Privacy Statement

1. Data controller

The controller for the processing described in this statement is:

We have not appointed a data protection officer, as we are not required to (Article 37 GDPR).

2. Summary

3. Our website (almo-consulting.eu / almo-consulting.be)

When you visit our website, our servers record technical data: your IP address, browser, the pages you request and the time of your visit. Server logs are kept for a short period for security purposes.

We use cookieless, self-hosted web analytics to understand how the website is used: pages visited, referrer, browser and device type, and approximate location (country, region and city). This data is kept for as long as needed to understand use of the website over time.

No cookies are set, and the analytics store nothing on your device. If you use the light and dark display switch, your choice is remembered in your browser.

Legal basis: legitimate interests (Article 6(1)(f) GDPR) - the security and operation of the website, and understanding how it is used.

4. Online tool (api.datatoolset.eu)

Addresses you submit for lookup are processed only to return the result and are not stored.

Server logs are kept for a short period for security purposes and to prevent abuse.

Legal basis: legitimate interests (Article 6(1)(f) GDPR) - providing the tool you use, and keeping it secure and free from abuse.

5. Enquiries by email and telephone

If you contact us by email or telephone, we process your name, contact details and the content of your message in order to respond.

Enquiries that do not lead to a contract are deleted 2 years after the last contact. Correspondence that becomes part of a client file is kept as described under "Clients and invoicing".

Legal basis: legitimate interests (Article 6(1)(f) GDPR) in responding to enquiries or, where the enquiry leads to a contract, taking steps at your request before entering into a contract and performing it (Article 6(1)(b) GDPR).

6. Phone messages (voicemail)

Calls to our number +32 2 886 22 30 are answered by an automated voicemail. The greeting tells you that the call is recorded and processed by an automated system using artificial intelligence.

If you leave a message, we process your phone number (or "withheld" if you withhold it), the date, time and duration of the call, the language you choose, your recorded message (at most 180 seconds), its transcript and an AI-generated summary. The summary sets out the details you give in your message: your name, company, subject, callback number and requested action, and how urgent the message appears to be.

The recording is transcribed on our own server using local speech recognition, with Mistral AI's speech-to-text service (EU, zero data retention) as a fallback. The transcript is summarised by Mistral AI (EU, zero data retention).

The summary and transcript are emailed to info@almo-consulting.be through EmailLabs, our email delivery provider in Poland. The audio recording is deleted from our processing systems once the email has been delivered. If automatic processing fails, we receive the recording as an email attachment instead; it is then kept with that email.

We also record each message in our customer relationship management (CRM) system, which runs on our own server in the European Union: your phone number, your name and company as you give them, the date, time and duration of the call, the transcript and the summary and, where you ask us to do something, a follow-up task. These records are kept like other enquiries: they are deleted 2 years after the last contact, unless they become part of a client file.

If you do not leave a message, or your message contains less than 2 seconds of speech, we receive a missed-call email with your phone number (or "withheld") and the time of the call.

Voicemail and missed-call emails are kept like other enquiries: they are deleted 2 years after the last contact, unless they become part of a client file. A technical call log (phone number, time, duration and outcome of the call, without any message content) is kept for 90 days and then deleted automatically.

Calls reach us through our telephony provider, DIDWW.

Legal basis: legitimate interests (Article 6(1)(f) GDPR) in answering and following up calls or, where the call concerns a contract or steps taken at your request before entering into a contract, Article 6(1)(b) GDPR.

No decisions based solely on automated processing within the meaning of Article 22 GDPR are made: the summary only helps us return your call, and a person decides on any follow-up.

7. Clients and invoicing

We process the contact and contract data of our clients and their representatives, and the invoices we issue, to perform our contracts and meet our accounting and tax obligations. Invoices are issued electronically and our bookkeeping is done by an external accountant.

Bookkeeping records are kept for 10 years, as required by law. Other client data is kept for the duration of the contract, then until the limitation period for claims has expired or statutory retention obligations end, whichever is later.

Where a client engages us for project work, the client is usually the controller for the personal data processed in that project. We then act as processor and process that data only on the client's documented instructions. Personal data processed in project work is shared only with the recipients listed below or as required to deliver the agreed services.

Legal basis: performance of a contract (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c) GDPR) and, for keeping data until the limitation period for claims has expired, legitimate interests in establishing, exercising or defending legal claims (Article 6(1)(f) GDPR).

8. Processing on behalf of ALMO Invest sp. z o.o.

We act as processor for ALMO Invest sp. z o.o. in providing its website (almo-invest.com.pl), web analytics, voicemail, IT services and backups. For that processing, ALMO Invest is the controller. See its privacy statement: almo-invest.com.pl/prywatnosc.

9. Recipients

Depending on the activity, personal data may be disclosed to the following categories of recipients:

• hosting and content-delivery providers;
• email service providers, including our email delivery provider (EmailLabs);
• our telephony provider (DIDWW);
• speech recognition and AI summarisation provider (Mistral AI);
• our bank and electronic invoicing platform;
• our external accountant;
• public authorities, where the law requires it.

Our hosting, content-delivery, email service, telephony, speech recognition and AI summarisation providers and our electronic invoicing platform act as processors under contract and process data only on our instructions; so does our external accountant, where it processes data on our instructions. Other recipients, such as our bank and public authorities, process data as separate controllers. We do not sell personal data.

Personal data is processed within the European Economic Area. Where a provider may access data from outside the EEA, this is covered by the EU Standard Contractual Clauses or an adequacy decision. You can obtain a copy of the Standard Contractual Clauses used by contacting us at info@almo-consulting.be.

10. Security and backups

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration and loss.

Our own backups are kept within the European Economic Area and overwritten on a fixed rotation, so deleted data disappears from backups when the rotation expires.

11. Your rights

Under the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) you have the right to:

• access your personal data and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure of your data;
• restriction of processing;
• object (Article 21 GDPR) to processing based on legitimate interests, on grounds relating to your particular situation;
• data portability for data you provided to us, where processing is based on a contract and carried out by automated means.

Right to object: you may at any time object, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) GDPR (Article 21(1) GDPR). Once you object, we will stop processing that data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

To exercise these rights, contact us at info@almo-consulting.be. We reply within one month of receiving your request.

We do not make decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

12. Right to lodge a complaint

If you believe that our processing of your personal data infringes the GDPR, you can lodge a complaint with the Belgian Data Protection Authority:

You can also complain to the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place.

13. Whether you must provide data

You do not have to provide any personal data to use our website; the technical data described above is recorded automatically when you visit it.

Contacting us is voluntary. If you do not provide your contact details, we cannot reply to your enquiry.

If you are a client, providing your data is a contractual requirement: we need it to conclude and perform the contract, and without it we cannot do so. Providing the data needed for invoicing is a statutory requirement under accounting and tax law.

14. Changes to this statement

We may update this statement. The "Last updated" date at the top of this page shows when it was last revised.

This statement is available in English, Dutch and French; all three language versions are equally authoritative.

For questions about this statement or how we handle your personal data, contact us at info@almo-consulting.be.