Privacy Policy
Version of 6 September 2026
This policy explains, without hiding behind boilerplate, what we do with your personal data: what we collect, why, who else sees it, how long we keep it, and what you can demand from us.
1. Who is responsible for your data
The controller of the personal data described in this policy is Add You Agency, a sole proprietorship (eenmanszaak) under Belgian law, operated by Dylan Flament, with its registered office at Auguste Oleffestraat 3/020, 2020 Antwerp, Belgium, registered in the Crossroads Bank for Enterprises (KBO/BCE), Belgium under enterprise and VAT number BE 0768.613.152.
You can reach us at contact@addyouagency.com or +32 470 79 81 54. Privacy questions and requests to exercise your rights go to the same address; put "privacy" in the subject line so it is routed correctly.
We are not required to appoint a Data Protection Officer: we are a small business, our core activity is not large-scale monitoring of individuals, and we do not process special categories of data on a large scale (art. 37 GDPR). Requests are handled personally by Dylan Flament.
2. What this policy covers
This policy covers www.addyouagency.com and the direct contact that follows from it: e-mail, phone, quotes, invoices and project work.
Our software products carry their own notice, because the roles differ. In VaultChain, AboApp, our CRM and the ERP environments we deliver to clients, the client is usually the controller and we act as their processor. What we may do with data in that role is set out in the data processing agreement we sign with each client, not in this policy.
3. What we collect, why, and on what legal basis
We collect only what a purpose actually needs. The table below is the complete picture for this website and for the client relationship that may follow from it.
| Purpose | Data | Legal basis (GDPR art. 6) | Retention |
|---|---|---|---|
| Answering your project intake or e-mail | Name, e-mail address, phone number, company name, VAT number, project type, contact preference and your description of the project | Steps taken at your request prior to a contract (art. 6(1)(b)); for a message that leads nowhere, our legitimate interest in handling enquiries (art. 6(1)(f)) | 2 years after the last contact, unless it becomes a client file |
| Delivering an agreed service and managing the client relationship | Contact and company details, correspondence, project files, and access data for the systems we build or manage for you | Performance of the contract (art. 6(1)(b)) | Duration of the contract plus 10 years, the limitation period for contractual claims under Belgian law |
| Invoicing and bookkeeping | Billing details, VAT number, invoices and payment data | Legal obligation (art. 6(1)(c)) under Belgian VAT and accounting law | 7 years from the closing of the financial year (art. III.86 Code of Economic Law) |
| Keeping the website available, stopping abuse of our forms, and counting how often each page is read | Request time, page, referrer and browser type. The IP address is truncated before it is written down: the last part is replaced by zeroes, which leaves a country and a provider but not a person. A full address exists only in memory, for at most 60 seconds, to rate-limit our own forms | Legitimate interest in the security and availability of our systems, and in knowing what visitors look for (art. 6(1)(f)) | Truncated server logs up to 30 days; the aggregated report holds no individual records |
| Testing which version of a page works better (A/B test) | A single letter (A or B) stored in your browser, plus that letter travelling along with your form submission | Your consent (art. 6(1)(a)). Nothing is stored until you accept | Until you withdraw consent or clear your browser storage |
| Informing you about our services after an assignment | Name, e-mail address and company | Your consent, or our legitimate interest in contacting existing clients about similar services (art. 6(1)(f) and art. XII.13 Code of Economic Law) | Until you unsubscribe; every message carries an unsubscribe link |
We do not buy address lists, we do not enrich your data from third-party sources, and we never sell personal data.
4. Cookies and storage on your device
This website places no tracking or advertising cookies. Only two things ever touch your device beyond what is strictly necessary to display the page, and both are described — with the option to refuse them — in our Cookie & Storage Policy.
5. Who receives your data
We use a small number of suppliers to run our business. They process your data only on our instructions, under a processing agreement within the meaning of art. 28 GDPR, and may not use it for their own purposes.
| Recipient | What they do for us | Where | Safeguard for transfers |
|---|---|---|---|
| Hetzner Online GmbH | Servers for this website and for our self-hosted applications (CRM, VaultChain bridge, file storage). This site is served from our own machine there; there is no hosting provider between us and you. | Germany (EU) | No transfer outside the EEA |
| Cloudflare, Inc. | DNS for our domains and protection against attacks and abuse. | United States, with EU points of presence | EU Standard Contractual Clauses / EU-US Data Privacy Framework |
| Purelymail LLC | Our e-mail: sending and receiving messages from contact@addyouagency.com. | United States | EU Standard Contractual Clauses |
| Supabase Inc. | Database behind parts of our applications. | EU region (Frankfurt, Germany) | No transfer outside the EEA for the EU region |
| Base (public blockchain, operated by Coinbase Technologies, Inc.) | Anchoring encrypted records and their proof of integrity, through our own VaultChain software. | Global, decentralised network | Public network; see the section on blockchain in our privacy policy |
| Google Ireland Ltd. (Google Fonts) | Delivery of the web fonts used by this website. | Ireland (EU), with global delivery network | EU Standard Contractual Clauses / EU-US Data Privacy Framework |
Beyond this list we share data only with our accountant and, where legally required, with public authorities. We never pass your data to third parties for their own marketing.
6. Data anchored on a blockchain, and what that means for you
Project intake submissions from this website are stored in our own VaultChain system. VaultChain encrypts each record and then anchors it on Base, a public blockchain. We state this explicitly, because a blockchain behaves differently from an ordinary database and that difference touches your rights.
- —What lands on the chain is encrypted. Without our key, nobody can read your name, e-mail address or project description in it. In data-protection terms the anchored record is pseudonymised data, not plain text.
- —Entries on a public blockchain cannot be removed. That is a property of the technology, not a choice we make. If you ask us to erase your data, we delete it everywhere we control and we destroy the ability to read the anchored record by discarding the key material and writing a deletion marker (a "tombstone") against it. From that moment the anchored record is an unreadable, meaningless block of bytes.
- —You can avoid it entirely. If you would rather not have an encrypted record anchored at all, send a plain e-mail to contact@addyouagency.com instead of using the form. E-mail is handled without any blockchain anchoring.
We consider this the honest way to present the trade-off. If you believe it affects you disproportionately, tell us and we will handle your request without anchoring.
7. Transfers outside the European Economic Area
Our own servers stand in Germany. Some of our suppliers are established in the United States; the table in section 5 says which. Where data reaches them, the transfer rests on the European Commission's Standard Contractual Clauses and, where the supplier is certified, on the EU-US Data Privacy Framework, supplemented by encryption in transit and at rest.
A public blockchain is by its nature a globally distributed network. That is precisely why records are encrypted before anchoring: what is replicated worldwide is ciphertext, not readable personal data.
8. How long we keep your data
The retention period per purpose is in the table in section 3. Two rules govern the rest:
- —Data we keep because the law requires it — invoices and accounting records — is kept for exactly that period, 7 years, and then removed.
- —Data we keep for our own purposes goes as soon as the purpose ends. A quote that never becomes an assignment disappears after 2 years.
Backups follow their own cycle and are overwritten within 90 days. If we delete your data at your request, it disappears from the live systems immediately and from the backups within that cycle.
9. How we protect your data
Concretely, and not as a slogan:
- —Every connection to our sites and applications runs over TLS, with HSTS enabled.
- —Records in VaultChain and in our CRM are encrypted with a key derived per client, so our servers can process data without anyone being able to open a client vault at will.
- —Access to systems is personal, protected by strong credentials, and logged.
- —We keep our software up to date and run automated security checks against our own code.
- —Everyone working for us, self-employed consultants included, is bound in writing to confidentiality and to our security instructions.
If a data breach nevertheless occurs and it is likely to result in a risk to your rights, we notify the Belgian Data Protection Authority within 72 hours and, where the risk is high, we inform you directly (art. 33 and 34 GDPR).
10. Your rights
Under the GDPR you have the right to:
- —Access — ask what data we hold about you and receive a copy of it.
- —Rectification — have incorrect or incomplete data corrected.
- —Erasure — have your data deleted, subject to the limits described in section 6 and to data we are required by law to keep.
- —Restriction — have processing frozen while a dispute about accuracy or lawfulness is being settled.
- —Portability — receive the data you gave us in a structured, machine-readable format, or have it sent on to another provider.
- —Objection — object to processing based on our legitimate interest. Against direct marketing we always honour the objection, no reasons needed.
- —Withdrawal of consent — withdraw consent at any time, without affecting processing that already took place.
Send your request to contact@addyouagency.com. We answer within one month. If a request is complex we may extend that by two months and will tell you why within the first month. Handling a request is free; only for manifestly unfounded or repetitive requests may we charge a reasonable fee or refuse (art. 12(5) GDPR). If we have reasonable doubts about who is asking, we may request proof of identity — we ask for the minimum needed and do not keep the proof.
11. Automated decisions
We take no decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (art. 22 GDPR). The A/B test in section 3 decides which text a page shows, nothing about you. Every decision about a quote, an assignment or a collaboration is taken by a human.
Where we use AI tools internally to help write or review code, we do not feed client personal data into them.
12. Children
Our services are aimed at businesses and at adults. We do not knowingly collect data from children under 16. If you believe a child has given us data, contact us and we will delete it.
13. Complaints
If you believe we handle your data incorrectly, please contact us first — most issues are settled faster that way. You always keep the right to lodge a complaint with the supervisory authority:
Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, Belgium — contact@apd-gba.be — https://www.gegevensbeschermingsautoriteit.be. You may also complain to the authority of the EU country where you live or work.
14. Changes to this policy
We update this policy when what we do changes. The version date sits at the top of this page. For material changes that affect them, clients are notified by e-mail. We do not apply changes retroactively to processing that has already taken place.
Questions about this policy, or about a request you sent us? Write to contact@addyouagency.com — you get an answer from a person, not a ticket system.