Your Privacy Matters
Privacy Policy
This policy explains what personal data Bujorean Consulting collects, why we collect it, how long we keep it and what rights you have. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (Regulation (EU) 2016/679).
1. Who is responsible for your data
The controller of your personal data, in the sense of Art. 4(7) GDPR, is:
[Registered legal name]
Trading as Bujorean Consulting
Krabbosstraat 50
1653 Dworp (Beersel)
Belgium
Enterprise number: [0XXX.XXX.XXX]
VAT: [BE 0XXX.XXX.XXX]
Email: denis@bujoreanconsulting.be
Phone: +32 491 33 97 67
We have not appointed a Data Protection Officer. We are not required to do so under Art. 37 GDPR, because our core activities do not involve large-scale monitoring of individuals or large-scale processing of special categories of data. For any privacy question, write to denis@bujoreanconsulting.be.
2. What we process, why, and for how long
We only collect personal data for the purposes listed below, and each purpose has a lawful basis under Art. 6 GDPR. We do not process special categories of personal data (Art. 9 GDPR).
Answering enquiries sent through our contact form or by email
- Data collected
- Name, email address, phone number, company, service and budget interest, and the content of your message
- Lawful basis
- Art. 6(1)(f) GDPR — our legitimate interest in responding to people who contact us, and in taking steps at your request prior to entering into a contract under Art. 6(1)(b)
- Retention period
- 24 months after our last exchange, unless the enquiry leads to a contract. Our enquiry database deletes them automatically at that point, and they are deleted from the Formspree dashboard on the same schedule.
Providing our consulting and development services
- Data collected
- Contact and billing details, project documentation, correspondence
- Lawful basis
- Art. 6(1)(b) GDPR — performance of a contract with you or the organisation you represent
- Retention period
- For the duration of the engagement, then archived for the applicable limitation period
Meeting our accounting and tax obligations
- Data collected
- Invoices, payment records, company and VAT details
- Lawful basis
- Art. 6(1)(c) GDPR — compliance with a legal obligation under Belgian accounting and VAT law
- Retention period
- 7 years, as required by Belgian law
Keeping this website secure and available
- Data collected
- IP address, browser user agent, requested URL and timestamp, recorded in server logs
- Lawful basis
- Art. 6(1)(f) GDPR — our legitimate interest in preventing abuse and diagnosing faults
- Retention period
- Maximum 30 days in our hosting provider's logs
3. Do you have to give us your data?
No. Providing personal data is voluntary. The fields marked as required on our contact form are simply the minimum we need to be able to reply to you — without them we cannot answer your enquiry. Once we work together under a contract, providing billing details becomes a contractual and statutory requirement, because we cannot invoice you lawfully without them.
4. Who receives your data
Your personal data is never sold, rented or traded, and it is never shared with third parties for their own marketing purposes.
We rely on a small number of service providers who act as processors on our instructions under a data processing agreement (Art. 28 GDPR):
Vercel Inc.
Website hosting and delivery
EU region, with a Data Processing Agreement and EU Standard Contractual Clauses for any transfer outside the EEA
Supabase, Inc.
Database that stores messages sent through our contact form
EU (Frankfurt, Germany), under a Data Processing Agreement and the EU Standard Contractual Clauses
Formspree, Inc.
Emailing us a notification of each message sent through our contact form
United States, under a Data Processing Agreement and the EU Standard Contractual Clauses. Submissions are also retained in the Formspree dashboard.
[Email and office provider]
Mailbox and document storage used to handle your enquiry
[Region — complete before launch]
[Accountant]
Bookkeeping and statutory filings
Belgium
Beyond these, we disclose personal data only where we are required to do so by law or by a competent authority, or where it is necessary to establish, exercise or defend a legal claim.
5. Transfers outside the EEA
We aim to keep personal data inside the European Economic Area. Where a provider processes data outside the EEA, that transfer takes place under a Chapter V GDPR safeguard — normally the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), combined with additional technical measures such as encryption in transit and at rest. You can request a copy of the safeguards we rely on by writing to denis@bujoreanconsulting.be.
6. How we protect your data
We apply technical and organisational measures appropriate to the risk, as required by Art. 32 GDPR:
Encryption in transit
The whole site is served over HTTPS/TLS, and form submissions are encrypted end to end
Access control
Access to enquiries and project data is limited to people who need it, protected by multi-factor authentication
Data minimisation
We ask only for what we need to answer you, and delete what we no longer need
Breach response
A personal data breach is reported to the supervisory authority within 72 hours where Art. 33 GDPR requires it
8. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, within the meaning of Art. 22 GDPR.
9. Your rights
You can exercise any of the following rights free of charge by emailing denis@bujoreanconsulting.be. We respond within one month, and will tell you if we need to extend that period by up to two further months because the request is complex (Art. 12(3) GDPR). We may ask you to confirm your identity before acting.
Access (Art. 15)
Obtain confirmation of whether we process your data, and receive a copy of it
Rectification (Art. 16)
Have inaccurate or incomplete data about you corrected
Erasure (Art. 17)
Have your data deleted where we no longer have a valid ground to keep it
Restriction (Art. 18)
Have processing limited while a dispute about accuracy or grounds is resolved
Portability (Art. 20)
Receive data you gave us in a structured, machine-readable format
Objection (Art. 21)
Object to processing we base on legitimate interest, including direct marketing
Withdraw consent (Art. 7)
Withdraw consent at any time, without affecting processing already carried out
Lodge a complaint (Art. 77)
Complain to your national supervisory authority — details below
10. Complaints
If you believe we handle your personal data unlawfully, we would like the chance to put it right first. You always keep the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. The competent authority for us is:
Gegevensbeschermingsautoriteit (Autorité de protection des données)
Drukpersstraat 35, 1000 Brussels, Belgium
contact@apd-gba.be
https://www.gegevensbeschermingsautoriteit.be
11. Changes to this policy
We update this policy when our processing changes or when the law requires it. The date at the top of this page always shows the current version. If a change materially affects how we use data you have already given us, we will tell you directly.
Questions about your privacy?
Write to us and we will get back to you.
Phone
Address
Krabbosstraat 501653 Dworp (Beersel)Belgium