Privacy policy

Last updated: 24 April 2026

This policy describes how Mohamed Reda Hantout (hereinafter "we") processes personal data collected through the website hantout.be, in accordance with the General Data Protection Regulation (GDPR, Regulation EU 2016/679) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1. Data controller

In the absence of a mandatory Data Protection Officer (DPO), Mohamed Reda Hantout himself acts as the contact point for any question relating to the processing of personal data.

2. Data collected

2.1 Contact form

When you fill in the contact form, we collect:

• your name;
• your email address;
• your phone number (optional);
• the content of your message;
• the timestamp of the submission and the associated IP address (processed by our processor Web3Forms for security purposes).

2.2 Client and invoicing data

When you become a client, we process the data required for the performance of the contract and for legal obligations (invoicing, accounting): company name, enterprise number, VAT number, invoicing address, bank details if you pay by transfer, and the content of commercial exchanges.

2.3 Technical data (logs)

Our host (Hostinger) automatically records technical data in its access logs (IP address, browser type, timestamp, URL visited) for security, diagnostic and anti-fraud purposes. We do not use these logs for marketing.

2.4 Cookies and trackers

This website uses no advertising or analytics tracking cookies. Only technical local storage strictly necessary for the website to function is used (remembering that the cookie information banner has been dismissed). In accordance with Article 129 of the Belgian Act of 13 June 2005 transposing the ePrivacy Directive, consent is not required for strictly necessary trackers; for any other tracker added in the future, a consent banner will be displayed beforehand.

3. Purposes of processing

Your data is used solely to:

• answer your quote request or your question;
• communicate with you about a potential project;
• perform a contract concluded with you (delivery, invoicing, support);
• comply with our legal obligations (accounting, invoicing, VAT, archiving);
• secure the website and prevent abuse (technical logs).

Your data is never sold or rented, and is not used for third-party commercial prospecting.

4. Legal bases

Each processing operation rests on an identified legal basis:

• Consent (Art. 6.1.a GDPR): voluntary submission of the contact form;
• Pre-contractual measures or performance of a contract (Art. 6.1.b GDPR): preparation of quotes, conclusion and performance of a service contract;
• Legal obligation (Art. 6.1.c GDPR): retention of accounting records (7 years), VAT declarations;
• Legitimate interest (Art. 6.1.f GDPR): website security, abuse prevention, technical logs.

5. Recipients and processors

To provide our services, we use the following processors:

• Hostinger International Ltd (Cyprus, EU): website hosting and technical emails. Website: hostinger.com
• Web3Forms (operated from the United States): technical processing of the contact form. Policy: web3forms.com/privacy. Transfers outside the EU are governed by the EU-US Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCC) approved by the European Commission.
• Google LLC · Google Fonts (United States): loading of typographic fonts. When fonts load, your IP address may be communicated to Google. Policy: policies.google.com/privacy. Transfers outside the EU are governed by the DPF.
• Accounting firm (Belgium): processing of accounting records required for legal tax and social obligations.

Each processor is contractually bound to confidentiality and GDPR-compliance guarantees within the meaning of Article 28.

6. Transfers outside the European Union

Where data is transferred to countries outside the European Economic Area (notably the United States), such transfers are governed by:

• an adequacy decision of the European Commission (notably the EU-US Data Privacy Framework adopted in 2023);
• failing that, Standard Contractual Clauses (SCC) approved by the European Commission;
• accompanied, where appropriate, by additional technical and organisational measures.

7. Retention periods

• Contact request without commercial follow-up: 12 months from the last exchange;
• Data related to an unsigned quote: 3 years from the issue of the quote;
• Contractual data and invoices: 7 years (Belgian accounting obligation, Art. III.86 CEL);
• Host technical logs: 12 months maximum, according to Hostinger's policy;
• Prospecting data: 3 years from the last contact (CNIL / EDPB guidance).

At the end of these periods, data is either erased or anonymised for statistical purposes.

8. Your rights

In accordance with Articles 12 to 22 of the GDPR, you have the following rights:

• Right of access: obtain confirmation that data concerning you is processed and receive a copy;
• Right to rectification: correct inaccurate or incomplete data;
• Right to erasure ("right to be forgotten"): request deletion of your data where the legal conditions are met;
• Right to restriction: temporarily suspend processing;
• Right to object: object to processing based on legitimate interest or prospecting;
• Right to portability: receive your data in a structured, commonly used, machine-readable format;
• Right to withdraw your consent at any time, without affecting the lawfulness of prior processing;
• Right to define post-mortem directives on the fate of your data after your death, in accordance with the Act of 30 July 2018.

To exercise these rights, send your request by email to reda@hantout.be or by post to the registered office indicated above. A copy of an identity document may be requested in case of reasonable doubt about your identity, in accordance with Article 12.6 GDPR. Superfluous elements (photo, national number) may be masked.

You will receive a response within one month (extendable by two months for complex requests, with prior notice). This service is free of charge, except for manifestly unfounded or excessive requests.

9. Right to lodge a complaint

If you consider that the processing of your personal data does not comply with the regulations, you have the right to lodge a complaint with the Belgian supervisory authority:
Data Protection Authority (APD / GBA)
Rue de la Presse 35, 1000 Brussels
Phone: +32 (0)2 274 48 00 · Email: contact@apd-gba.be
Website: dataprotectionauthority.be

10. Automated decision-making and profiling

No processing based solely on automated decision-making producing legal effects or significantly affecting you is carried out on this website. No profiling is performed.

11. Cookies (summary)

Only technical local storage (localStorage) is used. See details in point 2.4. No third-party analytics or advertising cookies are set.

12. Security

We implement reasonable technical and organisational measures to protect your data: HTTPS/TLS connection, security headers (HSTS, CSP, X-Content-Type-Options), secure hosting, regular backups, restricted access to data. In the event of a data breach likely to result in a risk to your rights, we will notify the Belgian DPA within 72 hours in accordance with Article 33 GDPR, and inform you without delay if the risk is high (Article 34).

As no transmission over the Internet is absolutely secure, we cannot however guarantee absolute security.

13. Amendments

This policy may be amended at any time to reflect legal, regulatory or technical developments. Any substantial change will be flagged on this page. The version in force is the one accessible at this URL, on the date indicated at the top of the document.

Related documents: Legal notice · Terms and conditions.