Privacy Policy

Personal data (GDPR)

Controller: Nicolas Louppe.

Data that may be processed

• IP address, User-Agent and technical logs for security and abuse prevention.
• First name, last name, email, request type, description and preferred date submitted through the form.
• QR scan data: IP, User-Agent, medium and timestamp.
• When chat is opened: session identifier, page, referrer, browser language, User-Agent and timestamp; then messages entered in the conversation.

Purposes and legal basis

• Answer requests and prepare a pre-contractual relationship.
• Secure the website and prevent spam and fraudulent use.
• Improve the service technically and produce internal statistics for QR media.
• Operate the chatbot and, when requested, hand over to an adviser.

Legal basis: legitimate interests and steps taken at the data subject’s request before entering into a contract.

Retention

• Technical security data: up to 30 days.
• Contact requests: for the pre-contractual relationship and up to 12 months where no contract follows.
• QR statistics: up to 12 months.
• Chat conversations: for the technical period required to provide the service and prevent abuse; this period must be reviewed and documented before production release.

Data is not sold or used for commercial profiling. No external LLM system is used to process the data.

Your rights

You have rights of access, rectification, erasure, restriction, objection and data portability. Exercise them by emailing contact@codebylouppe.be.

You may also lodge a complaint with the Belgian Data Protection Authority.

QR media statistics

The website may record scans of QR codes displayed on flyers, business cards or posters to assess their performance. Data is limited to IP address, User-Agent, medium type and timestamp. No named data or profiling is sought.

Processing takes place on infrastructure controlled by the controller and located in the European Union.

Audience measurement (Google Analytics 4)

Only with your audience measurement consent, the website loads Google Analytics 4 to measure visits, pages viewed, interactions and related technical information. The website does not intentionally send your name, email address, form content or chat content to Google Analytics.

The legal basis is your consent, which can be changed at any time through “Manage cookies”. Google Signals and personalised advertising are disabled in the tag configuration. Google may process data outside the European Economic Area under its own safeguards and terms: Google Privacy Policy.

After consent, _ga and _ga_1BTN3S1W7C cookies may be stored. The event data retention period depends on the retention setting of the Google Analytics property; this setting must remain documented and aligned with the effective configuration.

Cookies and local storage

Necessary mechanisms are used without prior consent only to provide or secure a requested function:

• cbl_cookie_consent remembers your choices for no longer than six months.
• PHPSESSID maintains a secure session when the form or chat is used and expires at the end of the session.
• cbl_contact_cooldown prevents form abuse for 24 hours.
• sessionStorage:chatbot_session_id and temporary form input storage maintain an action requested during the session.

With your agreement to preferences, cbl_locale remembers the language for one year and localStorage:cbl-theme remembers the theme until the choice is withdrawn. With your agreement to external media, Google Maps may load; Google then receives the technical data required for that request under its own terms.

Google Analytics 4 loads only after you have allowed audience measurement. No advertising pixel or advertising profiling is loaded by the public website. Using the website is not stored as a separate acceptance of the Terms of Use.

Professional data

Data submitted through the form is presumed to relate to a professional enquiry. Processing takes place in a B2B context unless explicitly stated otherwise.