Privacy Policy

This Privacy Policy explains how Bart Haagmans ("I", "me", "we") collects, uses, and protects personal data you provide through the website barthaagmans.com or while engaging me as a consultant. I take your privacy seriously and process your data in accordance with the EU General Data Protection Regulation (GDPR) and Belgian data protection law.

1. Who is responsible for your data

The data controller is:

Bart Haagmans
Boschelstraat 31, 3724 Hasselt, Belgium
Email: hello@barthaagmans.com

For any privacy-related question, request, or complaint, you can contact me directly at the email address above.

2. What personal data I collect

I only collect data you actively provide. Specifically:

• Contact form submissions: name, email address, and the content of any message you send.
• Direct communication: if you email me directly, the contents of your message and any attachments you choose to share.
• Client engagement data: during a project, this may include account access (read-only where possible) to platforms such as Google Analytics, Google Search Console, Shopify, WooCommerce, Magento, or similar tools, and any business data needed to do the work.
• Invoicing data: for paid engagements, the billing details required to issue invoices (company name, VAT number, billing address).

I do not use website analytics, advertising cookies, tracking pixels, or fingerprinting tools on barthaagmans.com. The site loads no third-party trackers by default.

3. Why I collect it (legal basis)

Each category of data has a specific purpose and legal basis under Article 6 of the GDPR:

• To respond to your inquiry — when you submit the contact form or email me, I use your name and email to reply. Legal basis: your consent and steps taken at your request prior to entering a contract.
• To deliver services — for active client engagements I process the data needed to perform the agreed work. Legal basis: performance of a contract.
• To meet legal obligations — invoicing records are kept for the period required by Belgian accounting law. Legal basis: legal obligation.
• To protect legitimate interests — for example, keeping records of past communication so I can pick up future requests in context. Legal basis: legitimate interest, balanced against your rights.

4. Cookies and tracking

barthaagmans.com does not set cookies, does not use Google Analytics, and does not embed advertising or social media tracking. The only third-party request the site makes is to Google Fonts to load the Inter typeface; Google's font CDN may temporarily log your IP address for the duration of that request, as described in Google's privacy policy.

If analytics or other cookies are added in the future, this policy will be updated and you will see a clear notice and consent option on first visit.

5. Third parties that process data on my behalf

I keep the list of processors as short as possible. The current ones:

• FormSubmit (FormSubmit Inc., United States) — handles contact-form submissions on this website. When you submit the form, your name, email, and message are sent through FormSubmit and forwarded to my mailbox. FormSubmit acts as a processor on my behalf. Data may be transferred outside the EU; transfers are protected by the Standard Contractual Clauses approved by the European Commission.
• Google (Ireland Ltd. / United States) — for email (Google Workspace) and font hosting (Google Fonts).
• Hostinger (Hostinger International, Lithuania) — provides the hosting infrastructure for the website.
• LinkedIn (Microsoft Corporation, Ireland / United States) — only when you click the LinkedIn link in the footer or contact me through that channel.

For active client engagements, additional processors may be used (e.g. project tools, invoicing software). These will be disclosed and a Data Processing Agreement will be signed where required.

6. How long I keep your data

• Contact form messages and email correspondence: kept as long as needed to handle the conversation, up to a maximum of 24 months after the last contact, unless the conversation leads to an engagement.
• Client project data: kept for the duration of the engagement plus a reasonable handover period (typically 90 days), after which working files are deleted unless otherwise agreed.
• Invoicing and accounting records: kept for 7 years, in line with Belgian accounting law (Article III.86 Code of Economic Law).

7. Your rights under the GDPR

You have a number of rights regarding your personal data:

• Access: request a copy of the personal data I hold about you.
• Rectification: ask me to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): ask me to delete your data, where there is no legal obligation to keep it.
• Restriction: ask me to limit how I process your data while a request or objection is being reviewed.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: where processing is based on consent, you can withdraw it at any time. This does not affect the lawfulness of processing done before withdrawal.

To exercise any of these rights, send an email to hello@barthaagmans.com. I will respond within 30 days. I may ask for proof of identity before acting on a request.

8. How I protect your data

I apply reasonable technical and organisational measures to protect personal data, including:

• HTTPS encryption on the website and during data transfer.
• Access to client systems on a least-privilege basis, using individual accounts and revoked when an engagement ends.
• Strong, unique passwords managed in a password manager, with two-factor authentication where supported.
• Devices are protected by full-disk encryption and a screen lock.
• Backups are encrypted and stored in the EU where possible.

No system is perfect. If a data breach affects your personal data and is likely to result in a risk to your rights, I will notify you and the Belgian Data Protection Authority within 72 hours, as required by the GDPR.

9. Transfers outside the European Economic Area

Some of the processors listed above (notably FormSubmit, parts of Google Workspace, and LinkedIn) may process data in the United States. Where this happens, the transfer is covered either by an adequacy decision of the European Commission, by the EU-U.S. Data Privacy Framework, or by the Standard Contractual Clauses combined with supplementary measures.

10. Children's data

This website and these services are aimed at professionals and businesses. The site is not directed at children under 16, and I do not knowingly collect personal data from minors. If you believe a minor has provided personal data, contact me and I will delete it.

11. Automated decision-making

I do not make decisions that have legal or similarly significant effects based solely on automated processing or profiling.

12. Changes to this policy

This policy may be updated when services, processors, or applicable laws change. The date at the top of this page shows when it was last revised. Material changes will be announced on the website and, where appropriate, by email to active clients.

13. Complaints

If you believe your data is being processed in a way that breaches the GDPR, please contact me first so I can address the issue. You also have the right to lodge a complaint with the Belgian Data Protection Authority:

Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD)
Drukpersstraat 35, 1000 Brussels, Belgium
Phone: +32 (0)2 274 48 00
Email: contact@apd-gba.be
Website: www.dataprotectionauthority.be

14. Contact

For any privacy-related question, request, or complaint:

Bart Haagmans
Email: hello@barthaagmans.com
Address: Boschelstraat 31, 3724 Hasselt, Belgium