Who processes your data

Obez, Lenny Ind., the sole proprietorship of Lenny Obez, Rue Ste Catherine 12/000A, 4500 Huy, Belgium. CBE and VAT BE 0713.634.146. Write to contact@lennyobez.com.

There is no data protection officer: the business meets none of the criteria in article 37 GDPR. So I answer, directly.

What I collect, and why

Contact form

Name, email address, nature of the request, subject and message. These go to my mailbox and are not stored in the site database. Legal basis: pre-contractual steps taken at your request (article 6.1.b), or my legitimate interest in answering someone who writes to me (article 6.1.f) when your message is not about an assignment. Retention: three years from the last exchange, seven years if the request led to an invoice, under Belgian accounting obligations.

Quote and booking requests

Name, email address, type of work, preferred date, location, description of the need, language and request status. A fingerprint of your IP address is added, meaning an irreversible digest: it only serves to spot automated submissions and cannot be turned back into the address. This data is stored in the database. Legal basis and retention: same as the contact form.

Email address, language, confirmation date. Sign-up is double opt-in: until you click the confirmation link, nothing is sent to you. Legal basis: your consent (article 6.1.a), which you can withdraw at any time through the unsubscribe link in every message. Retention: until you unsubscribe.

Technical logs and anti-abuse filters

The server records requests with the IP address, timestamp, requested URL and the browser announced. These logs rotate and are overwritten. When a form submission is rejected by the anti-abuse filters, the reason is logged along with the fields entered, so that a real person wrongly blocked can be found and contacted again. Legal basis: my legitimate interest in keeping the service available and protecting it from automated submissions (article 6.1.f).

Cookies

This site sets no advertising cookies, no analytics cookies and no third-party trackers. It therefore shows no consent banner, having nothing to ask consent for.

Three strictly functional cookies may be set:

locale: remembers the language you chose. One year.
theme: remembers light or dark. One year.
PULSAR_SESSION: only on pages carrying a form, to secure the submission. Two hours.

These fall under the consent exemption for trackers strictly necessary to the service you asked for.

Who else has access

Two processors, both established in the European Union:

Mailgun, Europe region, delivers the site's email.
Amazon Web Services, Europe region, hosts the site and its database.

No data is sold, rented or traded. No transfer outside the European Union takes place. A third party receives your data only where the law requires it of me.

Your rights

The GDPR gives you the right:

of access: to know whether I process data about you, and to obtain a copy;
to rectification: to have inaccurate or incomplete data corrected;
to erasure: to ask for deletion, except where a legal obligation requires me to keep it;
to restriction: to have processing frozen while a dispute is settled;
to portability: to receive your data in a machine-readable format, or have it transmitted;
to object: to object to processing based on my legitimate interest;
to withdraw consent at any time, without affecting what was done before.

Write to contact@lennyobez.com. I answer within a month. No identity document is asked for by default; I may ask for a clarification if there is reasonable doubt about who you are.

Automated decisions

No decision producing legal effects is taken automatically. The price calculators produce an indicative estimate, never a commitment, and no profiling is carried out.

Complaints

If my answer does not satisfy you, you can contact the Belgian Data Protection Authority:

Rue de la Presse 35, 1000 Brussels, Belgium
contact@apd-gba.be
www.dataprotectionauthority.be

You may also contact the authority of the country where you live.

Security

The site is served over HTTPS only. The session cookie is marked Secure, HttpOnly and SameSite=Strict. Forms are protected against cross-site submission. Should a breach present a high risk to your rights, I will tell you and notify the Authority within 72 hours.

Changes

Any change to this document is dated above. Substantial changes are announced to newsletter subscribers.

Privacy policy