Privacy policy & cookies

1. Who is responsible for your data?

Atitex is responsible for the processing of personal data as described in this privacy policy, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

2. What data do we collect?

Contact form (website)

When you fill in our contact form, we process your name, email address and the message you send. This data is processed by Formcarry and forwarded directly to our email address. Formcarry stores the submission on servers within the European Union; we do not keep it in a database of our own.

Booking calendar (Cal.com)

When you schedule a call through our contact page, Cal.com (cal.eu) processes the data you enter, typically your name, email address and the chosen time, in order to confirm the appointment and send a reminder. See the Cal.com privacy policy.

Client portal

As a client of Atitex, you get access to our secure client portal. In doing so, we process:

• Company details (name, company number)
• Access codes and passwords (stored unreadably)
• Files you upload or that we share with you
• Answers to questionnaires
• Session data (IP address, browser fingerprint) for security purposes

AI assistant on the website

Our website has an assistant (“Ask us”) and, on the Atitex Flow page, a field where you can describe your process. What you type there is sent to Anthropic, the provider of the language model, in order to generate an answer. Anthropic processes that data in the United States.

We do not keep those conversations: no database is involved and we cannot read them back afterwards. Under its own terms, Anthropic does not use this content to train its models. Even so, please avoid entering personal data there; for anything confidential, use the contact form or email us directly.

Log files & security

For the security of the portal, we log login attempts (including IP address and time). These logs are automatically purged after 90 days and are used solely to detect and prevent unauthorised access.

3. On what basis do we process your data?

We process your personal data on the basis of:

• Performance of a contract (Art. 6.1.b GDPR): where the processing is necessary for providing our services to you as a client
• Legitimate interest (Art. 6.1.f GDPR): for the security of our systems, fraud prevention and login monitoring
• Consent (Art. 6.1.a GDPR): when you voluntarily fill in our contact form or schedule a call

4. Do we share your data with third parties?

We only share your data where necessary for our services:

• Hostinger (hosting): our website and the client portal are hosted with Hostinger International Ltd. Your data is processed within the EU.
• Umami Cloud (Umami Software, United States, servers in the EU and the US): counts page views without cookies and without storing your IP address, so we know which pages are read.
• Formcarry: processes contact form submissions and stores them in data centres within the EU. See their privacy policy.
• Cal.com: processes bookings made through our calendar. We use their EU instance (cal.eu). See their privacy policy.
• Anthropic (United States): processes what you type into the assistant or the estimate field, solely in order to answer it. Transfer outside the EEA is covered by Standard Contractual Clauses. See their privacy policy.

We never sell your data to third parties. The contact form, the booking calendar and the client portal are all processed within the European Union. Only the AI assistant involves processing outside the European Economic Area; that transfer relies on the European Commission's Standard Contractual Clauses.

5. Cookies

Our main website (atitex.be) uses no tracking cookies. Visiting the website places one strictly necessary cookie as soon as you click the language switch (atitex_taal). It only remembers your language choice, contains no personal data and expires after one year. No consent is required for this cookie under the ePrivacy Directive (art. 5.3). The embedded booking calendar (Cal.com) may place technical cookies once you use that widget: see their privacy policy above.

To see which pages are read, we count visits with Umami Cloud, a service that places no cookies and stores nothing on your device. No profile is built and you cannot be identified in it: Umami keeps figures such as pages visited, referring site, country, device type and browser, and does not store your IP address. If Do Not Track is switched on in your browser, your visit is not counted. Because nothing is placed on or read from your device, no consent is required; the legal basis is our legitimate interest in knowing which information on our site is useful.

6. How do we secure your data?

We take the security of your data seriously and apply appropriate technical and organisational measures. Without going into the details of our setup:

• All traffic between your browser and our portal is encrypted
• Passwords are stored unreadably; we cannot read them either
• Administrators sign in with a second step alongside their password
• Each client sees only their own file and their own documents
• Forms and sessions are shielded from outside misuse, with automatic sign-out after inactivity
• Repeated failed sign-in attempts are blocked
• Sign-in attempts are recorded to spot unauthorised access, and erased after 90 days

Which measures suit a given project depends on what it processes. We set those out per assignment and discuss them with you, not on this page.

7. How long do we keep your data?

We do not keep personal data for longer than necessary:

• Contact form: messages go straight to our mailbox and are deleted once the conversation is closed. We erase the submission at Formcarry as soon as we no longer need it
• AI assistant: we do not keep conversations
• Client portal: data is kept for the duration of the collaboration and up to 12 months after it ends, unless statutory retention duties require otherwise
• Security logs: 90 days maximum

8. Your rights

Under the GDPR, you have the following rights:

• Access: you can request which data we process about you
• Rectification: you can have inaccurate data corrected
• Erasure: you can request that your data be deleted (the "right to be forgotten")
• Restriction: you can have the processing restricted
• Portability: you can request your data in a common format
• Objection: you can object to processing based on legitimate interest
• Withdrawing consent: if you have given consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out beforehand

To exercise your rights, send an email to alessio@atitex.be. We respond within 30 days.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Data Protection Authority (DPA), Drukpersstraat 35, 1000 Brussels.

9. Changes to this policy

We may update this privacy policy from time to time. The most recent version is always available on this page. We will announce any significant changes on our website.