1. Purpose and scope
This privacy policy describes the processing of personal data carried out by Webedia SRL (hereinafter “Webedia”, “we”) in connection with the webedia.be website, its contact form, its quote requests and the client area (hereinafter “the dashboard”) accessible from the website.
It is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
It applies to anyone who visits the website, contacts us, requests a quote or uses the dashboard, whether on their own behalf or on behalf of a company.
2. Data controller
The data controller is:
- Webedia SRL, a private limited company incorporated under Belgian law
- Company number (CBE) and VAT: BE 0771.506.524
- Registered office: Avenue Louise 367, 1050 Brussels, Belgium
- Telephone: +32 (0)2 899 20 48
- General enquiries: contact@webedia.be
- Data protection contact (GDPR): privacy@webedia.be
Webedia has not appointed a data protection officer, as this is not mandatory given its activities. Any question about your data may be sent to privacy@webedia.be.
3. Data collected, purposes and legal bases
We only collect the data needed for each purpose. The table below summarises, for each processing activity, the data concerned, the reason we process it and the legal basis that permits it.
| Purpose | Data processed | Legal basis |
|---|---|---|
| Responding to a contact or quote request | Surname, first name, email address, telephone number, company, content of the message, type of project and indicative budget | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR); legitimate interest in responding to enquiries |
| Managing the client relationship: quotes, orders, invoices, documents, project follow-up | Identity and business contact details, billing data (VAT number, address, IBAN where applicable), history of exchanges, quotes and invoices | Performance of the contract (Art. 6(1)(b) GDPR); statutory accounting and tax obligations (Art. 6(1)(c) GDPR) |
| Providing and securing the client dashboard | Email address, name, role, organisation, password or login link, two-factor authentication secret, credentials stored in the encrypted vault, shared documents | Performance of the contract (Art. 6(1)(b) GDPR); legitimate interest in securing our services (Art. 6(1)(f) GDPR) |
| Logging security events (logins, failed authentications, sensitive actions) | IP address, timestamp, user identifier, event type, user agent | Legitimate interest in preventing and detecting abuse (Art. 6(1)(f) GDPR) |
| Technical operation of the website (hosting, protection against attacks, server logs) | IP address, URLs visited, timestamp, user agent, response codes | Legitimate interest in operating and protecting the website (Art. 6(1)(f) GDPR) |
| Measuring website audience (Google Analytics 4) | Cookie identifiers, pages viewed, traffic source, device, browser, approximate location, truncated IP address | Consent (Art. 6(1)(a) GDPR and Art. 10/2 of the Act of 30 July 2018; Art. 129 of the Act of 13 June 2005 on electronic communications) |
| Cookie identifiers, mouse movements and clicks, pages viewed, device, browser; input fields are masked | Consent (Art. 6(1)(a) GDPR) | |
| Sending our clients commercial information about similar services | Business email address, name, company | Legitimate interest (Art. 6(1)(f) GDPR), with the right to object at any time |
| Handling requests to exercise rights and managing any disputes | Identity, contact details, content of the request, supporting documents | Legal obligation (Art. 6(1)(c) GDPR); legitimate interest in defending our rights |
The fields of the contact form marked as mandatory are needed to process your request; the others are optional. We do not collect any so-called “sensitive” data (origin, health, opinions, etc.) and ask you not to send us any.
The website is not intended for minors under 16 and we do not knowingly collect data about them.
4. Recipients and processors
Your data is processed by authorised Webedia staff, to the extent necessary for their duties. It is also entrusted to the technical service providers listed below, who act as processors within the meaning of Article 28 GDPR or, for some, as separate controllers, and who are bound by contractual confidentiality and security commitments.
| Provider | Role | Country of processing | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the website, the dashboard and the database | Germany (Gunzenhausen) — European Union | No transfer outside the EU |
| Cloudflare, Inc. | Content delivery network (CDN), DNS and anti-attack protection, loading of Google tags | Global network; company established in the United States | European Commission standard contractual clauses and Data Privacy Framework (DPF) certification |
| Resend, Inc. | Sending of transactional emails (contact form acknowledgements, notifications) | United States | Data Privacy Framework (DPF) certification and standard contractual clauses |
| Google Ireland Ltd (Google Tag Manager, Google Analytics 4) | Tag management and audience measurement — only after your consent | Ireland — European Union, with transfers to Google LLC (United States) | Data Privacy Framework (DPF) certification and standard contractual clauses |
| Session recordings and heatmaps — only after your consent | Ireland — European Union, with transfers to Microsoft Corporation (United States) | Data Privacy Framework (DPF) certification and standard contractual clauses |
Your data may also be disclosed to our advisers (accountant, lawyer), to banks for the processing of payments and to administrative or judicial authorities where the law requires us to do so.
Webedia does not sell or rent your personal data to third parties.
5. Transfers outside the European Union
The website and the dashboard are hosted in the European Union. Some of the providers listed in section 4 are nevertheless established in the United States or transfer data there.
These transfers are based on the European Commission adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, to which these providers have adhered, supplemented by the standard contractual clauses adopted by the European Commission (Decision 2021/914) and, where applicable, by additional measures (encryption in transit, pseudonymisation, minimisation).
You may obtain a copy of the applicable safeguards by writing to privacy@webedia.be.
6. Retention periods
We keep your data only for as long as necessary for the purposes for which it was collected, after which we delete or anonymise it.
- Prospects (contact form, quote request not followed by a contract): 3 years from your last contact.
- Clients and accounting records (accepted quotes, invoices, contractual documents): 10 years from the close of the relevant financial year, in accordance with Belgian accounting and tax obligations.
- Client dashboard accounts: for the duration of the contractual relationship; at its end or upon deletion of the account, account data is anonymised, except for records subject to the accounting obligation above.
- Technical logs and security log: 12 months.
- Consent cookie (wb_consent): 6 months; you are then asked for your choice again.
- Audience measurement cookies (Google Analytics 4): up to 13 months; aggregated audience data is kept for 14 months in Google Analytics.
- Requests to exercise rights: 5 years from our reply, so that we can demonstrate how the request was handled.
8. Client area (dashboard)
The dashboard allows our clients and the members of their organisation to view their quotes, invoices, documents, website statistics and change history, to send us requests and to store credentials in a vault.
The data it contains is processed for the performance of the contract between us and your organisation. Accounts are created by invitation; login is by magic link sent by email or by Google account, with optional two-factor authentication (TOTP).
Credentials stored in the vault are encrypted (AES-256-GCM) before being saved; only authorised members of your organisation and Webedia administrators, in the context of support, can access them.
A security log records logins, failed authentications and sensitive actions (IP address, timestamp, identifier); it is kept for 12 months and is used solely to detect abuse and protect you.
9. Security
Webedia implements appropriate technical and organisational measures to protect your data against loss, unauthorised access, alteration or disclosure:
- encryption of communications (HTTPS/TLS) across the entire website and dashboard;
- hosting in the European Union with an ISO 27001-certified provider, behind a web application firewall and anti-DDoS protection;
- encryption of vault secrets, hashing of authentication tokens, two-factor authentication;
- access restricted to authorised persons only, logging of sensitive access;
- regular encrypted backups of the database;
- security updates and periodic audits of the code and infrastructure.
In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as soon as possible and notify the Data Protection Authority in accordance with Articles 33 and 34 GDPR.
10. Your rights
In accordance with Articles 15 to 22 GDPR, you have the following rights:
- Right of access: to obtain confirmation that your data is being processed and to receive a copy of it;
- Right to rectification: to have inaccurate or incomplete data corrected;
- Right to erasure: to obtain the deletion of your data, subject to our statutory retention obligations;
- Right to restriction: to request that processing be temporarily suspended;
- Right to data portability: to receive the data you have provided to us in a structured, commonly used format;
- Right to object: on grounds relating to your particular situation, to processing based on legitimate interest, and at any time to processing for direct marketing purposes;
- Right to withdraw your consent at any time, in particular via the “Cookies” link in the footer, without affecting the lawfulness of prior processing;
- Right to lodge a complaint with the supervisory authority (see section 12).
To exercise these rights, write to us at privacy@webedia.be or by post to Webedia SRL, Avenue Louise 367, 1050 Brussels. In order to protect your data, we may ask you to prove your identity. We reply within one month, which may be extended by two months for complex requests, in which case you will be informed.
Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
11. Deleting your account
If you have a dashboard account, you may request its deletion at any time:
- from the dashboard, under Settings, using the “Delete my account” button;
- or by email to privacy@webedia.be from the address associated with your account.
We process the request within one month. Your account data is then anonymised; quotes, invoices and other accounting records are kept for the statutory period stated in section 6 and then deleted. If your account is the last owner account of a client organisation, we will contact you beforehand to arrange continued access to its documents.
12. Complaint to the supervisory authority
If you consider that the processing of your data does not comply with the regulations, you may lodge a complaint with the Belgian Data Protection Authority (APD/GBA):
- Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit)
- Rue de la Presse 35, 1000 Brussels
- www.dataprotectionauthority.be
- contact@apd-gba.be
We nevertheless invite you to contact us first at privacy@webedia.be: most questions can be answered quickly.
If you reside in another Member State of the European Union, you may also contact the supervisory authority of your country of residence.
13. Links to third-party websites
The website may contain links to third-party websites (social networks, our clients’ websites, partner tools). Webedia has no control over these websites and is not responsible for their personal data practices. We invite you to read their own privacy policies.
14. Updates to this policy
We may amend this policy to reflect legal or technical developments or changes to our services. The version in force is always the one published on this page, identified by its version number and update date. In the event of a substantial change, dashboard users will be informed by email or by a notification in their area.
Version 2.0 — last updated on 27 October 2026. This version replaces the policy published in January 2026.
15. Contact
For any question about this policy or your personal data: privacy@webedia.be — Webedia SRL, Avenue Louise 367, 1050 Brussels, Belgium — +32 (0)2 899 20 48.
Our legal notice and our general terms and conditions of sale (available in French only) supplement this policy.