Legal

Privacy statement

Last updated: 13 May 2026

This statement explains how Adefin processes personal data through the website adefin.be (the "Site"), in accordance with Regulation (EU) 2016/679 ("GDPR") and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1. Who is the data controller?

The controller of your personal data is:

  • Adefin bv
  • Registered office: Hundelgemsesteenweg 575 bus 002, 9820 Merelbeke-Melle
  • Contact for privacy queries: [email protected]

2. What personal data do we collect?

When you submit the mailing-list form on the Site, we collect:

  • Your email address, which you provide voluntarily;
  • Your preferred language (EN, NL or FR), to send communications in a language you can read.

For security, integrity and abuse-prevention purposes, when you submit the form we also log:

  • Your IP address;
  • Your browser's user-agent string;
  • The timestamp of submission.

If you accept analytics in the cookie banner, and only then, we also collect anonymous product-analytics events through PostHog (see section 5). We do not use advertising trackers, social-media pixels, or any profiling tools on the Site.

3. Why do we process this data, and on what legal basis?

  • To add you to our mailing list and send you emails about Adefin. Legal basis: your consent (Art. 6(1)(a) GDPR), given by submitting the form. You can withdraw your consent at any time (see section 7).
  • To understand how the Site is used (analytics). Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 129 of the Belgian Electronic Communications Act), given by clicking "Accept" in the cookie banner. We use PostHog for this; you can withdraw your consent at any time via the "Manage cookies" link in the footer.
  • To prevent abuse and protect the Site (e.g. blocking automated signups through Cloudflare Turnstile, limiting the number of attempts per IP address, debugging). Legal basis: our legitimate interest in operating the Site securely (Art. 6(1)(f) GDPR).
  • To comply with legal obligations, where applicable. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not sell your data, and we do not engage in profiling or automated decision-making within the meaning of Art. 22 GDPR.

4. How long do we keep your data?

  • Your email address and language preference are kept until you ask us to delete them, or for up to 24 months after your last contact with us, whichever comes first.
  • Technical logs (IP, user-agent, timestamp) are kept for up to 12 months, after which they are deleted or anonymised.

5. Who do we share your data with?

We share your personal data only with carefully selected service providers acting as our processors:

  • Resend (Resend, Inc., USA): used to deliver our transactional emails. Resend processes your email address and the content of messages we send you.
  • PostHog (PostHog, Inc.), via its EU instance hosted in Frankfurt, Germany: used, only with your consent, to collect anonymous product-analytics events (pageviews, clicks, basic device information) so we can understand how the Site is used. PostHog data is stored in the EU. We have disabled session recordings and have not enabled advertising features.
  • Cloudflare (Cloudflare, Inc.), whose Turnstile service we use to keep automated signups off the form. Turnstile receives your IP address and technical characteristics of your browser in order to judge whether the signup comes from a human. It sets no advertising or tracking cookies and builds no profile of you. This check is necessary to secure the form and therefore runs without cookie consent.
  • Our hosting provider Hetzner, which stores the Site's database on servers at Sigmundstraße 135, 90431 Nürnberg, Germany.

We do not otherwise disclose your data to third parties, except where we are legally required to do so (e.g. court order, lawful request from a competent authority).

6. International transfers

Some of our processors (notably Resend) are based outside the European Economic Area, in the United States. Where this is the case, transfers are governed by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) and, where applicable, by supplementary measures, in accordance with Chapter V GDPR. A copy of the relevant safeguards can be obtained by writing to [email protected].

7. Your rights

Under GDPR, you have the following rights regarding your personal data:

  • Right of access: request a copy of the data we hold about you;
  • Right to rectification: correct inaccurate or incomplete data;
  • Right to erasure ("right to be forgotten");
  • Right to restriction of processing;
  • Right to data portability;
  • Right to object to processing based on legitimate interest;
  • Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, write to [email protected]. We will respond within one month (extendable by two further months for complex requests, as permitted under Art. 12(3) GDPR). We may ask for reasonable proof of identity before acting on a request.

8. Cookies and local storage

We use two categories of browser storage:

  • Strictly necessary: one entry in your browser's localStorage (adefin.consent) to remember your cookie choice. These are required to operate the Site and do not need prior consent under Article 129 of the Belgian Electronic Communications Act.
  • Analytics (PostHog), only with your consent. If you click "Accept" in the cookie banner, PostHog sets a small number of cookies and localStorage entries (typically prefixed ph_) to attribute events to an anonymous visitor identifier across pageviews. No PostHog data is collected if you click "Reject" or do not choose. You can change your mind at any time via the "Manage cookies" link in the footer.

The Site does not use advertising or social-media cookies.

9. Right to lodge a complaint

If you believe we have processed your data unlawfully, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données):

You also have the right to seek a judicial remedy before the competent Belgian court.

10. Security

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include transport encryption (HTTPS), access controls, and segregation of credentials. No system, however, is perfectly secure; if we ever become aware of a personal data breach affecting your rights, we will notify the Data Protection Authority within 72 hours where required, and, where applicable, inform you directly.

11. Changes to this statement

We may update this statement from time to time to reflect changes to our processing activities or applicable law. Material changes will be indicated by an updated "Last updated" date at the top of this page and, where appropriate, communicated by email.

12. Contact

For any question about this statement or your personal data: [email protected].