1. Who is responsible for the processing?

The data controller is Wellens BV, trading under the name Small Steps Big Impact, with its registered office at Heirbaan 96, 3620 Lanaken, Belgium, office and visiting address Corda Campus Hal A, Kempische Steenweg 303, 3500 Hasselt, registered with the Crossroads Bank for Enterprises under number 0789.681.057 (VAT BE0789.681.057), hereinafter "SSBI", "we" or "us". For any question about this policy or about the processing of your personal data, you can reach us by e-mail at senne.wellens@smallstepsbigimpact.io, by post at the address above, or by phone at +32 474 13 78 13. We have not appointed a data protection officer, as the nature and scale of our processing do not require one; the contact point above handles all privacy requests.

2. Who and what does this policy cover?

This policy applies to every natural person whose personal data we process in our capacity as data controller: visitors to the website smallstepsbigimpact.io and its subdomains, people who contact us through the contact form, e-mail, phone or social media, people who book an appointment through our website, newsletter subscribers, contact persons at (prospective) clients, partners and suppliers, participants in our workshops and training sessions, and job applicants. Where we process personal data on behalf of a client, for instance because we build or maintain an automation that processes data of the client or of the client’s customers, we act as a processor within the meaning of Article 28 GDPR. In that case our client is the data controller and the arrangements are set out in a data processing agreement. This policy does not apply to that processing; please contact the client concerned.

3. Which data do we process, why, and on which legal basis?

Below you will find, per situation, which data we process, for which purpose, on which legal basis and for how long. We never collect more data than necessary for the stated purpose.

3.1 Visiting our website

Each time you visit our website, our hosting provider and we process technical data: your IP address, the type and version of your browser and operating system, the pages visited, the time of your visit, the referring website and error messages. This data is necessary to display the website correctly, to guarantee the security and stability of the website and to detect abuse. Legal basis: our legitimate interest in a properly functioning and secure website (Art. 6(1)(f) GDPR). Server logs are kept for a maximum of 12 months. In addition, and only with your consent, we place analytics and marketing cookies. See chapter 5 (Cookies).

3.2 Contact form, e-mail, phone and social media

When you send us a message through the contact form on the website, by e-mail, by phone or via LinkedIn or another social network, we process your name, e-mail address, phone number, company name and job title (where provided) and the content of your message. We use this data to answer your question and, if you ask us to, to propose a screening, quotation or appointment. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to those who contact us (Art. 6(1)(f) GDPR). We keep the correspondence for up to 24 months after the last contact; if the contact leads to an agreement, the retention periods in section 3.5 apply.

3.3 Booking an appointment

Through our website you can directly schedule an introductory call or a screening using an online scheduling tool. We then process your name, e-mail address, phone number, company name, the chosen time slot and any comments you add. We use this data to confirm the appointment, send you a confirmation and reminder, and prepare the conversation. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). The scheduling tool is provided by an external service provider acting as our processor; see chapter 6. Appointment data is kept for up to 24 months after the appointment, unless an agreement follows.

3.4 Newsletter

If you subscribe to our newsletter, we process your e-mail address, your name (if provided), the time of subscription and the IP address used to subscribe (as proof of your consent). We then periodically send you insights on AI, automation and process optimisation, practical cases, and news about our services and workshops. Legal basis: your consent (Art. 6(1)(a) GDPR). You confirm your subscription through a confirmation link (double opt-in). You may withdraw your consent at any time via the unsubscribe link at the bottom of every newsletter or by e-mailing us; we then remove you from the mailing list within 5 working days. We measure whether newsletters are opened and which links are clicked in order to improve our content; this is part of the consent you give when subscribing. We may inform existing clients, on the basis of our legitimate interest (Art. 6(1)(f) GDPR), about services similar to those they purchased from us. You can object to this at any time, free of charge.

3.5 Clients, prospects, partners and suppliers

For contact persons at (prospective) clients, partners and suppliers we process identification and contact data (name, job title, business e-mail address and phone number, company details), data about the collaboration (quotations, proposals, contracts, notes of meetings and screenings, project documentation, invoices, payments) and the communication we have with you. Purposes: preparing proposals and quotations, performing and following up on the agreement, client management, invoicing and accounting, and handling disputes. Legal bases: performance of the contract or of pre- contractual steps (Art. 6(1)(b) GDPR), compliance with legal obligations such as accounting and tax legislation (Art. 6(1)(c) GDPR) and our legitimate interest in efficient business operations and in defending our rights (Art. 6(1)(f) GDPR). During a screening we interview employees of the client and map their processes. The notes and reports that result contain only the professional data needed to describe the process. We ask the client to inform employees about this in advance. Retention periods: contract and project data is kept for up to 10 years after the end of the agreement (the general limitation period for contractual claims under Belgian law); accounting records and invoices for 10 years after the closing of the financial year (statutory obligation); and data of prospects with whom no agreement was concluded for up to 24 months after the last meaningful contact.

3.6 B2B prospecting

We may collect professional contact details of companies and their contact persons (company name, name and job title of the contact person, business e-mail address or phone number, website) from publicly accessible sources such as the Crossroads Bank for Enterprises, company websites and professional networks, in order to inform them about our services. Legal basis: our legitimate interest in B2B marketing (Art. 6(1)(f) GDPR, recital 47). We limit ourselves to persons whose role is relevant to our offering, contact them only in their professional capacity and offer a simple way to object in every message. If you object, we stop contacting you immediately and add you to a list of persons who are no longer approached. We keep prospecting data for a maximum of 24 months after collection if no response follows.

3.7 Workshops and training

For participants in our workshops and training sessions we process name, e-mail address, employer and job title, attendance and any evaluations. We use this data to organise the workshop, inform participants, deliver course material and issue certificates or invoices. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Photos or videos taken during a workshop are only made and published with the prior, explicit consent of the identifiable persons (Art. 6(1)(a) GDPR). Participant data is kept for up to 24 months after the workshop; invoicing data for 10 years.

3.8 Job applicants

If you apply for a position with us, we process the data you provide (CV, cover letter, contact details, portfolio) and our notes of the interviews, in order to assess your application. Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR). If you are not hired, we delete your data no later than 12 months after the procedure ends, unless you consent to us keeping it longer for future vacancies.

4. Special categories of data and minors

We do not process special categories of personal data (such as health data, data revealing ethnic origin, political opinions or religious beliefs) and ask you not to provide us with such data. Our website and services are aimed at businesses and professionals and are not intended for persons under the age of 16. We do not knowingly collect data from minors. If you suspect that a minor has nevertheless provided us with data, please contact us and we will delete it.

5. Cookies and similar technologies

Our website uses cookies: small text files that are stored on your device when you visit the website. We also use similar technologies such as pixels, scripts and local storage. Where we refer to "cookies" below, we mean all of these technologies. The applicable rules are set out in Article 129 of the Belgian Electronic Communications Act of 13 June 2005 and in the GDPR.

5.1 Which cookies do we use?

Category Purpose Legal basis Examples and retention Strictly necessary cookies Make the website work: page navigation, security, remembering your cookie choice, operation of the contact form and the scheduling tool. No consent required (strictly necessary, Art. 129 §3 ECA). Session cookies (deleted when the browser closes); cookie storing your cookie preference: 12 months. Analytics cookies Measure how visitors use the website (pages visited, duration, source, device) so that we can improve it. Your consent. [Google Analytics 4]: _ga and _ga_*, 24 months. IP addresses are truncated/anonymised. Until you consent, Google Analytics runs in consent mode: no cookies are set and no identifiers are stored; only anonymised, aggregated signals are sent. Marketing cookies Measure the effectiveness of our advertising and show relevant advertising on other platforms. Your consent. [LinkedIn Insight Tag]: li_sugr and bcookie, up to 12 months; [Meta Pixel]: _fbp, 3 months. Third-party functional cookies Embedded content or tools of third parties, such as the appointment scheduler or embedded videos. Your consent, unless strictly necessary to provide the function you requested. [Calendly / Cal.com]: session cookies; [YouTube / Vimeo]: up to 24 months. The specific cookie names, retention periods and providers are reviewed regularly and may change. An up-to-date, detailed list is available through the cookie settings on the website.

5.2 Managing your consent

On your first visit we show a cookie banner that lets you accept or refuse all non-essential cookies, or make a choice per category. Refusing is as easy as accepting and has no consequences for your access to the website. Non-essential cookies are only placed after you have accepted them. You can change or withdraw your choice at any time via the "Cookie settings" link at the bottom of every page. You can also refuse or delete cookies through your browser settings; some parts of the website may then work less well. We keep proof of your cookie choice for 12 months, after which we ask for your preference again.

6. With whom do we share your data?

We never sell your personal data to third parties. We share it only in the following cases.

6.1 Processors

We use service providers that process personal data on our behalf and in accordance with our instructions. We have concluded a data processing agreement in line with Article 28 GDPR with each of them. They fall into the following categories: website hosting and domain management, e-mail and office software, cloud storage and document management, CRM and client management software, the online scheduling tool for appointments, newsletter software, web analytics and advertising platforms (only with your consent), accounting and invoicing software, and tools for video conferencing and for transcribing or summarising meetings. We will provide an up-to-date list of our processors on simple request.

6.2 Partners

For certain assignments we work with partners, for example for the commercial follow-up of proposals or for communication and content services. We share your professional contact details with a partner only when necessary to prepare a proposal or carry out an assignment in which that partner is involved, and we inform you accordingly. Depending on its role, the partner then processes your data as a separate controller or as our processor.

6.3 Authorities and advisers

We may disclose your data to public authorities where we are legally obliged to do so (for example the tax administration) and to our accountant, legal advisers or insurers where necessary to defend our rights or meet our obligations. In the event of a transfer of our business or a merger, data may be transferred to the acquirer, who remains bound by this policy.

7. Transfers outside the European Economic Area

Some of our processors are established outside the European Economic Area (EEA) or use servers located outside it, in particular in the United States. In such cases we ensure that the transfer is based on an adequacy decision of the European Commission (such as the EU- US Data Privacy Framework for certified recipients) or, failing that, on the European Commission’s Standard Contractual Clauses, supplemented with additional measures where necessary. You can request a copy of the applicable safeguards through the contact point in chapter 1.

8. How do we secure your data?

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, alteration or disclosure. These include encrypted connections (TLS) for our website and e-mail, two-factor authentication and strong passwords on all our systems, access restricted to those who need the data, regular back-ups, careful selection of processors and contractual security obligations for our partners. If, despite these measures, we identify a breach that poses a risk to your rights and freedoms, we will notify the Data Protection Authority within the statutory period and, where required, you.

9. How long do we keep your data?

We do not keep your personal data longer than necessary for the purpose for which we collected it, taking into account statutory retention obligations and limitation periods. The specific periods per processing activity are set out in chapters 3 and 5. When the retention period expires, we delete or anonymise the data, unless an ongoing dispute or a legal obligation requires longer retention.

10. Your rights

Under the GDPR you have the following rights regarding your personal data.

11. Complaints

If you have a complaint about the way we handle your data, we would appreciate hearing from you first so that we can resolve it. You also always have the right to lodge a complaint with the supervisory authority. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, phone +32 (0)2 274 48 00, e-mail contact@apd-gba.be, website www.dataprotectionauthority.be. If you live in another EEA member state, you may also contact the supervisory authority of your place of residence; in the Netherlands this is the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl).

12. Links to other websites

Our website may contain links to third-party websites and services, such as social networks or partner tools. This policy does not apply to those websites. We recommend that you read the privacy policy of every website you visit.

13. Changes to this policy

We may amend this policy, for example when our services, the tools we use or the legislation change. The most recent version is always available on our website, stating the version number and effective date. In the event of material changes that directly affect you, we will inform you in an appropriate manner, for example by e-mail if we have your address. We recommend that you consult this policy regularly. This policy is available in Dutch and English. In the event of any inconsistency between the two versions, the Dutch version prevails.

See where the gains are.

Ready for your first small step?

Book an intro call with Senne. No strings attached.
Either way you leave with a few concrete pointers.