Who we are
Demo-Spel is a game shop, webshop and board game café in Leuven. We handle your personal data with care and comply with the General Data Protection Regulation (GDPR). This page explains which data we keep, why, for how long, and what your rights are.
Data controller:
- Demo-Spel bv
- Sint-Hubertusstraat 3, 3000 Leuven, Belgium
- Company / VAT number: BE 0550.596.645
- Email: [email protected]
- Phone: +32 16 84 36 30
For any privacy question, email us at [email protected] or drop by the shop.
Which data we keep and why
We only ask for what we need to help you. We never sell your data.
|
When |
Which data |
What for |
|---|---|---|
|
Webshop order |
name, email, phone, billing and delivery address, items ordered, payment status |
processing your order, delivering it or getting it ready for pickup, invoicing, customer service |
|
Purchase in the shop |
purchase and payment method; name and contact details only if you have a loyalty card or ask for an invoice |
sale, warranty, exchanges, accounting |
|
Loyalty card (points) |
name, email, phone if given, purchases and points balance |
earning and redeeming points, telling you when your discount is ready |
|
Newsletter |
name, email, whether you open and click the mail, your interests based on your purchases (e.g. board games, Warhammer, card games) |
news, events and offers that suit you; you can unsubscribe at the bottom of every newsletter |
|
Pre-order or order by email |
name, email, phone, the item |
recording your pre-order and letting you know when it has arrived |
|
Table reservation |
name, number of people, date and time, contact details |
getting your table ready |
|
Events and tournaments |
name, player name if applicable (e.g. Discord or the publisher's player account), results |
registration, running the tournament, awarding prizes or store credit |
|
Second-hand games on consignment |
name, contact details, the games you offer, sale price, your signature on the agreement, your store credit |
carrying out the agreement, telling you when a game sells, keeping track of your credit |
|
Store credit and gift cards |
name, email, balance |
keeping your credit and reminding you of it |
|
You email or call us |
what you tell us yourself |
answering your question |
|
You visit our website |
technical data and cookies (see Cookies) |
making the webshop work, remembering your cart, statistics |
|
You react on our social media |
what you share with us on Facebook or Instagram |
replying to your message |
|
Photos at events or in the café |
recognisable images of visitors |
showing what we do on our website and social media; see below |
Camera surveillance. Security cameras are in use in the shop and the café, indicated by the legal pictogram at the entrance. They serve to prevent and investigate theft and damage (legitimate interest). We keep the footage for at most one month, unless it is needed as evidence after an incident. Only the owners can view it, and we only pass it on to the police or the courts. We comply with the Belgian Camera Act.
Photos. We sometimes take photos in the shop and during events. We do not put you online in a recognisable way without your consent. If you do appear somewhere and would rather not, let us know and we will remove the photo.
Minors. To order in the webshop you must be at least 16 or have a parent's consent. For a loyalty card or newsletter under 16, we ask for a parent's consent.
Legal basis and retention
We only process your data when there is a legal basis for it:
- Contract: to carry out your order, reservation, pre-order, consignment or loyalty card.
- Legal obligation: we must keep invoices and accounting records.
- Legitimate interest: customer service, fraud prevention, camera surveillance, a reminder about your own credit or points, and mails to existing customers about similar products. You can always object to this.
- Consent: the newsletter, recognisable photos and non-essential cookies. You can withdraw your consent at any time.
|
Data |
Retention |
|---|---|
|
Invoices and accounting records |
10 years (legal obligation) |
|
Customer profile, loyalty card and purchase history |
as long as you are a customer; deleted 3 years after your last purchase or points activity, unless you still have credit |
|
Store credit and consignment agreements |
as long as there is credit or a running agreement, then according to accounting rules |
|
Newsletter |
until you unsubscribe |
|
Table reservations |
1 year |
|
Emails and customer questions |
3 years, unless needed for an ongoing order or invoice |
|
Tournament results |
as long as the event or ranking is relevant, at most 3 years |
|
Camera footage |
at most 1 month |
Who we share data with
We work with a number of service providers who process data on our behalf. They only receive what they need and may not use it for their own purposes.
|
Service provider |
What for |
|---|---|
|
Lightspeed |
point of sale, webshop, loyalty card and newsletter, café till |
|
Mollie (webshop) and Lightspeed Payments (shop and café) |
processing your payment securely (Bancontact, Visa, Mastercard and other cards); we never see your full card number |
|
bpost |
delivering your parcel (name, address, email and phone if given) |
|
Google (Workspace) |
email, calendar for reservations and events, documents |
|
Meta (Facebook, Instagram) |
publishing our own posts and replying to messages |
|
Discord |
communication and event sign-ups in our community |
|
GitHub |
secure storage and running of our own automations |
|
Anthropic |
AI assistance in handling emails, orders and invoices; your data is not used to train AI models |
|
Card game publishers (e.g. the organisers of official tournaments) |
only when you take part in an official tournament: your player name and results |
|
Our accountant |
accounting and tax returns |
Some of these providers are located outside the European Union (mainly the United States). In that case the transfer is based on a decision of the European Commission (EU-US Data Privacy Framework) or the Commission's standard contractual clauses.
We also share data when the law requires it, for example with the tax authorities.
Cookies
Our webshop runs on Lightspeed and uses cookies:
- Essential cookies: your cart, your language choice, logging in and secure payment. These are needed for the webshop to work.
- Analytics and marketing cookies: only if you consent in the cookie banner. You can change your choice at any time via the cookie settings or by clearing the cookies in your browser.
Social media and our publishing app
Demo-Spel has a Facebook page (Demo-Spel Leuven) and an Instagram account (@demospelleuven). What you share there is also covered by Meta's privacy policy.
To post our own content to those accounts automatically, we use our own Meta app, Demo-Spel Publisher. This app:
- only works for Demo-Spel's own page and account;
- publishes posts and photos we made ourselves, and reads basic data and statistics of our own posts;
- does not request any data about visitors, followers or other Facebook or Instagram users, and has no public login;
- does not store any personal data of Meta users.
Your rights
You have the right to:
- access your data and get a copy;
- have incorrect data corrected;
- have your data deleted;
- restrict or object to the processing;
- take your data with you in a common format;
- withdraw your consent, for example for the newsletter.
To do so, email [email protected] or ask at the counter. We reply within one month. We may ask you to confirm your identity, so that no one else can request your data.
Deleting your data
How to ask us to delete your data:
- Send an email to [email protected] with the subject "Delete my data".
- Include your name and the email address or phone number we know you by. If you only want something specific deleted (for example your loyalty card, a photo or your tournament data), say so.
- We delete your data within 30 days and confirm this by email.
What we may not delete: invoices and accounting records we are legally required to keep. If you still have store credit or loyalty points, they are lost when your data is deleted; we will tell you beforehand.
Facebook and Instagram. Our app Demo-Spel Publisher does not store any data of Facebook or Instagram users. If you contacted us via Facebook or Instagram and want us to delete those messages, send an email as described above. You can also delete your own comments in the Facebook or Instagram app.
Complaints and changes
If you are not happy with how we handle your data, please let us know first at [email protected]. You can also file a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
We update this privacy policy when our way of working changes. The latest version is always on this page.
Last updated: November 2026.