single thing stored on your device.
- When you buy the service, we read your accounting — but there we are not the ones deciding. You are. That relationship has its own contract, and it is public.
- We never sell, rent or trade personal data. There is no scenario in which that happens.
- You can ask us anything about your data at the address below, and we answer.
1. Who is responsible
The controller is Charbon Cinéma SRL, trading as Anthracite Brussels, rue Berthelot 172, 1190 Forest, Belgium — company number BE 0669.654.643.
Write to support@anthracite.brussels for anything on this page, including to exercise your rights. We have no Data Protection Officer, and none is required of us: we are not a public authority, we monitor nobody on a large scale, and we process no sensitive data on a large scale.
2. When you browse this site
We store three technical cookies that make the site work, and — once you have a cart and have answered the consent banner — a fourth that remembers your answer. Nothing else, and nothing is sent to a third party. Our web server keeps ordinary access logs — the address of the page, the time, the IP address — because a server that logs nothing cannot be defended when it is attacked.
The legal basis is our legitimate interest in serving and protecting the site. The full list of what is stored on your device, with real durations, is on the cookie page.
3. When you order
To sell you something we need to know who is buying: name, company, address, VAT number, email, and the content of the order. The legal basis is the performance of the contract, and for the invoice, our legal obligation to issue and keep one.
The card itself never reaches us. Our payment processor is Stripe, which handles the payment and its fraud checks as an independent controller — it decides how it does that, not us. We receive the result of the payment, not your card.
4. When we prepare your filings
The service reads the accounting of the company you name. There, most of what we see is data about a legal person, which is not personal data at all. What remains is real: the wording of bank transactions, the name of a supplier who trades in their own name, and the identification of the company itself.
For that reading we are a processor, not a controller. You decide what happens, we execute. That is exactly what the data processing agreement says, and you accept it on screen before the first reading — not at payment. It is public at /data-processing and it is the text that governs, not this page.
5. When you write to us
An email to us is kept as long as the exchange is useful, and longer if it becomes evidence of what was agreed. The legal basis is our legitimate interest in answering you and in being able to show what was said.
6. If we write to you first
We may write to a company's impersonal address — the kind that starts with info or contact — to present what we sell. Belgian law allows this without prior consent when the recipient is a legal person and the address is impersonal. Every such message says how to stop receiving them, and one click is enough. You can also object to the processing itself, at any time, without giving a reason.
7. Who else sees it
| Who | What they see | Why |
|---|---|---|
| OVH | everything hosted, at rest | our servers are theirs, in the European Union |
| Stripe | your payment and its context | it is the payment processor |
| Odoo S.A. | orders placed on the Apps Store | it sells the modules and invoices them |
| our accountant | invoices | the law requires books to be kept |
Nobody else. We do not sell, rent, or exchange personal data, and we do not share it for anyone else's advertising.
8. How long we keep it
| What | How long | Why that long |
|---|---|---|
| invoices and accounting records | 7 years | articles III.86 and III.88 of the Code of Economic Law |
| the accounting we read for you | as stated in the processing agreement | it is your data, not ours |
| customer file and correspondence | while the relationship lives, then the limitation period | so we can answer a claim |
| server logs | a few months | enough to investigate an incident, no more |
9. Outside the European Union
Our hosting is in the European Union. Stripe operates worldwide and may process a payment outside the EU under the guarantees its own policy sets out.
We currently transfer nothing to an advertising platform, because we run no advertising measurement on this site. If that ever changes, this page changes first — and a consent banner appears before anything is measured. Not the other way round.
10. What you can ask for
You may ask to see your data, to have it corrected, to have it deleted, to have its use restricted, to receive it in a portable form, and to object to a processing based on our legitimate interest. Where a processing rests on your consent, you may withdraw it, and withdrawing is as easy as giving it.
Write to support@anthracite.brussels. We answer within a month, and we say so if we need longer.
If you think we have handled this badly, you can complain to the Belgian Data Protection Authority — rue de la Presse 35, 1000 Brussels — at contact@apd-gba.be. We would rather you told us first, but that is your right and not our permission to give.
11. When this page changes
Every version carries a number and a date, and the old ones are kept. A change that affects what we do with your data is announced on this page before it takes effect, never after.