Last updated: 7 August 2026 · Version: 1.0 · The English version is authoritative; other languages are machine-translated for convenience.
This website collects very little. There are no cookies, no advertising, no profiling and no tracking across sites. What follows is the detail.
1. Who we are (the controller)
ePotentia VOF Frans van Dijckstraat 59, 2100 Deurne (Antwerpen), Belgium Company number (KBO/BCE): 0725.714.903 VAT: BE 0725.714.903 Legal entities register: RPR Antwerpen, afdeling Antwerpen Email: [email protected]
ePotentia VOF is the data controller for the personal data described below.
Data protection contact: Rina Jaeken - [email protected]. We are not legally required to appoint a Data Protection Officer; Rina is your point of contact for any privacy matter.
2. What we process and why
| Data | When | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Name, email, subject, message | You send the contact form | Answer your enquiry | Steps prior to a contract, Art. 6(1)(b); otherwise legitimate interest, Art. 6(1)(f) |
| Name, email, any notes | You book a call | Schedule the meeting, send the invitation, hold the call | Steps prior to a contract, Art. 6(1)(b) |
| IP address, browser, timestamp | Any request | Security, abuse prevention, diagnosing faults | Legitimate interest, Art. 6(1)(f) |
| Anti-abuse signals | You submit a form | Distinguish people from bots | Legitimate interest, Art. 6(1)(f) |
| Page, referrer, country, device type - aggregated, no identifier | Any page view | Understand which pages are useful | Legitimate interest, Art. 6(1)(f) |
| Account, billing and support data | You are a hosting customer | Provide and bill the service | Contract, Art. 6(1)(b); legal obligation for invoices, Art. 6(1)(c) |
We do not process special-category data (Art. 9), and we ask you not to send it through the contact form.
3. Analytics, and why there is no cookie banner
We use Umami, which we host ourselves at stats.epotentia.com. It sets no cookies, assigns no persistent identifier, and does not follow you between websites. It records a page path, a referrer, a country and a device type, aggregated into counts.
That is why this site has no consent banner. Consent under the ePrivacy Directive is required for storing or reading information on your device - and we do neither. We think this is better than the alternative: a banner most people dismiss, protecting data we would rather not collect in the first place.
We do not use Google Analytics.
4. Booking a call
When you book, we create an event in a Google Calendar belonging to ePotentia, and Google sends you an invitation with a video-meeting link. Your name, email address and any notes you provide appear in that event.
To work out which times to offer, we read only the free/busy status of our own calendars. That returns the start and end of blocked periods and nothing else - no titles, no attendees, no content. The booking page can tell when we are busy without being able to see what we are doing.
5. Processors
| Processor | Role | Location / safeguard |
|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd) | Hosting, media storage | EU - europe-west4, Netherlands |
| Google (Google Ireland Ltd) | Calendar events and meeting invitations | EU, under Google's standard terms |
| Resend | Sending contact-form and booking emails | US - Standard Contractual Clauses |
| Cloudflare | CDN, and the Turnstile anti-bot check | US - Standard Contractual Clauses |
ePotentia (own server, europe-west4) | Self-hosted analytics; legacy hosting and billing | EU |
Error monitoring (Sentry) exists in the codebase but is not currently switched on; if we enable it we will add it here first.
If we change a provider we update this list. Any new provider processing personal data will be EEA-based or covered by an appropriate transfer mechanism.
6. International transfers
The website, its media and our analytics are processed inside the EEA. Two processors are US-based - Resend for email delivery and Cloudflare for the CDN and anti-bot check - and those transfers rely on Standard Contractual Clauses, supplemented by the EU–US Data Privacy Framework where the provider is certified.
7. How long we keep things
- Contact-form enquiries: kept as business correspondence - with the project records if the enquiry becomes an engagement, and otherwise as a record of the exchange. We do not run a scheduled deletion of correspondence, so we would rather say so than publish a retention period we do not keep to. If you want your enquiry deleted, ask us and we will remove it.
- Bookings: the calendar event stays in our calendar as a business record. Ask us and we will remove it.
- Server logs: 30 days.
- Analytics: aggregated counts, kept indefinitely because they identify nobody.
- Invoices and accounting records: 7 years, as Belgian law requires.
8. Your rights
You may access, rectify or erase your data; restrict or object to processing; and request portability. Where processing rests on legitimate interest you may object at any time, and we will stop unless we have compelling grounds not to.
Because we keep correspondence rather than deleting it on a schedule (§7), erasure on request is the route that matters most here, and we act on it. Email [email protected]. We respond within one month.
You may also complain to the Belgian supervisory authority:
Gegevensbeschermingsautoriteit / Autorité de protection des données (GBA/APD) Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels [email protected] · gegevensbeschermingsautoriteit.be
9. Security
The site is served over HTTPS with a strict Content Security Policy. Form submissions are checked by Cloudflare Turnstile. Access to our systems is least-privilege, and the calendar integration uses scoped, keyless credentials that cannot read the contents of meetings. We will notify you and the supervisory authority of qualifying breaches as Art. 33–34 requires.
10. Cookies
This website sets no cookies. Not for analytics, not for advertising, not for preferences. If you switch to dark mode, your browser stores that choice locally on your device; it is never sent to us.
The customer area at /accounts is a separate billing application and does set a session cookie when you log in. That cookie is strictly necessary to keep you logged in, and requires no consent.
11. Changes
We may update this policy. The version number and date above will change; material changes will be noted on this page.