Privacy policy

Last updated: 28 May 2026

Acturnia takes the protection of your personal data seriously. This policy explains which data we collect, why we collect it, who we share it with and what your rights are as a data subject. We act in accordance with the General Data Protection Regulation (GDPR).

1. What data we collect

Through the contact form on this website:

• Name
• Email address
• Phone number (optional)
• Role and company name (optional)
• Subject and the content of your message

When you contact us directly by email, phone or LinkedIn, or during a discovery call: the contact details you provide and the notes we make about your question, your processes and a possible engagement.

Automatically, through our web server: standard log data, including the IP address of the request, the time, the pages requested and the user agent. These logs exist for security and troubleshooting purposes.

Aggregated usage statistics about visits to this website. See article 2.

Providing your data is not a statutory obligation, but without contact details we cannot answer your question. We do not collect sensitive personal data, and we do not build visitor profiles.

2. Analytics, cookies and local storage

We use Cloudflare Web Analytics to see how this website is used. It is a privacy-first, cookieless analytics tool: it sets no cookies, stores nothing on your device and does not use fingerprinting or any other client identifier to recognise you across visits or across websites.

For each page view it records only:

• The page visited and the referring page
• Your browser's user agent (browser and operating system)
• The country your request comes from, derived from the IP address
• Basic page-performance timings

Your IP address is used only to derive the country and is not stored by the analytics tool. The result is aggregated statistics that cannot be traced back to you as an individual. Because no information is stored on or read from your device, this requires no cookie consent, which is why this website shows no cookie banner.

We place no cookies of our own and use no other analytics, advertising or tracking services.

Local storage: if you choose a language on this website, that choice is saved in your browser's local storage under the key wa-lang, so the site opens in your language next time. It stays in your browser, is never sent to us or to third parties, and you can clear it at any time through your browser settings. It is strictly necessary to provide a function you asked for, and therefore requires no consent.

3. Why we use your data

We use your data solely to:

• Answer your question or request
• Prepare or carry out a possible engagement
• Meet our statutory obligations, in particular accounting and invoicing obligations
• Keep this website secure and understand, in aggregate, how it is used

Legal bases: Article 6(1)(b) GDPR — performance of a contract, or pre-contractual steps taken at your request — for contact and engagement data. Article 6(1)(c) GDPR — compliance with a legal obligation — for invoicing and accounting records. Article 6(1)(f) GDPR — our legitimate interest in the security of this website and in understanding, in aggregate, how it is used — for server logs and the statistics in article 2.

4. How long we keep your data

• Contact details and correspondence: a maximum of 2 years after the last contact.
• Engagement records: for the duration of the engagement and 2 years thereafter, unless a longer period is required for a legal claim.
• Invoices and accounting records: 7 years, as required by Belgian accounting and VAT legislation. We cannot delete these on request before that period ends.
• Server logs: a maximum of 12 months.
• Aggregated statistics: retained in aggregate form only; they contain no personal data.

5. Who we share it with

We do not sell your data and do not share it with third parties for commercial purposes. We do use service providers who process data on our instructions, as our processors, under a processing agreement:

• Hosting and content delivery — for serving this website and its server logs.
• Cloudflare — content delivery, security and the cookieless analytics described in article 2. See the Cloudflare privacy policy.
• Our contact-form relay (email.acturnia.be) — receives your form submission and delivers it to us by email.
• Our email provider — for the correspondence that follows.

We may also share data with our accountant or legal adviser where necessary, and with the authorities where the law requires it.

6. Transfers outside the EEA

We prefer processors established in the European Economic Area, but not all of them are. Cloudflare, Inc. is established in the United States and processes data on a global network. Where personal data is transferred outside the EEA, that transfer takes place under the safeguards provided for in Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses included in the processor's data processing agreement, supplemented by technical measures such as encryption in transit.

You can request more information about a specific transfer, or a copy of the safeguards in place, at [email protected].

7. How we secure it

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, as required by Article 32 GDPR. These include encrypted transport (HTTPS), access limited to those who need it, multi-factor authentication on the accounts that hold personal data, and regular updates of the software we use. No system is perfectly secure, but in the event of a data breach affecting your rights we will notify the supervisory authority, and you where required, within the statutory deadlines.

8. Automated decision-making

We do not subject you to automated decision-making or profiling that produces legal effects or similarly significantly affects you, within the meaning of Article 22 GDPR. The automation we build for clients is a separate matter, covered in article 9.

9. Your data in systems we build for you

This policy concerns the data we process as a controller: visitors to this website and people who contact us.

When we build or maintain an automation system for a client, we process personal data held in that client's systems on that client's instructions. In that role we act as a processor within the meaning of Article 28 GDPR, and the client is the controller. A data processing agreement is concluded before the work starts, setting out the scope, the security measures, the use of sub-processors, the data's location and what happens to it when the engagement ends. EU data residency is our default.

If you are an employee or customer of such a client and you have a question about your data, please contact that organisation, as it decides why and how the data is processed. We will of course support them in answering you.

10. Your rights

As a data subject, you have the right to:

• Request access to your personal data
• Request rectification of inaccurate data
• Request erasure ("right to be forgotten")
• Restrict the processing or object to it, including to processing based on our legitimate interest
• Have your data transferred (data portability)
• Withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing before the withdrawal

Send an email to [email protected] for any such request. We respond within 30 days. We may ask for proof of identity before acting on a request. Statutory retention periods, such as the 7 years for invoices in article 4, may prevent us from erasing certain data.

11. Complaints

You have the right to lodge a complaint with the competent supervisory authority:

• Belgian Data Protection Authority (Gegevensbeschermingsautoriteit)
• Drukpersstraat 35, 1000 Brussels
• gegevensbeschermingsautoriteit.be
• [email protected]

12. Changes

We may amend this policy. The date at the top indicates when it was last updated. In the event of significant changes, we will inform you by email if we hold your contact details.