Last updated: 27 August 2026
This page describes what the xtra-easy.com site does with your data: what it collects, why, who else receives it and how long we keep it. It is written from what the site actually does, including when the honest answer is “we don’t do that yet”.
Xtra Copy, Rue de l’Yser 11, 7500 Tournai, Belgium. Company and VAT number: BE 0700.366.625.
For any question about your data, write to administration@xtracopy.com. The site has no contact form: the addresses given here open your email software.
We have not appointed a data protection officer: our activity does not require one.
Creating an account requires your first name, your surname, your email address and a password. You may add a company, a VAT number, an address and a telephone number: these fields are optional and are used to pre-fill your orders and your invoices.
Your password is never stored as such: only an irreversible fingerprint of it is kept, what is called a hash, and nobody here can read it.
If you enter a VAT number, it is checked against the European VIES register, which sends us back the company name and the address so that you do not have to type them.
You can also sign in with Google or Facebook. We then receive your email address and your name, nothing else, and we keep the identifier of the account used so we can recognise you afterwards.
Once you are signed in, your browser keeps a session token valid for one hour, or seven days if you tick “remember me”. It contains your details so that your name and your balances can be shown without querying the server again on every page.
Legal basis: performance of the contract that begins when you open an account.
To place an order, we ask for your first name, your surname, your email and, in the case of delivery, your full address. Delivery is possible in Belgium and France; for collection, the shop’s address replaces yours.
You can add a free-text note for the workshop. It is read by our team: do not write anything there that you would not say at the counter.
Every order is kept with its details (formats, papers, finishes, quantities, amounts), its progress status and, where applicable, its tracking link. It is the record of what you ordered, useful in the event of a complaint.
Legal basis: performance of your order, then our accounting obligations for what has to be kept.
Your files to be printed are sent to our server under a rewritten name. For the photo mosaic, your photos never leave your device: the final image is assembled in your browser, and that image alone is what reaches us.
They are not kept indefinitely. A periodic clean-up, enabled in the site's administration, deletes them at the following deadlines:
That clean-up runs only once per configured interval, currently twenty-four hours, and on the occasion of visits to the site: a file is therefore deleted at the latest one interval after the deadline that applies to it. Your files to be printed are passed on to nobody: neither to a payment provider, nor to a carrier or its intermediary, nor to an outside printing service. What goes to our shipping intermediary is your delivery details, never your files, as point 11 explains.
Legal basis: performance of your order.
Online payment goes through Stripe, which offers card, Bancontact and PayPal. You are redirected to its secure page: no card number reaches our servers and we keep none.
Stripe receives your email, your name, and the order description and amount. Neither your postal address nor your files.
Legal basis: performance of your order, and our legal obligations regarding invoicing.
Every paid order gives rise to an invoice, attached to your confirmation email and available in your customer area. The PDF is not stored: it is rebuilt on demand.
If you have a VAT number, your invoice is sent automatically over the Peppol network, the official electronic invoicing channel in Belgium, through our provider Falco. Falco then receives your name or your company name, your VAT number, your email, your address and the amount.
Legal basis: our legal, accounting and tax obligations.
You can subscribe to our newsletter from your customer area. It announces our new services, our offers and our exceptional opening hours, and uses only your email address and your name.
Nobody is signed up automatically: the box is off by default and only you can turn it on. You unsubscribe in one click from your customer area or through the link at the bottom of every mailing, without having to give a reason. Mailings are sent from our own server: no emailing provider gets your address.
Legal basis: your consent, which you can withdraw at any time.
The chat bubble is an artificial intelligence, not a person, and it tells you so as soon as it opens, as required by Article 50 of the EU AI Act.
Your message, the current conversation, the language and the page you are viewing are sent to our server, which passes them on to the Anthropic model in charge of writing the reply. No conversation is recorded on our side: the history lives in your browser tab and disappears when you close it. Your exchanges are not used to train a model.
The assistant does not know who you are and is not linked to any account. To track an order, it requires the matching order number and email address, and then gives only the status, the date and the collection method.
Your IP address is used solely to limit the number of messages per minute. Avoid writing sensitive data or a card number in this window: for that, call us.
Legal basis: our legitimate interest in answering you outside opening hours, and in protecting the service from abuse by limiting the number of messages.
The site writes no cookie of its own. What it needs in order to work (your session and your cart) is kept in your browser’s storage.
Three choices are offered to you separately: audience measurement (Google Analytics), advertising (knowing which ad brought you here) and the shop map (provided by Google). Until you have accepted, none of this is loaded, not even the Google script.
Refusing takes one click, exactly like accepting. Your choice is recorded with its date, lasts six months, and then the question is put to you again. You can change it at any time, here or through the “Cookies” link at the bottom of every page.
We keep proof of your choice: an identifier your browser picks at random, the date, the version of the text you were shown and the purposes accepted or declined. Not your IP address, not your account: that record cannot identify you, it lets us check what was answered if anyone disputes it. The law requires us to be able to show it.
Legal basis: your consent, which you can withdraw at any time.
None of this is a cookie, and nothing is sent automatically to a third party:
You can erase all of it from your browser settings. Signing out is enough for the session token.
Legal basis: running the service you asked for, as far as necessary, and your consent for the rest.
We neither sell nor rent your data. It is passed on only to the providers needed to run the service:
Providers established in the United States are covered by the “EU-US Data Privacy Framework” adequacy decision or, failing that, by the European Commission’s standard contractual clauses. Nobody receives your files to be printed and nobody receives your bank details. Only our shipping intermediary receives your delivery details, and only when you choose delivery.
The periods actually applied:
We do not yet automatically delete accounts that have been left inactive for a long time, nor the advertising source attached to an old order. We would rather say so than let you believe otherwise, and you can ask for deletion at any time.
Legal basis: our legal, accounting and tax obligations for orders and invoices; our legitimate interest in being able to answer a rightholder's claim during the limitation period for contractual claims, for the minimal record of a printing order; performance of your order for the rest.
Passwords are hashed and never stored in clear text. Our providers’ keys are encrypted in the database. Payment notifications are verified by signature before being accepted, and access to an order requires a token.
The site, the database and the mail service are hosted in France, with o2switch.
The GDPR gives you the right to request access to your personal data and a copy of it, the correction of anything inaccurate, erasure (except what the law obliges us to keep), the restriction of or objection to a processing operation, the portability of your data, and the withdrawal of your consent at any time.
You correct your contact details yourself from “Edit my details”, and you unsubscribe from the newsletter from your customer area or through the link at the bottom of every mailing. Account deletion and data export are requested by email to administration@xtracopy.com: they are not automated yet. We reply within one month.
If our reply does not satisfy you, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be.
This page follows what the site does. Every change is published here with its date.