Privacy policy

Oh Lord ("we", "us") is the controller of the personal data described here. Oh Lord is a registered Belgian business, entered in the Crossroads Bank for Enterprises under enterprise number 0840.434.328. Oh Lord is the trade name of Nico Laurez, who is the person answerable for your data.

Registered address: Morekstraat 280, 9032 Ghent, Belgium. Enterprise number: 0840.434.328. VAT number: BE0840434328. Contact: [email protected].

Questions about your data go to [email protected]. We have not appointed a data protection officer, because the scale of our processing does not require one.

Almost everything we collect comes from you, because you sent it to us. Concretely:

• Contact form. When you send us a brief at /contact we receive your name, your email address, your company name if you fill it in, the project type you pick, the message you write, and the language version of the site you used. We use it for one thing: to read your message and reply to it.
• Booking form. When you book a call at /book we receive your name, your email address, the time slot you pick, and any notes you add. We use it to create the calendar appointment and send you the invite.
• Spam protection. Both forms run a Cloudflare Turnstile check before they submit. To do that, your IP address and a Turnstile token are sent to Cloudflare. We do not store your IP address ourselves.
• Analytics, only with your consent. If you accept analytics in the cookie banner, we measure which pages get read, how people arrived, roughly where in the world they are, and which device and browser they use. It is aggregated reporting: we use it to decide what to write next and what to fix, never to identify you or to build a profile. Your IP address is truncated before it is stored, and we run no advertising or remarketing features on it. If you refuse, none of it runs.
• Email. Anything you send us by email lands in our mailbox and stays there as part of the conversation.
• Server logs. Our hosting and our CDN keep short-lived technical logs (IP address, requested URL, timestamp, user agent) for security and troubleshooting. That is standard infrastructure logging, not tracking.

For the contact form, the booking form and email: your request. Legally this is either the performance of a contract or the steps you asked for before entering into one (Article 6.1.b GDPR), or our legitimate interest in answering people who write to us (Article 6.1.f).

For spam protection and server logs: our legitimate interest in keeping the site up and keeping bots out (Article 6.1.f).

For analytics: your consent, and nothing else (Article 6.1.a GDPR, and Article 129 of the Belgian Electronic Communications Act for the cookie itself). Nothing is measured until you accept, refusing costs you nothing, and you can withdraw at any time through the cookie settings link in the footer. Withdrawing is as easy as consenting and takes effect immediately.

We do not use your data for marketing. We will not add you to a mailing list because you filled in a form.

We do not sell data and we do not share it with advertisers. A short list of service providers processes it on our behalf, each for one specific job:

• Brevo (Sendinblue SA, France). Sends the transactional emails: the notification to us and your confirmation. Sees your name, your email address and the content of your message.
• Google (Google Ireland Limited). Runs the calendar behind the booking form. Sees your name, your email address, your notes and the appointment itself, because you are added as a guest to the calendar event and the Google Meet link.
• Google Analytics (Google Ireland Limited). Only if you consented to analytics. Receives the page you are on, the page that sent you, a truncated IP address, and technical details about your device and browser, tied to a randomly generated identifier stored in your browser. Advertising features and data sharing with other Google products are switched off. If you did not consent, Google Analytics is never loaded and receives nothing.
• Cloudflare (Cloudflare, Inc.). Delivers the site and runs the Turnstile anti-bot check. Sees your IP address and technical request data.
• Our hosting and mail provider. Stores the site and the mailbox that receives your message.

Some of these providers are US companies or belong to a US group. Where data reaches the United States, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework and on standard contractual clauses.

Form submissions and email conversations stay in our mailbox for as long as the conversation is live, and up to two years after our last contact if no project follows. Once a project starts, the related correspondence follows our normal business records and is kept for as long as accounting and liability rules require.

Calendar appointments stay in the calendar as a record of the meeting. Server and CDN logs are kept for a short period only, typically days to a few weeks, and then rotate out.

Analytics data is kept for 14 months and then deleted automatically. The analytics cookies in your own browser expire on the schedule listed in the cookie policy, and your consent itself lapses after twelve months, at which point we ask you again.

Ask us to delete something earlier and we will, unless we are legally required to keep it.

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you (access)
• correct anything that is wrong (rectification)
• delete it (erasure)
• restrict what we do with it (restriction)
• hand it to you or another provider in a portable format (portability)
• stop processing it where we rely on legitimate interest (objection)

Where we rely on your consent, you can withdraw it at any time without giving a reason. That does not undo what was lawfully processed before you withdrew.

Email [email protected] and we will handle it within one month. There is no charge. We may ask you to confirm who you are before we send data out.

If you think we got it wrong, you can complain to the Belgian data protection authority: Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, +32 (0)2 274 48 00, [email protected], www.gegevensbeschermingsautoriteit.be. You can also complain to the authority in the EU country where you live.

The site runs over HTTPS. Access to the mailbox, the calendar and the site's hosting is limited to the people who need it and protected by strong authentication. No system is perfect, but we do not collect data we do not need, which is the best protection there is.

This is a business site. It is not aimed at children and we do not knowingly collect data from anyone under 13, the age Belgium sets for a child's own consent online.

If we change what we do with data, we change this page and update the date at the top. Material changes will be visible here before they take effect, and where they affect what you consented to, we ask for your consent again.