YOUR INFORMATION

Privacy

We only request the information needed to understand your requirements and contact you.

Version dated 28 October 2026. The data controller is Martin Couturiaux (Ctx Informatique), BCE 1043.412.370, reachable at contact@deskanddata.com. This address can also be used for any question about your data.

Contact requests

On the hosted website, the contact form records your name, company, email address, phone number, request type, town, topic and message in a protected database. Depending on your needs, you can also state whether your business is blocked, the people affected, your preferred approach, the timing, an indicative budget, the number of people or workstations, the type of support, whether you are already a client and when we can reach you. This data can be accessed only by the site administrator, Martin Couturiaux, to process your request. No password or sensitive document is required.

The call-back request on the Individuals page only stores your first name, your phone number, the topic you chose, your message if you wrote one and, if you came from a flyer’s QR code, that origin. It does not ask for an email address and sends no acknowledgement: you are called back on the number you gave. It is kept in the same protected database as other requests.

If you contact us by phone, on WhatsApp, by email or in person, the administrator may record your request directly in the same database: your name, your company or the mention “private individual”, your phone number or email address, your town, the request type, a description of your needs, the device concerned, how you contacted us and, where applicable, how you heard about us. No acknowledgement is sent for these requests.

If you leave a device with us, a repair sheet is added to the request: the device, the items left with it, the diagnosis, the quote and your agreement, any part on order and the repair stage. For any request, with or without a device, payments are also recorded: amount, payment method (cash, Bancontact, bank transfer, Payconiq or other) and date. No bank account or card number is recorded.

Each request keeps a dated history of exchanges: changes of status, repair stage, payment or follow-up date, as well as calls, emails, WhatsApp messages and appointments noted by the administrator, with a short comment.

Purposes and legal bases

• Answering your request, whether it comes through the form, by phone, on WhatsApp, by email or in person, and preparing a possible proposal: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) or, where no contract is envisaged, our legitimate interest in answering your request (Article 6(1)(f)).
• Website security and protection against abuse (temporary network-address fingerprint, management session, technical logs): our legitimate interest in protecting the service and its users (Article 6(1)(f)).
• Optional analytics: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Optional advertising measurement (Google Ads): your consent (Article 6(1)(a)), which you can withdraw at any time.
• Requests that become customer files (repair sheet, quote, payments): performance of the contract (Article 6(1)(b)) and compliance with accounting and tax obligations (Article 6(1)(c)).

Recipients

The content of requests can only be accessed by the administrator. It is not sold, rented or transferred. It is stored on the server rented from Hostinger described below; apart from this hosting and the sending of emails, no service provider receives it. Desk&Data emails are sent through Google Workspace: the email address you provide is passed to it for the acknowledgement and for our replies. The Healthchecks.io monitoring service receives technical operating signals without form content; the resulting alerts are sent by email and Discord, without request data. If email notifications are enabled, the notice sent to the administrator contains only the request reference. An acknowledgement is also sent to the address given in the form: it contains the type and reference of the request, without repeating your message. Notifications on the administrator’s devices go through their browser’s push service (Apple, Google, Microsoft or Mozilla): they are encrypted and state only the type of request. Data may be disclosed to an authority where required by law.

If you contact us on WhatsApp, your messages go through that service, provided by WhatsApp Ireland Limited (Meta group) and subject to its own privacy policy. We use them only to answer and follow up on your request. If you prefer not to use WhatsApp, use the form or email.

Optional analytics

With your prior consent, the website records page views, contact clicks and form starts as daily totals. Without consent, after a refusal or once consent has been withdrawn, these events are not counted. The form and other services remain available. Consent is the legal basis for these optional analytics. Remarketing and ad personalisation are disabled. Internal counts remain aggregated. The totals contain no visitor identifier and cannot be used to count unique individuals. If your browser sends Do Not Track or Global Privacy Control, nothing is enabled until you accept yourself in the preferences window. The only exception: a visit through the QR code on our flyers is added to a daily total, with no cookie, no identifier and no link to any request; the temporary fingerprint described under “Protection against abuse” is only used to limit how often repeated visits are counted.

You can accept, refuse or withdraw your consent via , which is also available at the bottom of the page. Withdrawal does not affect processing carried out before it. Totals that have already been aggregated cannot be linked back to your browser and removed individually. When JavaScript is disabled, no optional analytics are sent.

Cookies and remembering your choices

A cookie is a small piece of information stored by your browser and returned to the relevant website. The necessary cookies below are internal to this website. The Google tools described below require separate consent.

• crm_privacy: remembers your acceptance or refusal for 180 days, without being renewed on every visit. It is created after you make a choice and is used solely to manage your preferences. It contains a random token, not your name. Its presence does not mean that you accepted analytics.
• crm_session: required for the administrator to sign in, for 8 hours, or up to 30 days if they choose “stay signed in”; the session then ends automatically after 7 days without use. It is created only after a successful sign-in to the management area and is not used for analytics.
• crm_device: set on the administrator’s device after a successful sign-in, for 180 days. It holds a signed random identifier, no name, and is only sent to the sign-in address: it stops a third party from locking the administrator out by trying wrong passwords. It is not used for analytics.

These cookies, which are required to remember your choice or provide the requested sign-in, are not controlled by the analytics acceptance button. They are protected from JavaScript access and transmitted only over HTTPS on the public website. Deleting the preference cookie or changing browser prompts a new choice; without fresh consent, analytics remain disabled.

Google Analytics and Google Ads

With “Analytics” consent, Google Analytics 4 measures pages and contact clicks. With “Advertising” consent, Google Ads measures submitted enquiries and their advertising source. Neither tool loads before consent to its purpose. Remarketing and ad personalisation are disabled. Refusing never prevents contacting us.

These services are provided by Google Ireland Limited. Google may process technical information such as IP addresses, browser information, events and click identifiers on its infrastructure, including outside the European Economic Area, under the safeguards described in its privacy policy. Your form contents, name, email, phone number and message are never sent to Google tags. Enhanced conversions are disabled.

Possible cookies after consent: _ga, _ga_* (analytics, configured for 30 days on this website) and _gcl_* (advertising attribution, up to 90 days according to Google). The Ads conversion window is configured separately for 30 days. gclid and UTM identifiers are stored in the browser session only after advertising consent, then attached to your enquiry to link ads, quotes and customers. They follow the enquiry retention period stated below. The preference register records both purposes separately for 180 days. Withdrawal disables optional events and clears accessible Google cookies on this domain; previously transmitted information remains subject to Google’s retention and rights policies.

Where is the information stored?

Cookies are stored in your browser. Requests, repair sheets, payments, the history of exchanges, sessions and privacy choices are recorded in the server’s private database. The choice register stores a fingerprint of the token, the decision, the date, the version of the notice and, where applicable, the withdrawal. It does not contain your name, email address or IP address and is not linked to requests or page counters.

The website is hosted on a virtual private server (VPS) rented from Hostinger, in a data centre located in the European Union. Only the administrator manages this server. Backups of the database are encrypted on this server, and a copy of these encrypted files is kept on Google Drive (Google Workspace) in case the server is lost. Google cannot read them: the key needed to open them is kept offline by the administrator. The readable content of requests remains stored in the European Union.

Private management area

The private management area uses a session cookie required for sign-in, valid for 8 hours, or up to 30 days with “stay signed in”; in that case, the session ends automatically after 7 days without use. It is not used to measure visitors. Notes and follow-up dates remain visible only to the administrator. If email notifications are enabled, they announce a new request and its reference without including the message or the requester’s contact details.

Protection against abuse

A temporary fingerprint of the network address is used to limit automated submissions. It ceases to be used after 24 hours and is deleted during a subsequent rate-limit check. The website does not store the raw IP address in requests or counters. Web server logs record IP addresses and technical information about requests. They are used only for security and troubleshooting, and are kept for 30 days.

Retention

Requests are retained for 180 days from receipt and then deleted automatically together with their repair sheet and history: the server checks every day for requests that have reached that limit. This also applies to requests recorded by the administrator. Two cases are excluded from this deletion: a request marked as a “signed customer” and a request on which a payment is recorded. These are not deleted automatically and follow the periods required by the contract and by accounting obligations. The administrator marks a request as a signed customer; this also happens automatically when the administrator records a device left with us for a request that is new, contacted or at the appointment stage. If it is later given another status, for example “no follow-up” after a quote is refused, and no payment is recorded on it, it is deleted after 180 days together with its repair sheet and history. Counters older than 396 days are deleted when a new authorised event is received; without further use, they may therefore remain in the database. Privacy choices expire after 180 days and expired records are deleted when a subsequent choice is made. Backups are encrypted and only the 30 most recent are kept: older ones are deleted automatically. They contain neither sign-in sessions nor network-address fingerprints. Data deleted from the live database may still appear in backups; it disappears from them at the latest once those backups have been replaced. They are used only to restore the service after an incident.

Your data rights requests

Email contact@deskanddata.com to request access to, correction of or deletion of your request, quoting its reference if available. Depending on the circumstances, you may also request restriction, object to certain processing or request data portability. You may lodge a complaint with the Belgian Data Protection Authority. Deleting a cookie in your browser does not delete data already stored on the server or in backups.