In short
- We collect the minimum, only to answer you, serve you and comply with the law.
- No advertising, no trackers, no sale of data, ever.
- Servers managed by us, encryption, daily backups, strictly limited access.
- Exercise your rights by e-mail to info@ouibel.com, answered within one month.
- For data in your websites and software, we act as processor, with an Art. 28 agreement on request.
What is the GDPR?
The General Data Protection Regulation (EU 2016/679), supplemented in Belgium by the Act of 30 July 2018, governs any use of data identifying a person. We apply its seven principles to every processing: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. The Belgian Data Protection Authority supervises compliance.
Our two roles
Controller for data of our visitors, prospects, customers and partners: Jordan Lallemand, operator of Ouibel (see our privacy policy). Processor for data you entrust to us within our services (website files and databases, apps, POS, mailboxes, your customers' data): we act only on your instructions, under Art. 28 GDPR and section 14 of our terms.
Record of processing
We keep a written record of processing activities (Art. 30 GDPR): contact requests (pre-contractual, 3 years), client area (contract, account lifetime), quotes and contracts (contract, 10 years), invoicing (legal obligation, 7 years), service e-mail delivery tracking (legitimate interest with right to object), partner programme (7 years), security logs (12 months), hosted services for customers (processing on instructions, 30 days after end of service).
Data minimisation and privacy by design
Every tool we build collects as little as possible: clearly marked optional fields, no audience measurement, fonts and resources hosted on our servers, no tracking social plug-ins, automatic deletion at expiry. Defaults are always the most protective (Art. 25 GDPR).
Technical and organisational security
- Encrypted connections (HTTPS, automatically renewed certificates).
- Hashed passwords, one-time login links, protected sessions.
- Strict content security policy, protection against injection and automated submissions.
- Isolation of each customer's websites and data.
- Firewall, regular security updates, constant monitoring (public status at statut.ouibel.com).
- Daily backups stored separately, tested restoration.
- Need-to-know access only, under written confidentiality undertakings, with logging of sensitive actions.
Where are your data?
On servers we administer ourselves, rented from OVHcloud (France) in a data centre in Canada, covered by a European Commission adequacy decision. Accounting is kept with Odoo SA (Belgium, EU hosting). Online payments go through Stripe (Ireland).
Our processors
OVHcloud, Stripe, Odoo, Let's Encrypt, OpenRouter and Anthropic, and independent collaborators bound by confidentiality and processing agreements. The up-to-date list is in our privacy policy. Customers are informed of any new processor with access to their data and may object.
Artificial intelligence
We use AI tools to save time (writing, translation, development). We share only strictly necessary information, never passwords, payment data or special categories of data. No decision about you is made solely by automated means.
Your rights
Access, rectification, erasure, restriction, portability, objection (and at any time to marketing), withdrawal of consent. Write to info@ouibel.com or use « My data » in your client area. Free of charge; we reply within one month (extendable by two months for complex requests) and may ask for proof of identity. You may complain to the Belgian Data Protection Authority (dataprotectionauthority.be).
Data breaches
Every incident is logged. A breach posing a risk is notified to the Data Protection Authority within 72 hours (Art. 33); if the risk is high, affected persons are informed directly (Art. 34). Customers are notified without delay for data we process on their behalf.
For our customers
The websites and software we build are delivered GDPR-ready. On request we provide a signed Art. 28 processing agreement, a description of our security measures and assistance with data subject requests or audits. The content of your legal pages, the data you choose to collect and your visitors' consent remain your responsibility.
Data protection officer
Ouibel is not required to appoint a DPO (Art. 37). All questions are handled directly by Jordan Lallemand at info@ouibel.com or +32 471 87 28 60.