Privacy notice

Controller and scope

CODE WAVE is the controller for this website and enquiries. Use the contact details above to exercise your rights or obtain information about processing and transfer safeguards. This notice covers the portfolio, contact form and optional visit measurement, not the separate contractual processing for client projects.

Data, purposes and legal bases

Enquiries: we receive your name, email address, message and submission timestamp. We use them to reply and take requested steps before a contract (GDPR Article 6(1)(b)); for other correspondence, our legitimate interest is answering business enquiries (Article 6(1)(f)). All three form fields are necessary to use the form. Providing them is not a statutory obligation; without them the form cannot send. You may use email instead. Do not submit health data, passwords or other sensitive information.

Hosting and abuse prevention: requests expose technical data such as IP address, browser information and access times to hosting providers. Submitting the form activates Firebase App Check with Google reCAPTCHA Enterprise, which evaluates browser/device and interaction signals to reduce automated abuse. Our legitimate interest is protecting the website, enquiries and infrastructure (Article 6(1)(f)). Necessary security storage is described in the cookie notice.

Optional analytics: only after consent (Article 6(1)(a)), Google Analytics processes online identifiers, page visits, referring pages, browser/device information and approximate location to understand site usage. We do not send your form fields to Analytics. Advertising personalization and Google Signals are disabled in the site configuration. Withdraw consent in the footer without affecting earlier lawful processing.

Recipients and international processing

Enquiries are accessible to authorized CODE WAVE personnel. Google provides Firebase Hosting, Realtime Database and App Check / reCAPTCHA Enterprise, and Google Analytics when enabled. Email correspondence also passes through the email providers used by the sender and CODE WAVE. We do not sell enquiry data. Providers or public authorities may receive data where necessary to provide the service or comply with the law.

Google services may process data outside Belgium and the EEA, including in the United States. Google’s published processing terms describe applicable EU adequacy arrangements for eligible certified recipients and standard contractual clauses where required. The safeguards applicable to a particular service depend on its contract and destination; contact us for information or a copy of the relevant safeguards. See the linked Google processing information below.

Retention

Enquiries that do not become client engagements are retained for 12 months after the last exchange. CODE WAVE carries out a documented monthly deletion review; deletion is not automated by this website. Correspondence that becomes part of an engagement, accounting records and evidence needed for legal claims follow separate applicable contractual or statutory retention requirements.

The local analytics choice and Analytics cookies expire after six months, as detailed in the cookie notice. Google Analytics event/user-level retention is configured to two months, without extending it on new user activity. Google may take up to 24 hours to apply a retention-setting change. Aggregate reports may have different retention under Google’s terms. Security/hosting-log retention is separate from cookie expiry and governed by the applicable service terms and security needs. Contact CODE WAVE for information about the applicable provider periods.

Your rights and complaints

Subject to the GDPR conditions, you may request access, correction, erasure, restriction and portability of your data, object to legitimate-interest processing, and withdraw consent at any time. Email CODE WAVE using the address above. We may ask for proportionate identity verification and normally respond within one month; legally permitted extensions will be explained. No fee is normally charged.

You may complain to the Belgian Data Protection Authority (APD / GBA), Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, or your competent supervisory authority. The official complaint link is provided below. We do not make decisions with legal or similarly significant effects about you solely through automated processing. Security checks can block form submission; email remains an alternative.