Privacy
Last updated: 16 October 2026. The French version prevails in case of discrepancy.
1. Who is responsible for your data?
TONIC Food & Fashion sàrl, 37, avenue Grande-Duchesse Charlotte, L-3441 Dudelange, Luxembourg (RCS B144526), operator of tonic.lu and of the Tonic Food stores in Dudelange and Howald. For any question about your data: info@tonic.lu.
2. What data and why?
| Purpose | Data | Legal basis |
|---|---|---|
| Customer account and sign-in (link sent by e-mail, no password) | E-mail, name, addresses, phone | Contract |
| Orders, payment, delivery, returns, customer service | Identity, addresses, items ordered, amounts, exchanges with us | Contract |
| Invoicing and accounting | Invoices, order data | Legal obligation |
| Loyalty programme, prices and discounts of your account (online and in store, with the same e-mail) | Purchase history, points, customer category | Contract |
| "Notify me" alert and wishlist | E-mail, chosen products | Your request |
| Invitation to review a purchase | Name, e-mail, products ordered | Legitimate interest (you can object at any time) |
| Audience measurement (Google Analytics) | Pages viewed, device, purchase events, cookie identifier | Your consent |
| Website security and fraud prevention | Technical connection data, payment data processed by Stripe or PayPal | Legitimate interest |
We do not sell or rent your data. We do not use your data for targeted advertising and make no automated decisions about you. We never see your card number: it is entered and processed directly by Stripe or PayPal.
3. Who receives your data?
Only the service providers we need, contractually bound to protect it and to use it only on our behalf:
- ACSONE SA/NV (Belgium): hosting of the website and of our management software (orders, customers, stock);
- Stripe (cards, Apple Pay, Google Pay) and PayPal: payments;
- Brevo (France): sending e-mails (sign-in link, confirmations);
- the carrier delivering your parcel: delivery name, address, phone or e-mail;
- Société des Avis Garantis (France): collecting and publishing customer reviews;
- Google (Google Analytics): audience measurement, only if you accept it;
- our bank and accountant, and authorities where required by law.
Some of these providers (Google, Stripe, PayPal) may process data outside the European Union, in particular in the United States. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
4. How long?
- Customer account: as long as it is used; you can ask for its deletion at any time.
- Orders and invoices: 10 years (Luxembourg accounting obligation).
- Customer service exchanges: the time needed to handle the request, then the applicable limitation period.
- Google Analytics: 14 months maximum.
- Your cookie choice: 6 months.
5. Cookies and browser storage
| Name | Purpose | Duration |
|---|---|---|
| Shop session cookies | Basket, sign-in, language, prices of your account (necessary) | Session or 1 year |
tonic_consent | Remembers your cookie choice (necessary) | 6 months |
_ga, _ga_2F02J9E1GR | Google Analytics: distinguishing visits (only if you accept) | Up to 2 years |
Local storage d26-recherches, d26-en-stock | Your recent searches and the "in stock" filter, kept on your device | Until cleared |
Without your consent, no Google Analytics cookie is set: Google only receives anonymous signals, without an identifier, to estimate traffic ("consent mode"). Payment providers may set their own security cookies (Stripe, PayPal), which are necessary to prevent fraud.
6. Your rights
You can at any time request access to your data, its rectification, erasure, restriction of processing or portability, and object to processing based on our legitimate interest (for example review invitations). Where processing is based on your consent, you can withdraw it at any time, without affecting what was done before.
Write to us at info@tonic.lu or at the address above; we reply within one month. You can also lodge a complaint with the National Commission for Data Protection (CNPD), 15, boulevard du Jazz, L-4370 Belvaux, Luxembourg – cnpd.public.lu.
7. Security
The website is fully encrypted (HTTPS), signing in to your account uses a personal, limited-use link sent by e-mail, and access to your data is restricted to the people who need it.
8. Changes
We may update this policy; the date at the top shows the latest version. See also our terms and conditions and our legal notice.