Privacy Policy

1. Controller

Philipp Hackländer
Rückerstraße 7
10119 Berlin, Germany
E-mail: mail@evalua.be

2. Data we collect

When you use this website, the following data may be processed:

• Company Value Check inputs: The indicative value tool runs in your browser. Inputs (revenue, profitability, sector, etc.) are not sent to our servers unless you submit a follow-up form (e.g. request a consultation or snapshot).
• Lead and form data: If you submit a form (e.g. contact, KBO teaser, or request), your name, e-mail, and other fields are collected and processed via Netlify (forms or serverless functions) and stored on Netlify's infrastructure.
• Server access logs: This site is hosted on Netlify (Netlify, Inc., San Francisco, USA). Netlify automatically collects access logs including IP address, browser type, referring URL, and timestamp. See Netlify's Privacy Policy.
• Local storage: A cookie-consent preference is stored in your browser's localStorage. No other cookies are set by this site except as described under analytics below.
• Analytics (PostHog): We use PostHog product analytics (EU cloud, eu.posthog.com). PostHog receives usage events (e.g. pages viewed). Until you accept analytics in the cookie banner, we configure PostHog without persistent first-party cookies (reduced persistence). If you accept, PostHog may use cookies and localStorage for session continuity. See PostHog's Privacy Policy. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring site usage in the limited configuration) and, where applicable, Art. 6(1)(a) GDPR (consent) for the extended configuration after you accept.
• Analytics (Google Analytics 4): We use Google Analytics 4 via Google Tag Manager (Container ID: GTM-NCPZ2QH7) to understand how visitors interact with the site. GA4 collects anonymised usage data (e.g. pages visited, session duration, events). GA4 cookies are only set after you accept cookies in the banner. You can opt out via the Google Analytics Opt-Out Browser Add-On. See Google's Privacy Policy. Legal basis: Art. 6(1)(a) GDPR (consent).
• Tag management (Google Tag Manager): GTM is used to manage analytics tags. GTM itself does not collect personal data but loads other services (e.g. GA4). See GTM Use Policy.
• Microsoft Clarity (optional): If enabled, we use Microsoft Clarity for heatmaps and session replay. Clarity may collect usage data. It is only loaded when configured (e.g. via environment variable). See Microsoft Privacy Statement.
• Booking links: "Book a consultation" links go to Cal.com (Cal.com, Inc.). Data you provide on Cal.com is subject to Cal.com's Privacy Policy.

3. Purpose and legal basis

• Form submissions and enquiries: Art. 6(1)(b) GDPR (performance of a service you requested).
• Server logs and security: Art. 6(1)(f) GDPR (legitimate interest in site security and availability).
• PostHog product analytics: Art. 6(1)(f) GDPR (legitimate interest in the limited configuration before consent) and Art. 6(1)(a) GDPR (consent) where you accept extended analytics storage.
• Google Analytics 4: Art. 6(1)(a) GDPR (consent). Consent is obtained via the cookie banner before GA4 runs.

4. Data recipients

• Netlify, Inc. (hosting, form data) — USA. Transfers governed by Netlify's Data Processing Agreement and standard contractual clauses.
• PostHog, Inc. (PostHog Cloud EU) — product analytics; data processed in the EU region you select for the project. See PostHog's privacy policy for subprocessors and transfers.
• Google LLC / Google Ireland Ltd. (GA4, GTM) — Ireland / USA. Under Google's Data Processing Terms and standard contractual clauses.
• Cal.com, Inc. (booking) — USA, if you use a booking link.
• Microsoft (Clarity, if enabled) — see Microsoft's privacy statement.

Form submissions are used only to respond to your enquiry.

5. Data retention

Form and lead data are retained for up to 12 months or until the enquiry is resolved. Server logs are retained by Netlify according to their standard retention (typically around 30 days). Consent preference in localStorage persists until you clear it.

6. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15 GDPR)
• Rectify inaccurate data (Art. 16 GDPR)
• Request erasure (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing based on legitimate interest (Art. 21 GDPR)

To exercise these rights, contact: mail@evalua.be

7. Supervisory authority

If you believe your data protection rights have been violated, you may lodge a complaint with a supervisory authority. For Belgium: Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD) — www.gegevensbeschermingsautoriteit.be. For Germany (where the controller is based): Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) — www.bfdi.bund.de.

8. Cookies and consent

PostHog is loaded on every page; until you accept analytics in the banner it runs without persistent PostHog cookies (reduced persistence). If you accept, PostHog may use cookies and localStorage for session analytics. Google Analytics 4 uses cookies (e.g. _ga, _ga_*) and is only activated after you accept cookies in the banner. You can withdraw consent by clearing cookies or using the Google Analytics Opt-Out Add-On. Google Tag Manager does not set cookies itself but manages the loading of GA4 and other services. When you first visit, a consent banner asks whether you accept analytics cookies. We do not use advertising cookies or tracking pixels.