Your data

Privacy notice

What we process, why, and the choices you have.

Updated 15 October 2026. This notice covers our website, contact enquiries and Sustainability & Transparency Scan. It does not give permission for marketing.

1. Who is responsible?

Sustainability Partner BV, Anjerweg 17, 3191 Schiplaken, Belgium · BE 0777.602.478 · RPR Leuven. For privacy questions or requests, email info@sustainabilitypartner.be or write to this address.

2. Data and purposes

• Website visits: hosting and security providers process technical request information, such as IP address, time, requested page and browser information, to deliver and protect the website. Legal basis: our legitimate interest in a secure, working website (GDPR Article 6(1)(f)).
• Contact enquiries: name, email and message; company is optional. We handle and answer your enquiry. Necessary steps you request before a contract rely on Article 6(1)(b), where applicable to your situation. General business correspondence relies on our legitimate interest in answering enquiries (Article 6(1)(f)).
• Scan reports: name, company, email, answers and selected topics. Phone, role, employee category and explanation are optional. We calculate your results and email the requested report and PDF certificate. The basis is the necessary service you request (Article 6(1)(b), where applicable), or our legitimate interest in delivering a business report requested by you (Article 6(1)(f)). A request is not marketing consent.

Your name, company and email are required to personalise and deliver the scan report. You can still view the initial on-screen results without giving these details. Do not include sensitive personal data or confidential information about others in free-text fields.

3. Calculations and optional digital sealing

Answers produce scores, a sustainability stage and recommendations. Internal scores and labels may help us organise requested advice. This is an automated assessment of the supplied business information and may be profiling when linked to an individual. It does not make solely automated decisions with legal or similarly significant effects on you. You may request an explanation or human review and object where processing relies on legitimate interests.

Digital sealing with ProofStack is a separate, unticked option. You receive the report without it. If requested, we send a SHA-256 fingerprint of the PDF, a timestamp and a random certificate reference to ProofStack. We do not send the PDF or entered contact details to ProofStack. A fingerprint is not automatically anonymous: it can be linked using the PDF. A blockchain proof may be permanent and cannot be erased by us. Your rights over our own files remain. Do not request sealing if you do not want a lasting proof.

4. Recipients

Access is limited to staff handling your request and necessary providers: Vercel delivers the website and forwards form requests; Combell operates the scan and contact backend and related storage; our email service delivers messages; Sanity manages published blog content and editor accounts; Cloudflare runs the spam check you start. ProofStack receives the information above only when sealing is requested. Contact messages are not sent to Sanity. We do not sell your data.

Cloudflare Turnstile receives technical network and browser signals, including IP address and browser information. We do not send message content to its verification API. Cloudflare also acts as an independent controller for improving bot detection. Read the Turnstile privacy addendum. You can email or call directly without starting the web check.

Calendar, WhatsApp and LinkedIn links are not embedded services. Those services open when you follow a link and their privacy rules also apply. Competent authorities may receive data where a valid legal obligation requires this.

5. Transfers outside the EEA

Some providers operate internationally. A European hosting location does not mean all support, security signals or subprocessors remain within the European Economic Area. Transfers require an applicable adequacy decision or other valid safeguards, such as standard contractual clauses and supplementary measures where needed. Contact us for details and an available copy of safeguards relevant to your processing. See also the Vercel DPA and Sanity DPA.

6. Retention

• Ordinary contact enquiries: no more than six months after handling.
• Scan requests, results, answers, internal labels and any local recovery files: six months from the request if no client relationship starts.
• If a request becomes a client file, the necessary service-related period applies. Statutory records such as invoices follow their applicable legal retention requirements, not automatically the entire scan or contact file.
• A limited file may be needed longer for a specific legal dispute. Backups are replaced according to the relevant service’s cycle; erased data must not be brought back into use after restoration.

We do not retain data indefinitely because you once made an enquiry. Technical security data has a separate purpose and should be kept for the shortest necessary period. An external blockchain proof is outside deletion of our own files.

7. Your rights

You may request access, a copy, correction or erasure, and restriction or portability where applicable. You may object on grounds relating to your situation where processing relies on legitimate interests. You may object to any direct marketing free of charge, without giving a reason. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. This website has no newsletter signup.

Email info@sustainabilitypartner.be. We normally respond within one month. For complex or numerous requests, the lawful extension of up to two additional months may apply; we explain this within the first month. We only request proportionate identification where necessary; do not send an unsolicited identity document.

You may complain to the Belgian Data Protection Authority or the competent authority in the member state where you live, work, or where a possible infringement occurred. This notice does not limit your statutory remedies.

8. Cookies, security and changes

We use no Google Analytics, advertising pixels or optional visitor analytics. Necessary sessions for requested forms are explained in the cookie overview. Contact verification loads when you start it; scan verification when requesting the report. Answers are not saved in browser storage.

We limit staff access, use HTTPS and server-side form validation, and do not make scan PDFs publicly retrievable. No system can promise absolute security. We update this notice for relevant changes; a new notice does not itself provide consent for a new purpose.