Privacy policy

1. Who processes your data

hexel is a trading name of the sole proprietorship of Kenzo Wijnants, registered in the Belgian Crossroads Bank for Enterprises as Wijnants Kenzo, established at Luikersteenweg 549/2, 3800 Sint-Truiden, Belgium, company and VAT number BE 1008.161.580. The same business also trades under the name Reboot-IT. Kenzo Wijnants is the controller for the data collected through this site.

Questions about this policy or about your data: info@hexel.be or 011 93 98 00.

No data protection officer has been appointed. That is not required for a business of this size, which processes neither data on a large scale nor special categories of data.

2. What we process

You decide what you hand over. In practice:

• Contact form: your name, e-mail address, message and language, and optionally your company, phone number and subject.
• E-mail, phone or WhatsApp: whatever you share in that conversation.
• Projects: the data needed to quote, invoice and carry out the work, including the client's contact persons.
• Rate limiting: your IP address is briefly used to cap the number of form submissions per visitor. That happens in the server's memory, not in a database, and disappears on its own.
• Server logs kept by the hosting provider, containing among other things the IP address, timestamp, requested page and browser, for security and troubleshooting.

3. Purposes and legal bases

We make no decisions about you based solely on automated processing, and we do not profile.

Your data is not used for newsletters or commercial mailings unless you ask for them.

• Answering your question and preparing a quote — necessary to take steps at your request before entering into a contract (article 6.1.b GDPR).
• Carrying out, invoicing and following up a project — performance of the contract (article 6.1.b GDPR).
• Securing the site and fighting spam and abuse — legitimate interest (article 6.1.f GDPR).
• Bookkeeping and tax obligations — legal obligation (article 6.1.c GDPR).
• Advertising or analytics cookies, once there are any — only with your consent (article 6.1.a GDPR), which you can withdraw at any time.

4. How long we keep it

• Enquiries that do not lead to a project: two years at most, so an earlier conversation can be found back.
• Client files: up to ten years after the end of the collaboration, because of the limitation period for contractual claims.
• Invoices and accounting records: as long as the tax and accounting retention obligation requires.
• Server logs: briefly, according to the hosting provider's retention policy.
• Your cookie choice: six months, after which we ask again.

5. Who we share it with

We do not sell your data and do not pass it on for the commercial purposes of third parties. We do work with service providers acting as processors, strictly on our instructions:

• Vercel Inc. — hosting of this site, including the server logs.
• Resend — delivery of the e-mail generated by the contact form. The mail leaves from the verified domain reboot-it.be and carries your address as reply-to.
• Our e-mail and office software, where your message arrives and is stored.
• Our accountant and, where applicable, a lawyer or debt collection agency, each in their own legal role.

Beyond that, we disclose data where a law, a court order or a competent authority obliges us to.

6. Transfers outside the European Economic Area

Vercel and Resend are established in the United States. The transfer relies on the adequacy decision for the EU-US Data Privacy Framework for participating companies, and otherwise on the European Commission's standard contractual clauses, together with the commitments in the data processing agreements with those parties.

7. Cookies

This site sets only what it needs to work. What is set, how long it stays and how to withdraw a choice is in the cookie policy.

8. Your rights

At any time you can:

• ask for access to the data we hold about you;
• have it corrected or completed;
• have it erased, to the extent we are not legally required to keep it;
• have the processing restricted;
• object to processing based on legitimate interest;
• receive your data in a common format or have it transferred;
• withdraw a consent you gave, without affecting what happened before.

9. A question or a complaint

Send your request to info@hexel.be. We answer within one month. Where there is reasonable doubt about your identity we ask for additional proof, purely to avoid handing data to the wrong person.

If our answer does not satisfy you, you can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be. You can also go straight to court.

10. Security

The site runs entirely over https, the contact form has a honeypot and a submission limit, and access to mailboxes and admin environments is limited to those who need it. No measure rules out every risk. If you notice something off, let us know at info@hexel.be.

11. When hexel processes on behalf of a client

Where we build or run a site, webshop, application or ERP or CRM system holding personal data of your customers, your business is the controller and hexel acts as processor. For that we conclude a data processing agreement as required by article 28 GDPR, covering purpose, duration, security, sub-processors, assistance, and return or deletion afterwards.

This privacy policy does not cover those processings. It describes only what hexel does with your data as a visitor or prospect of hexel.be.

12. Changes

If the processing changes, this policy is updated and the version number at the top changes with it. The current version is always on this page.