Privacy Policy
Last updated: April 21, 2026
Who we are
GY Digital is the project of a student-entrepreneur building professional websites for local businesses in Mechelen, Vilvoorde, Zemst and Flemish Brabant.
Invoicing: handled officially through Tentoo (Belgian registered payroll & invoicing agency), which acts as the legal issuer of invoices.
Contact: privacy@gy-digital.be. Phone: +32 492 49 38 04. Region: Mechelen, Belgium
What personal data do we collect?
Via the contact form on this website we collect:
Name: to address you personally
Email (optional if phone provided): to reply by email
Phone (optional if email provided): to call back
Message: the content of your request
We only collect data you actively fill in. At least one contact channel (email or phone) is required so we can reply.
Why do we process this data?
Your data is used only to contact you regarding your request for our services.
Legal basis: explicit consent (GDPR art. 6(1)(a)) when submitting the form and/or legitimate interest (art. 6(1)(f)) for commercial follow-up.
How long do we keep your data?
We keep your contact data for a maximum of 12 months after the last contact. After that it is permanently deleted.
If we collaborate on a project, project-related data is kept for the duration of the collaboration plus the legal accounting retention period (7 years).
With whom do we share your data?
We never sell, rent or share your personal data with third parties for commercial purposes.
We do use the following processors:
Web3Forms: form forwarding service (web3forms.com). Your data passes through their API and is forwarded straight to our mailbox, no permanent storage on their side. See their privacy policy.
Google Analytics 4 & Google Ads (gtag.js): we use Google Tag (measurement ID G-Q8B51FCJLL) to measure site usage and track ad conversions. By default these cookies are denied (Google Consent Mode v2), only after you click "Accept cookies" in our cookie banner is anonymous visitor info and ad attribution shared with Google. IP addresses are anonymised. See Google's privacy policy.
Hosting provider: our servers are with an EU-based, GDPR-compliant host.
Self-hosted visit analytics (GY Digital first-party)
In addition to Google Analytics we run a self-hosted analytics module on the same EU server. No data is shared with any third party. How it works:
Declined / no choice: anonymous mode. We record aggregated pageviews, clicks on links/buttons, scroll depth (25/50/75/100%), which sections you read, active time per page, and conversion clicks (email, phone, WhatsApp, contact form). No cookies or localStorage items are set. Your IP is hashed in memory with a daily-rotating salt and immediately discarded, the hash is not reversible and rotates every day, preventing journeys from being linked across days. Legal basis: legitimate interest + CNIL/EDPB audience-measurement exemption.
The salt used to hash your IP changes every day and is stored nowhere: it exists only in the server's memory and is gone for good after a restart. Even with a full copy of our database, a hash cannot be traced back to an IP address.
In this mode we also do not store: your city or region, your coordinates, your screen size, or the full URL of a link you click. Of that last one we keep only the kind (email, phone or external link), so no email address or phone number ever ends up in our measurements.
Accepted: extended mode. On top of the anonymous measurement, a random visitor UUID is stored in your browser (gy_visitor_id) plus a session UUID (gy_session_id). This lets us link your visits across days (e.g. see that the same visitor returned next week) without us knowing your identity. We never run ads or behavioural targeting on this data. Legal basis: your explicit consent (GDPR art. 6(1)(a)).
Retention: raw events 6 months, then automatically deleted. Aggregated anonymous totals are kept longer.
See or erase your data: one-click button at the bottom of this page, immediate and permanent, no email needed.
Your rights (GDPR)
Under GDPR you have:
Right of access: ask which data we hold
Right of rectification: correct inaccurate data
Right to erasure: request deletion ("right to be forgotten")
Right to object: object to processing
Right to portability: obtain your data in a structured format
Right to withdraw consent: at any time, without consequences
To exercise these rights, contact privacy@gy-digital.be. We reply within 30 days.
Security
We apply appropriate technical and organisational measures: HTTPS encryption, firewall, regular backups and access control.
Complaints
If you feel your rights have not been respected, you can file a complaint with:
Belgium: Data Protection Authority: dataprotectionauthority.be
Questions? Email privacy@gy-digital.be