Privacy Policy
Webaze is a small studio, and this is a small website. We collect as little as we can, we keep it for no longer than we need, and we don't sell or rent anything to anyone. This page explains what we collect when you visit webaze.be, why, and what you can do about it.
This policy covers the website webaze.be and its subdomains (such as analytics.webaze.be and newsletter.webaze.be), and the data we handle as a business about our own contacts, clients and suppliers. When we build or maintain software for a client, we usually process personal data on that client's behalf. That client is then the controller, and our General Terms and a separate data processing agreement with the client apply, not this policy.
This policy is available in English and Dutch. Both versions have the same content; if they ever differ, the reading most favourable to you applies.
1. Who we are
The controller for the personal data described here is:
Webaze BV
Boerderijstraat 39, 8500 Kortrijk, Belgium
Company number (KBO/BCE) and VAT: BE 0880.381.007
Email: [email protected]
Phone: +32 484 36 14 25
Webaze is a one-person company: every privacy question reaches Cedric directly. We have not appointed a data protection officer, because the law does not require one for a business of our size and activity.
2. What we collect and why
2.1 Visiting the website
| What | IP address, date and time of the request, the page requested, browser and operating system (user agent), referring page, and technical error information. |
|---|---|
| Why | To deliver the website, keep it secure, prevent abuse and fix errors. |
| Legal basis | Our legitimate interest in running a secure, working website (art. 6(1)(f) GDPR). |
| How long | Server logs are kept for 30 days, then deleted, unless needed to investigate a specific security incident. |
Requests to webaze.be and analytics.webaze.be pass through Cloudflare's network, which delivers the pages and filters attacks. Cloudflare processes this request data for us as a processor, on the same legal basis (see sections 4 and 5).
The website also uses a few strictly necessary cookies for security and form handling (see section 6). These need no consent.
2.2 Visit statistics ("Statistics", only with your consent)
| What | Pages viewed, referring page, browser, operating system, device type, screen size, language, approximate location (country, region and city, derived from your IP address), and interactions with certain buttons, links and form fields (for example "Send message", "Notify me" or clicking our email address). We never record what you type. |
|---|---|
| Why | To understand which pages are useful and where the website can be improved. |
| Legal basis | Your consent (art. 6(1)(a) GDPR, and art. 10/2 of the Belgian Act of 30 July 2018 on the protection of personal data, formerly art. 129 of the Electronic Communications Act, for accessing information on your device). |
| How long | Raw event data: 12 months. Totals that can no longer be linked to anyone may be kept longer. |
We use Umami, open-source analytics software that runs on our own server at analytics.webaze.be. No statistics are sent to Google or any other analytics company. Umami does not set cookies, does not store your IP address and does not follow you across other websites. To count visits, it derives a pseudonymous visit identifier from your IP address and browser details, which is reset regularly. That identifier is not your name, but the law still treats it as personal data, which is why we ask first: the script is only loaded after you choose Statistics in the cookie banner. If you decline, it is not loaded.
2.3 Session recordings and heatmaps ("Session recordings & heatmaps", only with your consent)
| What | The structure of the pages you view and how they change while you use them, mouse movements, clicks, how far you scroll, and the size of your browser window, linked to the pseudonymous Umami visit described in section 2.2. Heatmaps combine the clicks and scroll depth of all recorded visits per page. |
|---|---|
| Why | To see where visitors get stuck and improve the layout and content of the website. |
| Legal basis | Your consent (art. 6(1)(a) GDPR and art. 10/2 of the Belgian Act of 30 July 2018). |
| How long | At most 12 months, then deleted. |
| Provider | None. The recorder runs on our own analytics server at analytics.webaze.be, alongside the statistics in section 2.2. No recording company receives this data. |
What we do to limit what is recorded:
- Everything you type into form fields (name, email, message) is masked in your browser before anything is sent. Password fields are never recorded.
- Embedded content from other websites and drawing areas (canvas) are not recorded.
- The recorder sets no cookies and stores nothing on your device. To link a recording to the Umami visit, it uses Umami's temporary visit identifier, which is held only in the open page.
- We do not link recordings to your name or email address, and we do not use them to identify you.
The recorder is loaded only when you have chosen both Statistics and Session recordings & heatmaps in the cookie banner, because it relies on the Umami visit. Ticking recordings therefore also ticks statistics, and unticking statistics also unticks recordings. It is a separate choice: you can accept statistics and still refuse recordings.
2.4 Contact form and email
| What | Your name, email address, your message and anything you choose to include in it. |
|---|---|
| Why | To read and answer your message, and to follow up on any enquiry about working together. |
| Legal basis | If you ask about a project, a quote or our services: steps taken at your request before entering into a contract (art. 6(1)(b) GDPR). For any other message: our legitimate interest in reading and answering the messages people send us (art. 6(1)(f) GDPR). |
| How long | Up to 2 years after our last exchange. If the conversation leads to an assignment, the correspondence becomes part of the client file (see section 2.7). |
Contact form messages are not stored in a database on the website. They are sent as an email to our Google Workspace inbox through our email delivery provider, Mailtrap (see section 4). The same inbox receives the emails you send us directly.
2.5 Product updates ("Notify me")
| What | Your email address, the product you signed up for and the date of sign-up. We don't ask for your name; Listmonk stores the first part of your email address as a placeholder name. |
|---|---|
| Why | To email you when the product you signed up for launches. |
| Legal basis | Your consent (art. 6(1)(a) GDPR and art. XII.13 of the Belgian Code of Economic Law). |
| How long | Until you unsubscribe, or until we close the list for that product, whichever comes first. |
Sign-ups are managed with Listmonk, open-source newsletter software that runs on our own server at newsletter.webaze.be. The emails themselves are sent through our Google Workspace account (see section 4). Every email contains an unsubscribe link, and you can also simply reply or email [email protected]. Our website's technical logs note that a sign-up took place, but not your email address.
2.6 Social media links
The website links to our LinkedIn page. This is a plain link: nothing from LinkedIn is loaded on webaze.be, and we send it no data. Once you follow the link, LinkedIn's privacy policy applies.
2.7 Clients and suppliers
If you become a client or supplier (or work for one), we process contact details, correspondence, quotations, contracts and invoices to perform the agreement (art. 6(1)(b) GDPR), to meet our accounting and tax obligations (art. 6(1)(c) GDPR), and, for contact persons at a client or supplier company, on the basis of our legitimate interest in managing that business relationship (art. 6(1)(f) GDPR). Accounting records and supporting documents are kept for 10 years, as Belgian accounting and tax law requires; other correspondence for up to 5 years after the relationship ends, or longer if needed for a dispute. Our General Terms apply to that relationship.
2.8 Do you have to give us your data?
No. You can use the website without giving us any personal data, apart from the technical data in section 2.1 that every website needs. Without an email address we can't reply to you or send you product updates, and without your consent we simply don't load statistics or recordings.
We do not use your data for automated decision-making or profiling with legal or similarly significant effects.
2.9 Retention at a glance
| Data | How long |
|---|---|
| Server logs | 30 days |
| Statistics (Umami) | 12 months |
| Session recordings and heatmaps | 12 months |
| Contact form messages and email | 2 years after our last exchange |
| "Notify me" sign-ups | Until you unsubscribe or the list for that product is closed |
| Client and supplier correspondence | 5 years after the relationship ends |
| Accounting records | 10 years |
3. Where your data comes from
Almost everything comes directly from you: what you type, what you send, and what your browser sends when you visit. If you are a contact person at a client or supplier, we may also receive your business contact details from your colleagues. We do not buy data or enrich it from other sources.
4. Who receives your data
We don't sell, rent or trade personal data. We share it only with service providers who help us run the website and our business, under a data processing agreement, and only as far as they need it:
| Recipient | What for | Location |
|---|---|---|
| DigitalOcean, LLC | Hosting the website, Umami and Listmonk | Servers in Amsterdam, the Netherlands (EU); US company, see section 5 |
| Cloudflare, Inc. | Delivering webaze.be and analytics.webaze.be and protecting them against attacks and abuse (processes IP addresses and request data) | Global network; US company, see section 5 |
| Mailtrap (Railsware Products Studio LLC) | Delivering contact-form and system emails | United States, see section 5 |
| Google (Google Workspace) | Our email inbox, and sending the product launch emails from Listmonk | EU contracting entity in Ireland; Google may also process data outside the EEA, see section 5 |
| Our accountant | Bookkeeping and tax filings (clients and suppliers only) | Belgium |
We may also disclose data where the law requires it, for example to a court or the authorities, or where needed to establish, exercise or defend a legal claim.
5. International transfers
We prefer providers that store data within the European Economic Area. Our website server is in Amsterdam, but DigitalOcean, LLC is a US company, Cloudflare, Inc. is a US company whose network handles requests to webaze.be and analytics.webaze.be, Mailtrap is operated by a US company (Railsware Products Studio LLC), and Google may process data outside the EEA, including in the United States. Where a provider listed above processes or can access data outside the EEA, the transfer relies on a European Commission adequacy decision (such as the EU–US Data Privacy Framework, for certified US companies) or on the Commission's standard contractual clauses. You can ask us for more information or a copy of the relevant safeguards at [email protected].
6. Cookies and local storage
We use as few as possible. Strictly necessary items are set without asking; everything else waits for your consent.
| Name | Set by | Purpose | Duration | Consent needed |
|---|---|---|---|---|
CraftSessionId | webaze.be | Keeps your session while you submit a form (for example to show "message sent"). | Until you close your browser | No, strictly necessary |
CRAFT_CSRF_TOKEN | webaze.be | Protects forms against cross-site request forgery. | Until you close your browser | No, strictly necessary |
__cf_bm, cf_clearance (only in some cases) | Cloudflare, on webaze.be | Tells people and bots apart, and remembers that you passed a security check, so we can block abuse. | __cf_bm: 30 minutes; cf_clearance: up to the validity of the security check | No, strictly necessary |
webaze.consent.v2 (local storage) | webaze.be | Remembers your choices in the cookie banner (statistics, recordings and the date you chose, ts), so we don't ask on every page. | 12 months, then we ask again | No, strictly necessary |
| Umami script (no cookies) | analytics.webaze.be | Statistics (section 2.2). Reads device details such as screen size and language. | Nothing stored on your device | Yes, "Statistics" |
| Umami recorder (no cookies) | analytics.webaze.be | Session recordings and heatmaps (section 2.3). | Nothing stored on your device | Yes, "Statistics" and "Session recordings & heatmaps" |
Changing your mind. You can withdraw or change your consent at any time through the Cookie settings link at the bottom of every page, or by clearing your browser's storage for webaze.be. When you withdraw consent, the page reloads and the tools are no longer loaded. Withdrawal does not affect what was processed before.
7. How we protect your data
Connections to the website are encrypted (HTTPS). Access to our systems is limited to Cedric, with individual accounts and strong passwords. Forms are protected against spam and forgery. Umami and Listmonk run on a server we manage, so your statistics and sign-ups are not shared with an analytics or mailing-list company. No system is perfectly secure, but we take reasonable care and, if a breach occurs, we will notify the Data Protection Authority and you where the law requires it.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have incorrect data corrected;
- have your data erased, where there is no longer a reason to keep it;
- restrict processing, for example while a correction is being checked;
- data portability: receive data you gave us in a common, machine-readable format, or have it sent to someone else;
- withdraw your consent at any time, where we rely on consent (statistics, recordings, product updates). This does not affect processing that took place before.
Your right to object. Where we rely on our legitimate interest (sections 2.1, 2.4 and 2.7), you can object at any time for reasons relating to your situation. We will then stop, unless we have compelling legitimate grounds or need the data for a legal claim. You can always object to direct marketing, without giving a reason, and we will stop.
How to exercise them. Email [email protected] or write to the address in section 1. We may ask you to confirm your identity if we can't otherwise be sure the request comes from you. We respond within one month. That period can be extended by two more months for complex requests, and we will tell you if that happens. Exercising your rights is free, unless a request is clearly unfounded or excessive.
Complaints. If you are not happy with how we handle your data, please tell us first; we'll try to put it right. You can also lodge a complaint with the Belgian Data Protection Authority:
Gegevensbeschermingsautoriteit / Autorité de protection des données
Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels
+32 2 274 48 00 · [email protected] · www.gegevensbeschermingsautoriteit.be
If you live or work elsewhere in the EU, you can also contact the authority in your own country.
9. Children
This website is aimed at businesses and professionals. We do not knowingly collect data from children under 13, and product updates are not intended for them.
10. Changes to this policy
If we change how we process data, we update this page, its version number and the date at the top. If a change is significant, for example a new purpose or a new kind of tracking, we will make it clearly visible on the website and, where consent is needed, ask for it again.
11. Contact
Questions about this policy or your data: [email protected]
Webaze BV, Boerderijstraat 39, 8500 Kortrijk, Belgium