Privacy Policy

01 Who we are

The website xlnty.com is operated by:

Entity: XLNTY BV (besloten vennootschap)
BCE / KBO: BE0685991720
Address: Rue Paul Wemaere 29, 1150 Woluwe-Saint-Pierre, Belgium
Email: contact@xlnty.com

XLNTY BV is the data controller for any personal data processed through this website, within the meaning of the EU General Data Protection Regulation (Regulation 2016/679, "GDPR").

02 What we collect on this website

xlnty.com is a static marketing site. It has no forms, no user accounts, no shopping cart, no analytics scripts, and sets no cookies of any kind. The only personal data involved in a visit is your IP address, which is processed as follows:

Edge and origin logs. Our hosting provider (Amazon Web Services, EMEA S.à r.l., Luxembourg) logs standard HTTP request metadata — IP address, timestamp, user-agent, path requested, response status — at the CloudFront edge and S3 origin. We do not enable custom CloudFront access logs, so these logs are retained only by AWS on our behalf under AWS's own operational and security defaults.
Font delivery. The page loads three typefaces (Archivo, Space Grotesk, JetBrains Mono) from Google Fonts. This means Google (Google Ireland Limited, and its infrastructure operated by Google LLC in the United States) receives your IP address, user-agent, and the URL of the page requesting the font. Google states it does not use this data for advertising and does not set cookies on font requests. See §04 for how this is handled under GDPR.

If you send us an email using the contact link, we will of course have your email address and whatever you wrote. That is a direct communication rather than website tracking, but we treat it under the same standards described below.

Not on this website: no advertising cookies, no analytics (Google Analytics, Plausible, Fathom, etc.), no A/B testing, no fingerprinting, no chatbots, no session recording, no social-network embeds.

03 Why we process this data — legal basis

We rely on legitimate interest (GDPR art. 6(1)(f)) for the minimal request-metadata processing described in §02: it is strictly necessary to serve you the page you asked for, to keep the site secure and available, and to detect abuse.

Where you email us directly, we rely on your request to communicate (art. 6(1)(b)/(f)) to reply and to keep a reasonable record of that exchange.

04 Third parties and international transfers

Two third parties process personal data in connection with this website:

Amazon Web Services — as our hosting processor. Serving the site is delivered from AWS regions inside the EU (Ireland-based edge locations and eu-west-1 for the origin). AWS may transfer certain operational data to the United States under its own data-transfer framework (Standard Contractual Clauses, plus the EU-US Data Privacy Framework where applicable).
Google Fonts (Google Ireland Limited / Google LLC) — as an independent controller of the font-request metadata. Because Google's font delivery is served from a global CDN, your request may reach servers in the United States. Google relies on Standard Contractual Clauses and its EU-US Data Privacy Framework certification for this transfer.

If you would rather not have your IP visible to Google when browsing xlnty.com, you can block third-party requests to fonts.googleapis.com and fonts.gstatic.com in your browser or via a content blocker. The page will render with system fallback fonts.

05 How long we keep data

Server / edge logs: retained by AWS under its default operational retention (a small number of days), then discarded. XLNTY does not export or archive them.
Emails you send us: retained in our mailbox for as long as the professional exchange is active, plus a limited period for administrative and legal recordkeeping (typically no more than 3 years after the last contact, unless a longer period is required by law or an ongoing engagement).

06 Your rights under the GDPR

You have the following rights over your personal data, exercisable free of charge by writing to contact@xlnty.com:

Access — a copy of the personal data we hold about you.
Rectification — correction of inaccurate data.
Erasure — deletion, where the legal basis no longer applies.
Restriction — pause processing while a dispute is resolved.
Portability — a structured, machine-readable copy of data you provided to us.
Objection — to any processing based on legitimate interest, on grounds relating to your particular situation.
Withdrawal of consent — where processing is based on consent, at any time and without prejudice to processing already carried out.

If you consider that our processing infringes the GDPR, you have the right to lodge a complaint with the Belgian data-protection authority:

Autorité de protection des données · Gegevensbeschermingsautoriteit
Rue de la Presse 35 · 1000 Bruxelles
autoriteprotectiondonnees.be · gegevensbeschermingsautoriteit.be

07 Security

The site is served exclusively over HTTPS with a modern TLS configuration (TLS 1.2+, HTTP/2 and HTTP/3). It is a static site with no server-side code path exposed to visitors, and the underlying storage is not publicly reachable — only our CDN can read it, over a signed connection.

08 Children

This site is intended for a professional audience and is not directed at children under 16. We do not knowingly collect personal data from children.

09 Business communications and client engagements

Sections 02 to 07 describe what happens when you visit xlnty.com as an anonymous reader. The paragraphs below cover the personal data we process outside the website — when you reach out to us, engage us for work, or become a client.

What we process

Prospect and enquiry data — your name, email address, company or organisation, job title (if you share it), and the substance of what you wrote to us. Received via email at contact@xlnty.com.
Client engagement data — for people or organisations we contract with: the additional data needed to draft, sign, deliver, invoice, and archive the engagement. This typically includes billing address, VAT number, contract signatories, contact people on your side, meeting notes, deliverables, and correspondence relating to the work.
Financial records — invoices we issue you, payment references, and the underlying evidence Belgian tax law requires us to keep.

Legal basis

Performance of a contract (art. 6(1)(b) GDPR) — for engaged clients and for the pre-contractual exchanges that lead there.
Legitimate interest (art. 6(1)(f)) — for reading and replying to prospect enquiries you initiated with us.
Legal obligation (art. 6(1)(c)) — for keeping financial and tax records under Belgian bookkeeping law.

Retention

Prospect exchanges that did not lead to an engagement — retained for up to 3 years after the last contact, then deleted.
Client engagement records — retained for the duration of the relationship plus 5 years, unless a specific legal obligation requires longer.
Financial records — retained for 7 years, in line with the Belgian Code de droit économique / Wetboek van economisch recht (art. III.86).

Recipients

Client engagement data is handled inside XLNTY BV. It is disclosed to third parties only where necessary and lawful: our email provider, our accountant, the Belgian tax administration (for invoices and returns), and — where required — our legal counsel or a competent authority under judicial process.

When XLNTY processes data on behalf of a client: where an engagement involves us handling personal data whose controller is our client (for example, when we help operate or maintain a system your organisation runs for its own users), our role is that of a processor under GDPR art. 28. That processing is governed by a Data Processing Agreement signed with the client, not by this public policy. Individuals whose data is processed in that context should refer to the client's own privacy notice.

10 XLNTY-operated services

Alongside our consulting work, XLNTY builds and operates its own software products. Each such product is a separate service with its own scope of processing, its own users, and — critically — its own privacy notice, published at the service's own domain. The present policy applies to xlnty.com only; using an XLNTY-operated service is governed by that service's dedicated notice.

Publicly available XLNTY-operated services, and their privacy notices:

ABL Survival Kit (com.xlnty.ablesk) — a free, offline reference app for the ranks and insignia of the Belgian Armed Forces. Fully offline, zero data collection. Privacy notice →

If you use a service that carries the XLNTY name and cannot find its privacy notice, write to contact@xlnty.com and we will point you to it.

11 Changes to this policy

We may update this policy to reflect changes to the website, to the third-party services it depends on, or to the applicable law. The effective date at the top of the page will always show when the current version was published. Material changes will be summarised in a short changelog below when the update happens.

12 Contact

Any question, request, or GDPR right you would like to exercise — write to contact@xlnty.com. We aim to reply to substantive requests within 30 days, as required by the GDPR.