Privacy policy
Last updated: 10.10.2026
1. Who is responsible
The controller of your personal data is Neagu Group (BV), Mechelsesteenweg 67, 2018 Antwerpen, Belgium, enterprise number BE0677.564.992. Email: neagu.group@gmail.com, phone: +32 493 42 82 39.
We process personal data in accordance with the General Data Protection Regulation (GDPR) and Belgian data protection law. We only collect what we need.
2. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering your message (contact form, email, phone, Instagram) | Name, email address, subject, message, and any details you choose to share | Steps at your request before entering into a contract (Art. 6(1)(b) GDPR), or our legitimate interest in answering questions (Art. 6(1)(f)) | Up to 12 months after our last contact, unless a contract follows |
| Quotes, contracts and invoicing | Name, contact details, site address, project details, invoicing data | Performance of a contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) | For the duration of the contract and liability periods; invoices for 10 years (Belgian accounting law) |
| Spam and abuse protection of the contact form | A one-way hashed version of your IP address (rate limiting); data processed by Google reCAPTCHA | Legitimate interest in protecting our website (Art. 6(1)(f)) | Hashed IP: maximum 24 hours |
| Showing a map on the contact page | IP address and device data processed by Google Maps | Your consent (Art. 6(1)(a)), which you can withdraw at any time | See Google's privacy policy |
| Hosting and security of the website | Technical server logs (IP address, browser, time of request) | Legitimate interest in a secure, working website (Art. 6(1)(f)) | According to our hosting provider's log policy |
The fields in the contact form are the minimum we need to reply to you. We do not use your data for profiling or automated decision-making, and we never sell it.
We do not keep a database of contact form messages: the form only forwards your message by email to our mailbox, and nothing you type is stored on the web server. “Processing” in the sense of the GDPR also covers receiving and keeping these emails, which is why this policy applies.
3. Who receives your data
We only share data with service providers that help us run our business, and only as far as needed:
- Our web hosting provider: hosts the website and processes the contact form.
- Google Ireland Ltd / Google LLC: email (Gmail), spam protection (reCAPTCHA) and, only with your consent, Google Maps. See Google's privacy policy.
- Accountants and authorities: where required by law (for example tax obligations).
Fonts are hosted on our own server; no data is sent to Google Fonts or other font services.
4. Transfers outside the EU
Google may process data in the United States. Such transfers are based on the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.
5. Children
Our services are intended for adults. The contact form may only be used by persons aged 16 or older. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, contact us and we will delete it.
6. Your rights
You have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted (“right to be forgotten”);
- restrict or object to processing, including processing based on legitimate interest;
- receive your data in a commonly used format (data portability);
- withdraw your consent at any time, for example via “Cookie settings” at the bottom of each page.
We respond to requests within one month. You can also lodge a complaint with the Belgian Data Protection Authority: Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, contact@apd-gba.be.
7. Requesting deletion of your data
To have your data deleted, send an email to neagu.group@gmail.com with the subject “Data deletion request” and the email address or phone number you used to contact us. We may ask for additional information to verify your identity. We will confirm the deletion within one month. In practice, this means we delete your emails and messages from our mailbox.Data we are legally required to keep (such as invoices) will be deleted once the legal retention period ends.
8. Emails and newsletters
We do not send newsletters or marketing emails. We only email you to answer your question or about your project. If we ever start sending marketing emails, we will only do so with your prior consent, and every such email will contain an unsubscribe link.
9. Security
We take appropriate technical and organisational measures to protect your data, such as encrypted connections, access restriction and spam protection. Contact form submissions are not stored on the web server beyond what is needed to send them to us.
10. Changes
We may update this policy. The date at the top of this page shows the latest version.