Privacy policy
Updated 13 October 2026
English translation for information only; the French version prevails. Read the French version
Draft dated 13 October 2026, subject to approval by the President of HOPSTOCK. This text is not yet in force.
This policy explains what personal data HOPSTOCK processes on brewstock.fr, why, how long it keeps them, to whom it discloses them and how to exercise your rights. It supplements the Terms of Use and the Terms and Conditions of Sale.
1. Data controller
HOPSTOCK, a simplified joint-stock company with a sole shareholder (société par actions simplifiée à associé unique) with share capital of €1,000, 2131 route de Merville, 59190 Hazebrouck, RCS Dunkerque 838 136 794. Contact for any questions about your data: contact@brewstock.fr. HOPSTOCK has not appointed a data protection officer.
2. Data processed, purposes, legal bases and retention periods
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Customer account management | Surname, first name, email, telephone, addresses; for a business account: company, SIRET, VAT number | Performance of the contract (Terms of Use) | For as long as the account is active; deletion after three years without any login or order |
| Orders, delivery, invoicing | Account data, order contents, brewing date (fresh hops), parcel tracking | Performance of the contract; legal obligation for invoices | Duration of the business relationship; invoices and accounting records: ten years (article L123-22 of the French Commercial Code (Code de commerce)); contracts concluded online with a consumer for €120 or more: ten years (article L213-1 of the French Consumer Code (Code de la consommation)) |
| Payment | Transaction reference; card data are processed by Stripe and are never received by HOPSTOCK | Performance of the contract | Reference kept with the order |
| Withdrawal, complaints, guarantees | Correspondence, photographs submitted, notice of withdrawal | Performance of the contract; legal obligation | Duration of the legal guarantees plus the limitation periods |
| Online chat | Name and email if provided, content of messages, technical connection data | HOPSTOCK’s legitimate interest in answering your questions | One year after the last conversation |
| Commercial information by email | Email, name, purchase history | Consumers: consent; business customers: legitimate interest, with the option to object at any time | Three years from the last contact |
| Grower account request (form on the “Become a seller” page) | First and last name, name of the farm, email, telephone (optional), municipality or département, varieties grown, indicative volume, farming method, message; date and text of the consent given; encrypted fingerprint of the IP address (protection against abusive submissions) | Pre-contractual measures taken at your request; legitimate interest in protection against abusive submissions | Five years from the last contact, then automatic deletion |
| Brewer profile and beer projects (customer area) | Answers to the questionnaires: beers brewed, aromas sought, priorities, brewing volumes and dates, storage method; saved beer projects | Performance of the contract (customer area services requested by the customer) | For as long as the account is active; can be changed or deleted at any time in the customer area |
| Back-in-stock alerts (HOP ALERT) | Email, variety requested, date and text of the consent, date of confirmation; technical subscription address of the device if notifications are enabled; mobile number, date and text of the consent to SMS if you ticked “Also notify me by SMS” | Consent, which can be withdrawn in one click in each message | Unconfirmed request: 7 days; stopped alert: 30 days; alert sent: 12 months; no return to stock: 24 months |
| Website security | IP address, connection logs | Legitimate interest (protection of the website and accounts) | No more than twelve months |
| Audience measurement and advertising | Cookie identifiers, pages viewed, browsing data | Consent | No more than thirteen months for cookies (see § 7) |
Information marked as mandatory in the forms is necessary to process the order or to open the account; without it, the order cannot be completed. HOPSTOCK does not take any decision based solely on automated processing and does not sell any data.
3. Recipients
Your data are accessible only to those people within HOPSTOCK who need them, and are disclosed, to the extent necessary for them, to the following recipients:
- Partner growers: name, delivery address and telephone number, parcel contents, in order to prepare and ship your order;
- Sendcloud (Netherlands), shipping label platform, and the carriers Mondial Relay, Colissimo (La Poste) and Chronopost, for delivery;
- Stripe (Stripe Payments Europe Limited, Ireland), for card payments;
- Brevo (France), for sending emails (order confirmation, tracking, commercial information if you have consented to it) and for the HOP ALERT SMS if you have requested it;
- Zoho, provider of the Zoho SalesIQ online chat service;
- Hostinger International Ltd (Cyprus), host of the website; the page cache (LiteSpeed) runs on its servers;
- Pennylane (France), invoicing and accounting software, and HOPSTOCK’s chartered accountancy firm;
- Google (Google Analytics) and Meta (Facebook pixel), only if you have accepted the corresponding cookies;
- administrative or judicial authorities, upon a request provided for by law.
4. Transfers outside the European Union
Certain service providers (Stripe, Google, Meta, Zoho) belong to groups established outside the European Union and may transfer data to those countries, in particular the United States. These transfers are governed by the European Commission’s adequacy decision (EU–US Data Privacy Framework) for companies that adhere to it, or by standard contractual clauses adopted by the European Commission.
5. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw your consent at any time. You may also set out instructions regarding what happens to your data after your death (article 85 of Law No. 78-17 of 6 January 1978, the French Data Protection Act (loi Informatique et Libertés)).
To exercise these rights, write to contact@brewstock.fr or to HOPSTOCK, 2131 route de Merville, 59190 Hazebrouck. You will receive a reply within one month, which may be extended by two months for complex requests; if there is reasonable doubt as to your identity, you may be asked to provide proof of identity. You can unsubscribe from commercial emails using the link included in each of them.
If you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
Commercial telephone canvassing of a consumer who has not given prior consent is prohibited (article L223-2 of the French Consumer Code): HOPSTOCK uses your telephone number solely for tracking and delivering your orders and, if you have requested it, for the HOP ALERT back-in-stock SMS.
6. Security
HOPSTOCK takes appropriate measures to protect your data: encrypted connection (HTTPS), restricted access to administration accounts, web application firewall and regular backups. Account passwords are stored in an encrypted form that prevents them from being read.
7. Cookies and other trackers
A cookie is a small file placed on your device when you visit a website. In accordance with article 82 of Law No. 78-17 of 6 January 1978, trackers that are not strictly necessary for the operation of the website are placed only once you have given your consent.
| Category | Examples on brewstock.fr | Is your consent requested? |
|---|---|---|
| Website operation | Basket, session and login to your account (WooCommerce and WordPress cookies); payment security (Stripe); remembering your choice to display prices excl. VAT or incl. VAT (bw_prix cookie, one year); remembering your cookie choices | No consent requested: these trackers are strictly necessary for the service you request |
| Online chat | Zoho SalesIQ chat service | Yes (“Marketing” category of the banner) |
| Audience measurement | Google Analytics; attribution of orders to the source of the visit (WooCommerce) | Yes (“Statistics” category) |
| Advertising | Facebook pixel (Meta); tracking of advertising campaigns (Zoho CRM) | Yes (“Marketing” category) |
Your consent is obtained through a banner on your first visit: you can accept, refuse or choose by category, and refusing is as simple as accepting. Your choice is kept for six months; cookies subject to your consent have a lifetime of no more than thirteen months. You can change your choices at any time via the “Manage my cookies” link at the bottom of each page, or through your browser settings. The list of cookies, their purpose and their lifetime are given in the table in this section.
8. Changes to this policy
HOPSTOCK may update this policy, in particular when it changes service providers. Each version states at the top of the page the date of its last revision.