Privacy policy

We handle your data with care. This policy explains in plain language which personal data we process, why, how long we keep it and what your rights are. It is drawn up in accordance with the General Data Protection Regulation (GDPR) and the Belgian Act of 30 July 2018.

1. Who is responsible?

The data controller is Stucapro BV, trading as Vitrinet, with registered office at Vinkenstraat 31, 2530 Boechout, Belgium, registered with the Crossroads Bank for Enterprises under number 0845.511.782 (VAT BE 0845.511.782).

Questions about your data? Email info@vitrinet.be or call +32 477 23 81 77. We have not appointed a data protection officer, as the law does not require it for a company of our size.

2. Which data do we process, and why?

a) When you contact us

Via the form, by email, phone or WhatsApp: your name, company name, phone number, email address, your current website and the content of your message. We use these details to answer your request and prepare a proposal. Legal basis: the steps you request prior to entering into a contract (art. 6.1.b GDPR).

b) When you become a customer

Your contact and invoicing details, company number, the content of your website (text, photos, logo), access details for your domain name and hosting, and our correspondence. We use these to perform the contract (art. 6.1.b GDPR) and to comply with our legal accounting and tax obligations (art. 6.1.c GDPR).

c) When we approach you as a business (prospecting)

Vitrinet contacts businesses that do not yet have a website or whose website is outdated. For this we collect publicly available business details: company name, address, general phone number and email address (preferably info@ or contact@), website, sector and the public information on your website, Google Business Profile and social media. Sources include the Crossroads Bank for Enterprises, Google Maps, business directories and your own website.

We use these details to send you a single personal proposal and, if you don't reply, one reminder after about a week. Legal basis: our legitimate interest in offering our services to businesses (art. 6.1.f GDPR), in line with the Belgian rules on B2B email prospecting (art. XII.13 of the Code of Economic Law and the Royal Decree of 4 April 2003). We balance that interest against your privacy: we only use business details, send at most two messages, identify ourselves clearly, and you can unsubscribe with one click or one word ('stop'). We do not email private individuals.

If you unsubscribe, we keep only your email address on an exclusion list so that we do not contact you again.

d) When you use the website check

The web address you enter is sent from your browser directly to Google PageSpeed Insights to perform the measurement. We do not receive or store that address, unless you enter it yourself in the contact form afterwards. Google's processing is subject to Google's privacy policy.

e) When you visit our website

Our hosting provider keeps technical log files (IP address, time, page requested, browser) to keep the website secure and available. Legal basis: legitimate interest (art. 6.1.f GDPR). These logs are deleted after 30 days at most. You can read more about cookies in our cookie policy.

3. How long do we keep your data?

• Contact requests without follow-up: 12 months after the last contact.
• Prospecting data: 12 months after the last contact, or until you unsubscribe. Exclusion list: as long as needed to respect your choice.
• Customer data and correspondence: up to 5 years after the end of the contract (limitation period).
• Invoices and accounting records: 7 years (statutory retention period).
• Technical log files: 30 days at most.

4. Who do we share your data with?

We never sell your data. We only share it with service providers who help us, and only what they need:

• our hosting provider for the website: Netlify, Inc. (San Francisco, USA; delivered through a global network with servers in the EU), and for email: Combell NV (Ghent, Belgium; servers in the EU)
• proposals and reminders are sent from our own mailbox at Combell; we use no separate sending service and no tracking pixels
• Formspree, Inc. (USA) processes contact-form submissions and emails them to us; stored at Formspree for 30 days at most, under the European Commission's standard contractual clauses
• our accountant, for invoicing
• Google (PageSpeed Insights) if you use the website check, and OpenStreetMap if you load the map

We conclude a data processing agreement with our processors. Some providers process data outside the European Economic Area; in that case this is based on an adequacy decision or the European Commission's standard contractual clauses. We only pass your data to authorities if the law obliges us to.

5. How do we protect your data?

Our website and email use encrypted connections (https, TLS). Customer access details are kept in a password manager with two-factor authentication. Only Raymond De Loose and, where necessary, a processor have access. Despite all care, no system can guarantee complete security; in the event of a data breach that poses risks, we notify you and the Data Protection Authority within the statutory deadlines.

6. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. You can object to prospecting (direct marketing) at any time and without giving a reason; we then stop immediately.

Send your request to info@vitrinet.be. We reply within one month. To prevent abuse, we may ask you to confirm your identity.

Not satisfied with how we handle your data? You can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, +32 2 274 48 00, contact@apd-gba.be, www.dataprotectionauthority.be. We would of course rather hear from you first.

7. Automated decisions

Our prospecting system automatically assesses websites on technical characteristics (for example: is there https, does the site work on a phone). That only determines whether we send you a proposal; it has no legal effect on you and a person always reviews the proposal before it is sent.

8. Changes

We may amend this policy, for example for new services or new legislation. The date at the top shows when it was last changed. For significant changes we notify customers by email.