Privacy policy

Data controller

The controller of the data collected on tristan-tacule.com is:

• Tristan Tacule, freelance web developer
• Business operated from La Louvière (7100, Hainaut, Belgium) and remotely, with no office or premises open to the public
• Email: support@tristan-tacule.com
• Phone: +32 456 96 02 13

My services are invoiced by Productions Associées asbl, the organization my business is affiliated with (enterprise number BE 0896.755.397, registered office at Rue Coenraets 72, 1060 Saint-Gilles). If you become a client, this organization also processes the data needed for invoicing, for its own accounting obligations. Its full details are in the legal notice.

No data protection officer has been appointed: for any question about your data, write directly to support@tristan-tacule.com.

Data collected and purposes

You can browse this site without filling out a form or creating an account. Apart from the technical connection data described below, data is only collected in the following situations, and only for the stated purpose.

Quote request

• Data: name, email address, phone (optional), project type, estimated budget (optional), message, the page of the site from which the request is sent, date and time.
• Use: reviewing your project, getting back to you, and preparing your quote. The request is saved on the site’s server, then sent directly to my business email.
• Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) of the GDPR).

Contact form

• Data: name, email address, phone (optional), message, originating page, date and time.
• Use: answering your question. The message is emailed to my business email; the form doesn’t save it on the site’s server.
• Legal basis: pre-contractual steps (Article 6(1)(b)) if your question concerns a project; otherwise, my legitimate interest in replying to the messages I receive (Article 6(1)(f)).

Online appointment booking

• Data: the date, time, and duration chosen, first and last name, company (optional), phone, email address, message (optional).
• Use: organizing the appointment by video call. The appointment is saved in the site’s database. An event is created in my Google Calendar, with a Google Meet link: it contains your name, your company, your phone number, and your email address, but not your message. Google sends you the invitation at the address you provided; you also receive a confirmation email, and I receive a summary of the booking.
• To prevent abuse, your email address is also used to limit the number of upcoming appointments booked with the same address.
• Legal basis: pre-contractual steps taken at your request (Article 6(1)(b)).

Website assistant (“Chat” button)

• How it works: the assistant answers with the information published on this website, directly in your browser and with no third-party service. Your questions are neither sent nor stored, and the assistant sets no cookies.
• Preparing a quote: if you ask it to, the assistant prepares your request in the quote form (project type, options, estimate, never your contact details). Nothing is sent until you submit that form, which is handled as described above.
• Anonymous statistics: when the assistant shows an estimate, the site records the date, the package, the project size, the extras, and the amount shown, to better understand what visitors need. These statistics contain neither your questions, nor your IP address, nor any data that identifies you, and are deleted after 12 months. As with the forms, an anti-abuse counter (a fingerprint of your IP address, erased after 24 hours) limits the number of submissions.

Email, phone, and WhatsApp

If you email or call me directly, I use the information you give me to reply to you (pre-contractual steps, Article 6(1)(b), or legitimate interest in replying, Article 6(1)(f)). If you use WhatsApp, this Meta group service also processes your exchanges according to its own rules.

Business prospecting

• Who is concerned: without prior consent, only companies (legal entities registered with the Belgian Crossroads Bank for Enterprises), contacted at the general address they publish on their website (info@, contact@…) or through their website’s contact form. A sole trader, or a personal address, only receives a message if they asked me for it, for example during a call or a visit; that message is then sent at their request (Article 6(1)(b) GDPR).
• Data: the company’s name, its enterprise number, its general email address or the address of its form, its website address, the page where these details appear and the date it was viewed, the technical findings I made about its website, the dates of messages and replies, and a copy of the message sent.
• Source: the company’s website and the Crossroads Bank for Enterprises (public data). I neither buy nor rent any address lists.
• Use: presenting my services in a single message, with at most one reminder.
• Legal basis: my legitimate interest in making my services known to businesses (Article 6(1)(f) GDPR), under the Belgian Royal Decree of 4 April 2003, which allows writing to a legal entity at an impersonal address without prior consent.
• Objection: reply STOP to the message, or email support@tristan-tacule.com. I confirm that your refusal has been recorded, without any advertising, and I never contact you again, by any means. I keep only the address and the date on an objection list, to respect your choice.

Facebook and Instagram ad forms

If you fill out a contact form built into an ad on Facebook or Instagram (Meta Lead Ads), Meta sends me the information you agreed to send, usually your name, email, and phone number. I use it only to respond to your request (Article 6(1)(b)). Meta processes this form according to its own privacy rules.

Spam protection

• hCaptcha only loads when you start filling out a quote or contact form, or when you open appointment booking. It analyzes technical data (IP address, browser, interactions with the page) to tell a person from a bot; the site’s server then verifies the result with hCaptcha.
• Anti-abuse counters: to limit the number of submissions (for example, 5 requests per hour), the server keeps the time of recent submissions, linked to a hash of your IP address: the address itself is not stored in plain text.
• Legal basis: my legitimate interest in protecting the site and my inbox against abuse (Article 6(1)(f)).

Analytics and advertising

• With your consent, Google Analytics 4 and Google Ads, loaded by Google Tag Manager, measure site traffic and the effectiveness of my ads: pages viewed, where the visit came from, device type, interactions, and conversions (a click on the phone number, a successfully submitted form, an appointment booked). When a submission succeeds, only non-identifying information is made available to them: the form type, the page of the site from which the request is sent, and, depending on the case, the project type, budget, or appointment duration chosen. Never your contact details or your message.
• Without your consent, no analytics or advertising cookies are used. Google’s tools may, however, send technical signals without cookies or identifiers (Consent Mode), which are used for aggregate estimates.
• Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time in the cookie policy, and, for the cookieless signals, my legitimate interest in knowing the site’s overall traffic (Article 6(1)(f)).

Google reviews

The reviews published on my Google Business Profile are displayed by an Elfsight widget, loaded from this provider’s servers, which receives your IP address and technical browsing data in the process (legitimate interest in showing my clients’ reviews, Article 6(1)(f)).

Technical browsing data

As on any website, every visit transmits connection data: IP address, date and time, requested page, browser and operating system, referring site. This data is processed by the web host (Hostinger) and by the delivery and protection network (Cloudflare), to display the pages to you, keep the site secure, and prevent abuse. The typefaces and the display libraries for the calendar on the booking page are hosted on the site’s server: no request is sent to Google Fonts (legitimate interest in the proper functioning and security of the site, Article 6(1)(f)).

If you become a client

• Data: contact details, exchanges, quotes, invoices, and the information needed to carry out your project.
• Use: carrying out the project, following up on it, and invoicing it; invoices are issued through Productions Associées asbl.
• Legal basis: performance of the contract (Article 6(1)(b)) and compliance with accounting and tax obligations (Article 6(1)(c)).

In all cases, the contact details you give me are used only to handle your request or your project: no newsletter and no sales offers without your consent. I don’t make any automated decisions about you.

Recipients and service providers

Your data is intended for me alone: it is neither sold nor rented. To run the site, I use the following service providers, who only access it for the service they provide.

To learn more about their practices, see in particular the privacy policies of Google (opens in a new tab), Cloudflare (opens in a new tab), and hCaptcha (opens in a new tab). Your data may also be disclosed to the authorities where required by law.

Transfers outside the European Union

Some providers are based in the United States or may process data there, including Google, Cloudflare, and hCaptcha. Depending on the provider, these transfers rely on the European Commission’s adequacy decision for companies certified under the EU–U.S. Data Privacy Framework, or on the standard contractual clauses adopted by the Commission. You can write to me for information about the applicable safeguards.

Retention periods

Your data is kept only for as long as its intended use requires:

Once a year, I delete data whose retention period has expired.

Your rights

The GDPR gives you the following rights over your data:

• Access: find out what data I hold about you and receive a copy of it;
• Rectification: have inaccurate or incomplete data corrected;
• Erasure: have your data deleted, unless a legal obligation requires me to keep it;
• Restriction: have the use of your data suspended, for example while a dispute is being checked;
• Objection: object to processing based on my legitimate interest;
• Portability: receive the data you provided to me in a commonly used format, or have it sent to another provider;
• Withdrawal of consent: withdraw consent you have given at any time (analytics and advertising cookies), without affecting what was done before.

To exercise these rights, email support@tristan-tacule.com with your request. If I have reasonable doubts about your identity, I may ask you for additional information to verify it. I reply free of charge, within one month; for a complex request, this period may be extended by two months, in which case you will be informed within the first month. For cookies, the easiest way is to use the “Change my preferences” button in the cookie policy.

Filing a complaint with the supervisory authority

If you believe that your data is not being processed properly, you can file a complaint with the Data Protection Authority (Autorité de protection des données, APD), the Belgian supervisory authority: Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be (opens in a new tab). Feel free to write to me first: most questions are easily resolved.

Security

Technical and organizational measures protect your data:

• the site is served over HTTPS only, through an encrypted connection;
• the folders that contain the requests received and the technical files are not accessible from the web;
• the administration area is protected by a username, a password, an anti-bot check, and a limit on login attempts;
• the forms are protected against spam and automated submissions;
• access to the requests received is restricted to Tristan Tacule.

Since no system is infallible, if a data breach posed a high risk to your rights, I would inform you without undue delay, as required by the GDPR.

Cookies

The site uses strictly necessary cookies and, with your consent, analytics and advertising cookies. Their list, their duration, and how to change your choice are detailed in the cookie policy.

Changes to this policy

This policy may change, for example when a service is added or a provider changes. The date of the last update appears at the top of the page: October 2, 2026.