1. Who is responsible?
The controller is Jordy L’Oeuille, trading as Codegenie, Gentsestraat 98a box 001, 8530 Harelbeke, Belgium, enterprise and VAT number BE0770651142.
For privacy questions or requests, contact info@codegenie.be or use the contact form. Codegenie has not appointed a data protection officer because this is not legally required for the current activities.
2. Scope and Codegenie’s role
This policy applies to visitors, people who contact Codegenie, prospects, clients, suppliers and professional contacts involved in the cooperation.
Codegenie is the controller for its own website, outreach, client administration, invoicing, security and business operations. When Codegenie processes personal data solely on a client’s instructions during development, hosting, maintenance, support or server management, Codegenie generally acts as a processor. Where required, that processing is governed by a separate data processing agreement under Article 28 GDPR.
3. What data may be processed?
Depending on the relationship and service, Codegenie may process the following categories:
- Identity and contact data, such as name, role, company name, email address and phone number.
- Enquiry and project data, such as message content, requested functionality, current website, timing, budget, languages and content status.
- Contract, invoicing and administrative data needed for quotes, agreements, payments and accounting.
- Technical data, such as session information, browser type, timestamps, security signals, limited network data, logs and error context.
- Project and support information, such as configurations, account identifiers, change history, incident information and technical documentation.
- Business prospect data, such as enterprise number, public company name, website, domain, public business contact address, source page and limited website assessments.
- Consent and preference data for cookies, analytics and objections to direct marketing.
4. Where does the data come from?
Most data is provided directly through forms, email, phone, quotes, agreements, support or project communication.
Business prospect data may also come from public sources, including Belgian CBE/KBO Open Data, public company websites, public contact pages and technical information made available by a website. Clients may also provide data about their staff, users, suppliers or own customers where this is necessary for the agreed assignment.
5. Purposes and legal bases
Codegenie processes data only for defined purposes and on an appropriate legal basis:
- Answering enquiries and preparing quotes: pre-contractual steps and, where appropriate, legitimate interests in handling professional requests.
- Performing projects, support, maintenance, hosting or server services: performance of the agreement.
- Invoicing, accounting and statutory administration: legal obligation and performance of the agreement.
- Securing systems, forms and infrastructure, preventing abuse and investigating incidents: legitimate interests in safe and reliable services.
- Managing existing professional relationships and presenting relevant B2B services: legitimate interests, provided the individual’s interests and rights do not override them and electronic marketing rules are respected.
- Using Google Analytics: consent. The Codegenie Google Analytics integration is not loaded without consent.
- Establishing, exercising or defending legal claims: legitimate interests and applicable legal provisions.
6. Contact and quote forms
Form data is used to assess and answer the request and to take any necessary pre-contractual steps. Required fields are limited to what is needed to handle the request meaningfully.
Submissions are sent to the relevant Codegenie mailbox. A temporary hashed idempotency key may be used for up to one day to prevent duplicate delivery. Form content, email addresses and phone numbers are not sent as analytics events or included in ordinary error context.
7. Client, project and administrative data
Codegenie processes the necessary data of clients and their professional contacts for quotes, agreements, project follow-up, support, invoicing and evidence of agreed instructions.
Where a client supplies data about other people, the client is responsible for having a valid legal basis and providing appropriate information to those people. Codegenie does not use that data for its own incompatible purposes.
8. Development, support and server management
Development, migrations, updates, incident investigation, backups, hosting or server management may require temporary access to client environments, databases, logs, accounts or other personal data. Codegenie limits access to what is necessary for the assignment and does not use production data for unrelated purposes.
Where Codegenie acts as processor, the agreement and data processing agreement define matters such as instructions, security, confidentiality, subprocessors, retention, deletion and assistance with rights or personal data breaches.
9. Business outreach and direct marketing
Codegenie may use publicly available company data and, in principle, non-personal business contact addresses to present a relevant B2B service to an organisation. Sources may include Belgian CBE/KBO Open Data and the organisation’s public website.
Prospect selection may involve company identity, enterprise number, website, public contact address, source page, technical website characteristics, status and sending history. The processing is based on legitimate interests in presenting professional services in a targeted way, where this is necessary and proportionate after balancing interests and where the applicable electronic marketing rules are respected.
A first message identifies Codegenie, includes a privacy reference and provides an easy way to refuse further commercial messages.
10. Automated website assessment
Codegenie may automatically inspect publicly accessible company websites for limited technical, content, accessibility, security and conversion signals to assess whether business outreach may be relevant.
The assessment is used only for prospect selection, may be incomplete and does not produce legal or similarly significant effects for a person or organisation. Signals with insufficient evidence are not presented as established facts.
11. Cookies, Google Analytics and Cloudflare Web Analytics
After consent, Codegenie measures page views and clicks on homepage service links. A click or visit to a thank-you page does not count as an enquiry. Names, email addresses, phone numbers, message content and query parameters are not added to this measurement.
Cloudflare Web Analytics may be used independently for traffic and performance measurement. According to Cloudflare, this service uses no cookies and Web Analytics does not collect or use visitors’ personal data. Cloudflare may also be involved as network, CDN and security provider. More technical information appears in the cookie policy.
12. Recipients and service providers
Data is shared only where necessary with providers for hosting, domains, email, security, backups, analytics, accounting or professional support. Google may receive data for Google Analytics after consent. Cloudflare may process data for network, security and Web Analytics services.
Providers receive no more data than reasonably necessary and are contractually bound where required. Codegenie does not sell personal data. Data is disclosed to public authorities or other parties only where legally required or necessary for a legal claim.
13. Processing outside the EEA
Some international service providers may process data outside the European Economic Area. Where this occurs, Codegenie relies on a valid transfer mechanism, such as an adequacy decision, approved standard contractual clauses or another legally permitted safeguard.
The specific safeguards depend on the provider, service and account settings. Further information can be requested through the privacy contact.
14. How long is data retained?
Contact and quote data without an active assignment is generally retained for up to 12 months after the last substantive contact, unless a longer period is needed for a request, dispute or legal obligation.
Client, project, contract, invoicing and accounting data is retained during the cooperation and afterwards for as long as statutory retention, evidence or limitation periods require. Technical logs, incident data and backups are kept for a limited period based on their security purpose, operational cycle and contractual arrangements.
Prospect data is deleted or minimised when it is no longer needed for a relevant approach or follow-up. After an objection, a minimal suppression record may be retained to prevent the same organisation or address from being selected again for direct marketing.
Website sessions expire after 120 minutes of inactivity by default. The cookie preference is remembered for up to 12 months. Analytics data follows the configured retention settings of the relevant provider.
15. Security and personal data breaches
Codegenie uses appropriate technical and organisational measures, including encrypted connections, server-side validation, CSRF protection, rate limiting, security headers, limited logging, access restrictions and controlled management of secrets and updates.
No system can guarantee absolute security. Suspected incidents are investigated and documented. Where GDPR requires it, Codegenie notifies the competent supervisory authority and, in case of high risk, the affected people. Where Codegenie acts as processor, the client is informed without undue delay in accordance with the data processing agreement.
16. Your rights and request procedure
Subject to the legal conditions, you may request access, rectification, erasure, restriction, portability or object to processing. Consent may be withdrawn at any time without affecting processing lawfully carried out before withdrawal.
Send a sufficiently clear request to info@codegenie.be. Codegenie may ask for proportionate information to verify identity and generally responds within one month. For a complex or extensive request, the statutory extension may be used, in which case you are informed within the first month.
Erasure is not absolute. Certain data may be retained where necessary for legal obligations, security, evidence, legal claims or to respect a marketing objection.
17. Objection to direct marketing
You may object to processing for direct marketing at any time and free of charge. Reply to the commercial message with your objection or contact info@codegenie.be. Once the objection has been processed, Codegenie stops direct marketing to the relevant address.
A minimal suppression record may be retained solely to continue respecting the objection. It is not used to build new marketing profiles.
18. Complaints and changes
You may lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels. Codegenie asks that a concern be reported first where possible so it can be investigated and resolved, without limiting your right to complain.
This policy is updated when processing activities, providers or legal obligations materially change. The date above shows when the public text was last substantively updated.