Privacy policy

1. Data controller

Secureflow SRL, Belgique, company number BE 1017.357.774, is the controller for the processing described below.

For any question about your data or to exercise your rights: [email protected].

Given the nature and volume of our processing activities, appointing a data protection officer is not mandatory; requests are handled directly by management.

2. Principle: a website without profiling

This is a showcase website. It has no collection form, no user account, no advertising network, no analytics tool and no social media button loading third-party scripts.

We neither sell nor rent any data, and we carry out no profiling.

3. Data processed and purposes

We process only the following categories of data:

• Contact details you send us spontaneously by email (name, email address, company, message content and any information you choose to include), purpose: answering your request and, where applicable, preparing a proposal; legal basis: pre-contractual steps at your request and our legitimate interest in replying to our contacts (Art. 6(1)(b, and 6(1)(f) GDPR).
• Technical connection data processed by our host and our delivery network (IP address, date and time of the request, page requested, browser type, country of origin), purpose: serving the website, keeping it secure, preventing abuse and producing aggregated infrastructure statistics; legal basis: our legitimate interest in operating a safe and available service (Art. 6(1)(f) GDPR).
• Language preference stored locally in your browser, purpose: displaying the website again in the language you selected; legal basis: our legitimate interest in providing a feature you explicitly requested (Art. 6(1)(f) GDPR).

4. Recipients and processors

Your data is accessible only to those within Secureflow who need it, and to the following technical providers acting as processors under an agreement compliant with Article 28 GDPR:

• Infomaniak Network SA, website hosting and email service (Rue Eugène-Marziano 25, 1227 Les Acacias (Genève), Suisse). Data is hosted in Switzerland, a country recognised by the European Commission as providing an adequate level of protection.
• Cloudflare, Inc., delivery, caching and abuse protection (101 Townsend St, San Francisco, CA 94107, États-Unis).
• We pass your data to no third party for commercial purposes. Disclosure to a public authority occurs only where the law requires it.

5. Transfers outside the European Economic Area

Using Cloudflare, Inc. may involve technical processing of connection data outside the EEA. Such transfers are governed by the European Commission’s standard contractual clauses, supplemented by technical measures (encryption in transit, minimisation of the data transmitted).

No content you send us by email is transferred outside the EEA and Switzerland as a result of this website.

6. Retention periods

• Email exchanges with no commercial follow-up: deleted at the latest 12 months after the last contact.
• Exchanges relating to a proposal or a contract: kept for the duration of the relationship, then for the applicable limitation period, and 7 years for accounting records as required by Belgian law.
• Technical logs: kept by our providers for a limited period for security and troubleshooting purposes, typically from a few days to a few months.
• Language preference: kept in your browser until you clear the site data.

7. Security

The website is served over HTTPS with permanent redirection and an HSTS policy. It is static: it exposes neither a database nor an administration interface reachable from the internet.

Access to publishing tools is protected by strong authentication and the least-privilege principle. Our mailboxes are protected by SPF, DKIM and DMARC to limit spoofing of our domain.

In the event of a data breach likely to result in a risk to your rights and freedoms, we notify the Autorité de protection des données (APD) within 72 hours and inform you where the risk is high.

8. Your rights

Under the conditions set out in the GDPR, you have the following rights:

• Right of access to your data and to obtain a copy.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure, where retention is no longer justified.
• Right to restriction of processing and right to object, in particular to processing based on our legitimate interest.
• Right to data portability for the data you provided to us.
• Right to give instructions on the fate of your data after your death.

9. Exercising your rights and lodging a complaint

Send your request to [email protected]. We reply within one month, extendable by two months for complex requests; we may ask for proof of identity where there is reasonable doubt about the identity of the requester.

If our answer does not satisfy you, you may lodge a complaint with the Autorité de protection des données (APD), Rue de la Presse 35, 1000 Bruxelles, Belgique ([email protected], https://www.autoriteprotectiondonnees.be), or with the supervisory authority of your place of residence.

10. Automated decisions

No decision producing legal effects concerning you is taken solely on the basis of automated processing, and no profiling is carried out on this website.

11. Changes

This policy may change along with the website or the applicable regulations. The date of the last update appears at the top of this page; in the event of a substantial change, we will inform the contacts we know.