What we collect, why, how long we keep it, which cookies we use, and what you can ask us to do about it.
Version 1.0 · Last updated: 12 October 2026
1. Who we are and what this policy covers
This website (focalpoint-sprl.be) is operated by Focal Point SRL, a company registered in Belgium under company number 0844.581.671, with offices at Koning Boudewijnlaan 20A, Office 133, 3500 Hasselt, Belgium.
Focal Point is the controller of the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR). For any question about this policy or to exercise your rights, contact us at info@focalpoint-sprl.be or write to the address above.
This policy applies to personal data processed in connection with this website: when you contact us, when you register and pay for one of our events or trainings, and when you simply browse the site. Where Focal Point processes personal data in connection with its research activities or EU-funded projects, other privacy notices may apply depending on the project and on Focal Point’s role in the processing.
2. The personal data we process
When
What we receive
From whom
You use our contact form
Your first and last name, email address, company or organisation and the content of your message (including anything you choose to tell us in it).
You
You register and pay for an event or training
First and last name, email address, company or organisation, how you heard about us (optional), country and billing address, VAT number, the event you register for, and payment details such as amount, date, status and payment method. We do not receive your full card number. In case another person registers you, we receive your first and last name, email address and registration information from that organisation/company or person.
You, or where your registration details are provided by your employer, organisation or another person registering you, the source of those details is the person or organisation/company that made the registration
You browse the website
Technical data: IP address, date and time of the request, page requested, referring page, browser and device type (user agent).
Your browser, automatically
You accept analytics cookies
Pages visited, time spent, referring website, approximate location (country or city), device, browser and screen size, and a random identifier stored in a cookie.
Your browser, via Google Analytics
You exercise a privacy right
The content of your request and our correspondence about it.
You
When
You use our contact form
What we receive
Your first and last name, email address, company or organisation and the content of your message (including anything you choose to tell us in it).
From whom
You
When
You register and pay for an event or training
What we receive
First and last name, email address, company or organisation, how you heard about us (optional), country and billing address, VAT number, the event you register for, and payment details such as amount, date, status and payment method. We do not receive your full card number. In case another person registers you, we receive your first and last name, email address and registration information from that organisation/company or person.
From whom
You, or where your registration details are provided by your employer, organisation or another person registering you, the source of those details is the person or organisation/company that made the registration
When
You browse the website
What we receive
Technical data: IP address, date and time of the request, page requested, referring page, browser and device type (user agent).
From whom
Your browser, automatically
When
You accept analytics cookies
What we receive
Pages visited, time spent, referring website, approximate location (country or city), device, browser and screen size, and a random identifier stored in a cookie.
From whom
Your browser, via Google Analytics
When
You exercise a privacy right
What we receive
The content of your request and our correspondence about it.
From whom
You
The fields on our contact form and registration form are needed to answer you or to register you. Invoicing details (company, address, VAT number) are required by Belgian accounting and VAT law when we issue an invoice. If you do not provide them, we cannot process the enquiry or registration.
3. Contact enquiries
When you send a message through our contact form, the details you enter are sent to our web server and forwarded to us as an email. The email is delivered by our email-sending provider, Resend, and arrives in our Microsoft 365 mailbox. We do not store enquiries in a database on this website.
We use your message to reply to you and, if you ask us for a proposal, to prepare it. If our exchange turns into a working relationship, we keep the correspondence as part of that relationship.
If you contact us through the WhatsApp link on our website instead, your message is handled by WhatsApp (Meta) under its own terms and privacy policy. We use it only to reply to you.
4. Event and training registrations
You register and pay for our events and trainings through a secure checkout page operated by Stripe. There you provide the registration and invoicing details listed in section 2. Card and other payment details are entered directly with Stripe. We never see or store your full card number.
We use this information to:
confirm your registration and take payment;
issue invoices and keep our accounting and tax records;
send joining instructions and give participants access to the online training environment;
communicate with you about the event, including practical changes;
issue certificates of participation; and
handle questions, cancellations, refunds and any disputes.
If you register other people, for example colleagues, please make sure they know you are sharing their details with us and point them to this policy.
Stripe processes payment data on our behalf and, for some purposes such as fraud prevention and compliance with financial regulation, as a separate controller under its own privacy policy (stripe.com/privacy). Stripe’s checkout pages are operated by Stripe and may use Stripe’s own cookies.
Information about future events
We send electronic marketing communication where we have obtained the consent required by applicable law or where the conditions of an applicable exception under Belgian law are satisfied. Where we rely on existing-customer exception, communications are limited to our own similar products or services, and recipients are given a simple and free opportunity to object when their electronic contact details are collected and in every subsequent marketing communication. You may object to direct marketing at any time.
5. Website hosting, cookies and analytics
This website is hosted by Vercel Inc. When your browser requests a page, Vercel automatically records technical data (see section 2) to deliver the site, keep it available and protect it against attacks. We do not use this data to build profiles or to identify individual visitors.
We use an automated bot-protection mechanism to detect and prevent abusive or automated submissions. It may process technical information necessary for this purpose.
Google Analytics
With your consent, we use Google Analytics to understand how visitors use our website, for example which pages are read most and how people find us, so that we can improve it. Google Analytics is only activated after you click “Accept” in our cookie banner. If you decline, it is not loaded at all.
Google Analytics collects information such as the pages you visit, how long you stay, the website that referred you, your approximate location (country or city), and your device, browser and screen size. It sets cookies that give your browser a random identifier. Google Analytics uses your IP address only to estimate your approximate location and does not store it. We have switched off Google’s signals, Google’s advertising features and data sharing, and we do not use Google Analytics to identify you. Google Analytics is provided by Google Ireland Limited, acting as our processor.
You can change your mind at any time through the link at the bottom of every page. Withdrawing your consent stops any further collection and removes the Google Analytics cookies from your browser.
Cookies we use
Cookie
Purpose
Duration
fp_consent
Remembers your cookie choice. Strictly necessary, set whichever option you choose.
6 months
_ga
Google Analytics: distinguishes visitors. Only with your consent.
2 years
_ga_ followed by our property ID
Google Analytics: keeps track of your visit session. Only with your consent.
2 years
Cookie
fp_consent
Purpose
Remembers your cookie choice. Strictly necessary, set whichever option you choose.
Duration
6 months
Cookie
_ga
Purpose
Google Analytics: distinguishes visitors. Only with your consent.
Duration
2 years
Cookie
_ga_ followed by our property ID
Purpose
Google Analytics: keeps track of your visit session. Only with your consent.
Duration
2 years
Apart from these, the website stores nothing in your browser. We do not use advertising or social-media tracking tools, tracking pixels or embedded third-party content, and our fonts and images are served from our own website. Links to LinkedIn, YouTube, X, WhatsApp or other websites only take you there when you click them; those sites have their own privacy policies.
We ask for your consent in a banner on your first visit. Declining is as easy as accepting, and the website works fully either way. We ask again after six months, or sooner if we change the cookies we use.
6. Purposes and legal bases at a glance
Purpose
Data
Legal basis (GDPR)
Answering contact enquiries
Contact form data
Legitimate interest (6(1)(f)) in responding to business enquiries and managing prospective client relationships
Understanding how participants found us, to assess the effectiveness of our marketing
Your answer to “How did you hear about us?” on the registration form
Legitimate interest (6(1)(f)) in understanding which channels bring participants to our events and trainings, so we can plan our marketing
Preparing proposals
Contact form data
Pre-contractual steps (6(1)(b))
Registration, payment, delivery of events
Registration and payment data
Contract (6(1)(b)); legitimate interest for participants registered by their organisation/company (6(1)(f)) to administer the event or training and communicating with registered participants
Invoicing, accounting and tax records
Invoicing data, payment records
Legal obligation (6(1)(c))
Information about future events
Name, email
Consent (6(1)(a)) or legitimate interest for existing customers (6(1)(f)), with opt-out
Operating and securing the website, preventing spam and abuse
Technical data
Legitimate interest (6(1)(f)) for maintaining security, availability and integrity of Focal Point’s website and IT infrastructure and preventing fraudulent, abusive or malicious activity.
Measuring and improving the use of our website (Google Analytics)
Analytics data
Consent (6(1)(a))
Remembering your cookie choice and proving consent
Your choice and its date
Legal obligation (6(1)(c))
Handling privacy requests
Request correspondence
Legal obligation (6(1)(c)) to the extent processing is necessary to comply with legal obligations
Handling legal claims
Relevant records or processing information to establish, exercise or defend legal claims
Legitimate interest (6(1)(f)) in demonstrating compliance and establishing, exercising or defending legal claims
Purpose
Answering contact enquiries
Data
Contact form data
Legal basis (GDPR)
Legitimate interest (6(1)(f)) in responding to business enquiries and managing prospective client relationships
Purpose
Understanding how participants found us, to assess the effectiveness of our marketing
Data
Your answer to “How did you hear about us?” on the registration form
Legal basis (GDPR)
Legitimate interest (6(1)(f)) in understanding which channels bring participants to our events and trainings, so we can plan our marketing
Purpose
Preparing proposals
Data
Contact form data
Legal basis (GDPR)
Pre-contractual steps (6(1)(b))
Purpose
Registration, payment, delivery of events
Data
Registration and payment data
Legal basis (GDPR)
Contract (6(1)(b)); legitimate interest for participants registered by their organisation/company (6(1)(f)) to administer the event or training and communicating with registered participants
Purpose
Invoicing, accounting and tax records
Data
Invoicing data, payment records
Legal basis (GDPR)
Legal obligation (6(1)(c))
Purpose
Information about future events
Data
Name, email
Legal basis (GDPR)
Consent (6(1)(a)) or legitimate interest for existing customers (6(1)(f)), with opt-out
Purpose
Operating and securing the website, preventing spam and abuse
Data
Technical data
Legal basis (GDPR)
Legitimate interest (6(1)(f)) for maintaining security, availability and integrity of Focal Point’s website and IT infrastructure and preventing fraudulent, abusive or malicious activity.
Purpose
Measuring and improving the use of our website (Google Analytics)
Data
Analytics data
Legal basis (GDPR)
Consent (6(1)(a))
Purpose
Remembering your cookie choice and proving consent
Data
Your choice and its date
Legal basis (GDPR)
Legal obligation (6(1)(c))
Purpose
Handling privacy requests
Data
Request correspondence
Legal basis (GDPR)
Legal obligation (6(1)(c)) to the extent processing is necessary to comply with legal obligations
Purpose
Handling legal claims
Data
Relevant records or processing information to establish, exercise or defend legal claims
Legal basis (GDPR)
Legitimate interest (6(1)(f)) in demonstrating compliance and establishing, exercising or defending legal claims
7. Who receives your data
We do not sell personal data and we do not share it for advertising. We share it only with:
Recipient
Role
Vercel Inc. (United States)
Website hosting, delivery, security logs and bot protection. Processor.
Plus Five Five, Inc., trading as Resend (United States)
Delivers contact-form messages to our mailbox by email. Processor.
Microsoft Ireland Operations Limited (Microsoft 365)
Hosts our email, including the enquiries and registration correspondence we receive. Processor.
Google Ireland Limited (Google Analytics)
Website analytics, only if you accept analytics cookies. Processor.
Stripe Payments Europe, Limited (Ireland)
Event checkout, payment processing and invoicing. Processor and, for some purposes, separate controller (see section 4).
Providers we use to deliver an event
For example video-conferencing or training-environment platforms, which receive participants’ names and email addresses to give them access. Participants are told which platform is used in their joining instructions.
Our accountant and professional advisers
Where needed for accounting, tax or legal advice. Bound by professional secrecy or confidentiality.
Authorities, courts and law enforcement
Only where we are legally required to, or to establish or defend legal claims.
Recipient
Vercel Inc. (United States)
Role
Website hosting, delivery, security logs and bot protection. Processor.
Recipient
Plus Five Five, Inc., trading as Resend (United States)
Role
Delivers contact-form messages to our mailbox by email. Processor.
Recipient
Microsoft Ireland Operations Limited (Microsoft 365)
Role
Hosts our email, including the enquiries and registration correspondence we receive. Processor.
Recipient
Google Ireland Limited (Google Analytics)
Role
Website analytics, only if you accept analytics cookies. Processor.
Recipient
Stripe Payments Europe, Limited (Ireland)
Role
Event checkout, payment processing and invoicing. Processor and, for some purposes, separate controller (see section 4).
Recipient
Providers we use to deliver an event
Role
For example video-conferencing or training-environment platforms, which receive participants’ names and email addresses to give them access. Participants are told which platform is used in their joining instructions.
Recipient
Our accountant and professional advisers
Role
Where needed for accounting, tax or legal advice. Bound by professional secrecy or confidentiality.
Recipient
Authorities, courts and law enforcement
Role
Only where we are legally required to, or to establish or defend legal claims.
8. Transfers outside the European Economic Area
Our website runs in Vercel’s Frankfurt (EU) region, and our contact-form emails are sent through Resend’s EU region. However, Vercel Inc. and Resend (Plus Five Five, Inc.) are US companies, and Google, Stripe and Microsoft may transfer limited data to their US group companies (Google LLC, Stripe, LLC and Microsoft Corporation). Personal data may therefore be accessed from, or processed in, the United States. Each of these US companies is certified under the EU-U.S. Data Privacy Framework. For these transfers, Focal Point relies on the European Commission’s adequacy decision of 10 July 2023 for that framework. You can check their certifications at dataprivacyframework.gov. Our agreements with these providers also include the European Commission’s Standard Contractual Clauses, which would apply if a certification lapsed or the framework ceased to apply. You can ask us for more information about these safeguards at info@focalpoint-sprl.be.
9. How long we keep your data
Data
How long
Contact enquiries that do not lead to a working relationship
12 months from receipt, then deleted
Contact enquiries that do lead to a working relationship
Relevant correspondence is retained for the duration of the relationship and thereafter for as long as necessary for contractual, accounting, legal or claims-management purposes, in accordance with the applicable retention periods.
Registration and attendance details
3 years after the end of the event
Invoices, payment and accounting records
10 years, as required by Belgian accounting and tax law
Hosting and security logs (Vercel)
1 day on our current hosting plan
Copies of contact-form messages held by our email-sending provider (Resend)
30 days, then deleted automatically by Resend
Google Analytics data
14 months, then deleted automatically by Google
Cookies
As listed in section 5
Privacy requests and our replies
We retain records of privacy requests and our responses for up to 3 years after closure, unless a longer period is necessary to establish, exercise or defend legal claims or comply with a legal obligation.
Your objection to marketing emails
As long as needed to respect your choice
Data
Contact enquiries that do not lead to a working relationship
How long
12 months from receipt, then deleted
Data
Contact enquiries that do lead to a working relationship
How long
Relevant correspondence is retained for the duration of the relationship and thereafter for as long as necessary for contractual, accounting, legal or claims-management purposes, in accordance with the applicable retention periods.
Data
Registration and attendance details
How long
3 years after the end of the event
Data
Invoices, payment and accounting records
How long
10 years, as required by Belgian accounting and tax law
Data
Hosting and security logs (Vercel)
How long
1 day on our current hosting plan
Data
Copies of contact-form messages held by our email-sending provider (Resend)
How long
30 days, then deleted automatically by Resend
Data
Google Analytics data
How long
14 months, then deleted automatically by Google
Data
Cookies
How long
As listed in section 5
Data
Privacy requests and our replies
How long
We retain records of privacy requests and our responses for up to 3 years after closure, unless a longer period is necessary to establish, exercise or defend legal claims or comply with a legal obligation.
Data
Your objection to marketing emails
How long
As long as needed to respect your choice
Where a longer period is needed to establish, exercise or defend a legal claim, we keep the relevant data until the matter is resolved. Stripe also keeps transaction records for the periods required of it by financial regulation.
10. How we protect your data
As a cyber defence company, we treat the security of personal data as part of our own discipline. We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, such as encryption, access controls and the careful selection of our service providers. We review these measures regularly.
11. Automated decision-making
We use automated security mechanisms to detect potentially abusive or automated submissions. These mechanisms do not make decisions producing legal or similarly significant effects concerning individuals. Our bot protection automatically blocks form submissions that appear to come from automated scripts. If a genuine message of yours is blocked, email us directly at info@focalpoint-sprl.be.
12. Your rights
Under the GDPR you have the right to:
access the personal data we hold about you and receive a copy;
have inaccurate data corrected;
have your data erased, where there is no longer a reason for us to keep it;
restrict how we use your data in certain cases;
receive the data you provided to us in a portable format, where we process it on the basis of a contract or consent;
object to processing based on our legitimate interests, and object at any time to direct marketing; and
withdraw your consent at any time, where we rely on consent, without affecting processing that took place before. For analytics cookies, use the “Cookie settings” link at the bottom of every page.
All the above-mentioned rights apply subject to the conditions and limitations provided by the GDPR.
To exercise any of these rights, write to info@focalpoint-sprl.be. We may ask you to confirm your identity before acting on a request. We will respond without undue delay and in any event within one month of receiving your request. Where permitted by the GDPR, this period may be extended by up to two further months, taking into account the complexity and number of requests; if so, we will inform you of the extension and the reasons for it within the first month.
If you believe we have not handled your data properly, you may lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be, or where applicable, another supervisory authority competent under the GDPR. We would appreciate the chance to address your concern first.
13. Changes to this policy
We will update this policy when the way we handle personal data changes. The version number and “last updated” date at the top show when it was last revised. Material changes will be published here before they take effect and, where appropriate, we will inform you directly.
Questions about your data?
We would rather answer a question than have you guess.
