Privacy policy

Etienne van Bogaert (vbnetwork), based in Vilvoorde, Belgium, is the data controller for this site. For any question about your data, contact [email protected].

No tracking cookies. No localStorage used for identification. No Google Analytics tag, Meta Pixel, Hotjar or equivalent. No third-party tracking script runs in your browser.

The contact form uses Cloudflare Turnstile to block automated submissions — it is the only third-party script loaded, and only when you open the contact drawer.

On each request, we increment a counter keyed by (source, day, page) on the server. This counter contains no IP, no user-agent, no derived identifier. A stored row is a sum like "the landing page was read 47 times on 2026-03-15", never who read it.

These counters are not personal data. Legal basis: legitimate interest (art. 6.1.f GDPR) — approximate measurement of traffic to a public page.

For each request, an entry is written with: timestamp, IP, HTTP method, exact path, query string, user-agent, referer, country (via the edge). This entry is personal data.

It exists to answer the questions a counter cannot: "what is this unusual activity", "did a scanner probe /wp-admin", "did something just fail". Without it, an access log is not a log.

Legal basis: legitimate interest (art. 6.1.f) — service security and availability. Retention: 30 days from write, automatic purge on the CRM side.

This log deliberately ignores the x-no-analytics header (§ 7). A security log an attacker can switch off is not one.

To reconstruct in what order one visit read several pages, a session key is computed on the server: HMAC-SHA256(salt_of_today, IP || user-agent), truncated to 128 bits. Neither the IP nor the user-agent is stored — only the derived key.

The salt is regenerated at each UTC midnight and the outgoing salt is destroyed. Once rotation happens, yesterday's key cannot be recomputed even by us. A visitor who returns on another day is a new visitor to this system.

Legal basis: legitimate interest (art. 6.1.f) — understanding the shape of a visit. Retention: 90 days on the CRM. You may object with the x-no-analytics header (§ 7).

A URL fragment like #services is never sent to the server. To know which sections of a page a visitor reached, a small client-side script sends a beacon to /api/section-view when you click an in-page link, open the page on an anchor, or scroll a section into view for ~1 second.

What the beacon sends: the page path, and one or more section names from a closed set (see src/lib/tracking/sectionAnchors.ts). Nothing else. No cookie, no client id, no browser fingerprint. The visit key is derived server-side exactly as in § 5.

A visitor who blocks this script (JavaScript disabled, tracking-blocker extension) is still counted as a page view; they simply contribute no section data. These numbers are a floor, not a census.

Legal basis and retention identical to § 5.

Send x-no-analytics: 1 with any HTTP request and that request is excluded from: page-view counter (§ 3), session events (§ 5), section views (§ 6). This covers monitors, verification scripts, visitors who prefer not to be measured at all.

The header is not honoured by the security log (§ 4) — deliberately. A log an attacker can switch off with a header is not a log.

The fields you fill in (name, company, email/phone, message) are sent by email only, to this site's contact address. No database storage, no forwarding to a CRM or to Cloudflare other than the Turnstile anti-spam check described in § 2.

Legal basis: consent / your own outreach (art. 6.1.a and 6.1.b). You can request deletion of the thread at any time.

You have the right to access your data, rectify it, have it erased, object to processing, and lodge a complaint with the Belgian data-protection authority (APD/GBA) if you believe your rights have not been respected.

Contact: [email protected].