Privacy statement.

Ginkgo Leaf VOF is responsible for processing your personal data. In the language of the GDPR, the European privacy law: we are the controller.

• Ginkgo Leaf VOF, Stokteloopstraat 58, 2400 Mol, Belgium
• Company number BE 1044.219.450
• info@ginkgo-leaf.eu · +32 468 01 20 30

Ginkgo Leaf is Gunther Van Landeghem and Liesbeth Kenens. Only the two of us have access to your data. We are not required to appoint a data protection officer (DPO): you can bring any privacy question straight to us.

You can visit our website without telling us anything about yourself.

• No cookies, no analytics or trackers, no ads and no social media buttons.
• Fonts and images are hosted on our own website. Your browser does not connect to Google or any other third party.
• There is no contact form. If you want to reach us, send an e-mail or give us a call.

Your browser does keep two small items in its local storage: your choice of light or dark mode, if you click the lantern, and the time of your last visit, so that the ginkgo leaf intro does not replay on every page. They stay on your device and are never sent to us or to anyone else. You can remove them by clearing the site data in your browser.

Our website is hosted by GitLab (GitLab Pages). Like every web server, GitLab keeps a log of visits that includes your IP address. According to GitLab, this log is used for the security and operation of the service and is deleted after seven days. We do not see these logs.

When we link to another website, that website’s privacy policy applies.

When you e-mail or call us, we use your name, your contact details and what you tell us to reply and, if you ask for one, to prepare a quote. We do this because you asked us to, or on the basis of our legitimate interest in answering questions.

If no assignment follows, we delete your e-mails and any quote at the latest two years after our last contact.

Our e-mail runs on Proton Mail (Proton AG, Switzerland), which stores messages encrypted.

For a workshop, training or advice, we process:

• for organisations: name, address and company number, and the name, job title, e-mail address and phone number of the contact person;
• for private individuals: name, address, e-mail address and phone number;
• the arrangements, quotes, invoices and payments.

We use this data to carry out the assignment, to invoice and to keep our accounts. The legal basis is our contract with you and our legal obligations. Belgian law requires us to keep invoices and accounting records for ten years.

We send invoices to businesses through the Peppol network (Let’s Peppol). Payments go through our bank.

For a workshop we usually only need the number of participants. We ask for names only when the organisation requires it.

We do ask you to tell us about injuries or physical limitations beforehand, so we can adapt the exercises. This is health data. We use it only with your explicit consent and only for that workshop. We share it with no one and delete it at the latest one month after the workshop. Rather not put anything in writing? Just tell us on the day.

Adult participants who are not insured through their employer sign a participation declaration (annex 2 to our terms and conditions). It contains their name, signature and choice about photos, but no health data. We keep this declaration for five years after the workshop as evidence in case of an accident, on the basis of our legitimate interest.

We take and use photos or videos in which you can be recognised only with your consent. For minors, we ask a parent’s consent. If you withdraw your consent, we take the images down.

If you report a vulnerability under our responsible disclosure policy, we keep your name or alias, your e-mail address, your PGP key and your report. We use them to handle your report, on the basis of our legitimate interest in securing our systems. With your consent, we mention your name or alias on our website.

We use your postal address and size only to send you your t-shirt, and delete them afterwards. We keep the rest for up to two years after your report has been handled.

We never sell or rent out your data. We do not use it for profiling or automated decisions.

We work with a few service providers, who process data only on our behalf:

• GitLab (GitLab B.V. and GitLab Inc.): website hosting;
• Proton AG: e-mail;
• Let’s Peppol: sending e-invoices;
• our bank: payments.

We also pass on data when the law requires it, for example to the Belgian Federal Public Service Finance.

Two service providers operate outside the EU:

• Proton AG is based in Switzerland. According to the European Commission, Switzerland protects personal data as well as the EU does (adequacy decision).
• GitLab hosts the website in the United States. GitLab Inc. participates in the EU-U.S. Data Privacy Framework.

We protect your data with appropriate technical and organisational measures. Only the two of us have access, our e-mail is encrypted and we keep no more than we need.

Found a weak spot anyway? Please report it through our responsible disclosure policy.

You have the right to access your data, to have it corrected or erased, to restrict its processing, to object and to take your data with you. Where you gave consent, you can withdraw it at any time.

To do so, e-mail info@ginkgo-leaf.eu. We reply within one month. If we are unsure whether a request really comes from you, we will ask you to confirm it.

Not happy with how we handle your data? Please tell us first. You can always lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.

If anything changes in how we handle personal data, we update this statement. The date at the top shows when that last happened.