This is a courtesy translation of the Dutch privacyverklaring of Veneysis Advisory & Consultancy, version 1.1 of 21 September 2026, drawn up under the General Data Protection Regulation (Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018. The Dutch text prevails in case of discrepancy.
Article 1 — Who is responsible for your data
1.1 Cedric Buch, trading as Veneysis Advisory & Consultancy ("we" or "VAC"), is the controller for the personal data described in this notice. Our details are on the first page. No data protection officer has been appointed. Questions and requests about your data go to cedricbuch@veneysis.com.
1.2 When we deliver training, assessments or administrative services for a client and process data of its staff, trainees or patients in doing so, we act on that client's instructions. The client is then the controller and we are the processor; the arrangements are set out in the data processing agreement annexed to the service agreement. For questions about that processing, please contact the client first.
Article 2 — Who this notice applies to
2.1 This notice applies to everyone whose personal data we process: visitors to veneysis.com, people who contact us, prospects and their contacts, clients and their staff, participants in workshops and training programmes, and suppliers and partners.
Article 3 — What data we process, why and for how long
3.1 The overview below shows, per situation, which data we process, for what purpose, on which legal basis (Article 6 GDPR) and for how long we keep it. At the end of the retention period the data is deleted or anonymised, unless a pending dispute or a legal obligation requires longer retention.
Visiting veneysis.com
- Data
- Technical data recorded by the hosting provider in server logs: IP address, browser, time, page requested.
- Purpose and legal basis
- Operation, security and abuse detection of the website — legitimate interest (Art. 6(1)(f)).
- Retention
- Retention depends on the technical purpose and the settings and terms of the hosting or security service involved. Data is retained no longer than necessary for operation, security, incident investigation or legal obligations. The period differs by data category; information about the applicable period is available on request.
Contact by e-mail or telephone
- Data
- Name, e-mail address, telephone number, organisation and role, content of your message.
- Purpose and legal basis
- Answering your question, arranging an introduction, preparing a quotation — pre-contractual steps at your request (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)).
- Retention
- Twelve months after the last contact where no agreement follows.
Quotations and agreements
- Data
- Identification and contact details, role, enterprise number, invoicing details, correspondence, planning and reports on the services.
- Purpose and legal basis
- Preparing and performing the agreement, following up the engagement (Art. 6(1)(b)).
- Retention
- Ten years after the end of the agreement (limitation period for contractual claims and retention duty for accounting records).
Invoicing and accounting
- Data
- Invoice details, payment details (IBAN), VAT number.
- Purpose and legal basis
- Legal obligations on VAT and accounting (Art. 6(1)(c)).
- Retention
- Ten years from 1 January following the financial year (Art. III.86 Code of Economic Law and Art. 60 VAT Code).
Workshops, training and assessments
- Data
- Name, role, organisation, attendance, evaluations and assessment results, possibly photo or video material of exercises.
- Purpose and legal basis
- Usually as processor on the client's instructions (data processing agreement). For open enrolments: performance of the agreement with the participant (Art. 6(1)(b)).
- Retention
- As instructed by the client. For open enrolments: three years after the session, certificates ten years.
News about services and publications
- Data
- Name, e-mail address, organisation of clients and of people who asked to be kept informed.
- Purpose and legal basis
- Consent (Art. 6(1)(a)), or legitimate interest (Art. 6(1)(f)) where permitted. Promotional email to existing clients without separate consent is limited to our own similar services, where contact details were obtained during a sale and a simple, free opportunity to object was provided both when collecting them and in every message. Otherwise we obtain prior consent.
- Retention
- Until you object or withdraw consent, and at most three years after the last contact.
Suppliers and partners
- Data
- Contact and invoicing details of contact persons.
- Purpose and legal basis
- Performance of the agreement and legal obligations (Art. 6(1)(b) and (c)).
- Retention
- Ten years after the last invoice.
__cf_bm
- Provider
- Cloudflare
- Purpose
- Security and protection against automated abuse
- Lifetime
- 30 minutes of continuous inactivity
3.3 We take no decisions about you based solely on automated processing and we do not profile.
Article 4 — Where the data comes from
4.1 Most data we receive directly from you. We may also receive data from your organisation when it names you as a contact or participant, and from public sources such as the Crossroads Bank for Enterprises, your company website or your professional LinkedIn profile, solely to prepare a business contact.
Article 5 — Who we share data with
5.1 We do not sell personal data. We share it only with parties that help us deliver the service, and only as far as necessary:
IT suppliers acting as processors: Google (Google Workspace — e-mail, calendar and storage), the website hosting provider and Cloudflare for website delivery and security, the invoicing and accounting software and the tools used to prepare documents, each under a data processing agreement;
the accountant, the bank (ING) for payments, and the social insurance fund or public authorities where the law requires it;
subcontractors or specialists we engage for an assignment, bound by the same confidentiality;
the client on whose behalf a training programme or assessment takes place, for the results the agreement provides for.
Article 6 — Transfers outside the European Economic Area
6.1 We use international IT services, including Google Workspace and the website hosting and security infrastructure. Personal data may therefore be processed outside the European Economic Area, including in the United States. Cloudflare states that security-cookie data may be processed in the United States by default. We therefore do not guarantee exclusively European processing. A transfer outside the EEA requires an applicable adequacy decision or another valid safeguard, such as standard contractual clauses, with additional measures where needed. The applicable safeguard depends on the supplier, service and agreement. Contact cedricbuch@veneysis.com for information on the safeguards used for your data and how to obtain a copy.
Article 7 — Security
7.1 We take appropriate technical and organisational measures to protect your data: two-step verification on all accounts, encrypted storage and connections, access limited to those who need it, and confidentiality by everyone who works for us. In the event of a breach that poses a risk to you, we notify the Data Protection Authority within 72 hours and, where the risk is high, you as well.
Article 8 — Your rights
8.1 You have the right to access your data, to have it corrected or erased, to have processing restricted, to receive your data in a common format and have it transferred, and to object to processing based on our legitimate interest. You may object to the use of your data for direct marketing at any time and free of charge. Consent you have given can be withdrawn at any time, without affecting the processing that took place before.
8.2 You exercise these rights by e-mail to cedricbuch@veneysis.com. We reply within one month; for complex requests that period may be extended by two months, in which case we will let you know. We may ask you to prove your identity. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
Article 9 — Complaints
9.1 If you are unhappy with how we handle your data, please tell us first. You may also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, +32 2 274 48 00, contact@apd-gba.be, www.dataprotectionauthority.be.
Article 10 — Changes
10.1 This notice may be amended when our services, suppliers or the law change. The current version, with its version number and date, is always available on veneysis.com. Material changes are communicated to current clients.
Further cookie information
Cloudflare: https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/