Privacy Policy
Last updated: 5 October 2026
1. Who processes your data
Illustrated is a trade name of IMIGRE VOF.
IMIGRE VOF, Broekstraat 13, 1840 Londerzeel, Belgium. Company and VAT number: BE 0828.191.245. Email: gregory@illustrated.be
IMIGRE VOF is the controller for the personal data collected through illustrated.be. For any question about this policy or about your data, write to the address above.
2. What we process, what for, and on what basis
Contact form
Data: first name, last name, email address and the content of your message.
Purpose: answering your question, scheduling an introductory call and, if you ask for one, preparing a free prototype.
Basis: performance of a contract, or the steps taken at your request before entering into one (Article 6(1)(b) GDPR).
First name, last name and email address are required to submit the form. What you write in the message field is up to you; please do not include anything you would rather not send by email.
Newsletter
Data: email address.
Purpose: sending you our newsletter.
Basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time by emailing gregory@illustrated.be. Withdrawing your consent does not affect processing that already took place.
Subscriptions are stored within our website platform. We do not use a separate email marketing tool and we do not pass your address to third parties.
We do not send a newsletter yet. Your address is kept until we do, and you will receive nothing other than that newsletter. If you want out before then, email the address above.
Job applications
Data: name, email address, a link to your LinkedIn profile or portfolio if you add one, the area you want to work in and your message.
Purpose: assessing your open application and contacting you about it.
Basis: the steps you ask us to take before a possible agreement (Article 6(1)(b) GDPR).
Technical logs
Our hosting provider keeps server logs, including IP addresses, to keep the website running, diagnose faults and prevent abuse. Basis: our legitimate interest in a working and secure website (Article 6(1)(f) GDPR).
What we do not do
This website sets no advertising cookies, uses no social network tracking pixels and builds no profile of you for advertising. For visitor statistics we use Google Analytics, see section 3.
We do not process special categories of personal data through this website. We do not take automated decisions that produce legal effects for you. We do not sell your data.
3. Cookies
For visitor statistics we use Google Analytics 4 by Google Ireland Limited. It shows us how many people visit the site, which pages they read and how they arrive. Google Analytics sets the cookies _ga and _ga_3DDZ112V8V for this, which are kept for up to 2 years. Detailed visit data is kept for 2 months. Data linked to your browser is kept until 14 months after your last visit. We do not use these statistics for advertising and do not link them to your name.
Our website platform may set functional cookies that are strictly necessary for the site and its forms to work, for example to prevent a form from being submitted twice. Under the law, those do not require consent.
Basis: your consent (Article 6(1)(a) GDPR). We are working on a cookie banner that lets you give or refuse that consent. Until it is in place, you can refuse Google Analytics with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout) or by blocking cookies in your browser. You can delete cookies at any time through your browser settings.
4. Who we share your data with
We use a small number of providers that process data on our behalf. Where required, their data processing terms apply or we have a data processing agreement in place with them.
Webflow, Inc. (United States): website hosting and storage of form submissions.
jsDelivr and Amazon CloudFront (global network): delivery of scripts and style files. These parties set no cookies, but do see your IP address because your browser requests their files.
Google Ireland Limited (Ireland, with transfer to the United States): visitor statistics through Google Analytics.
Cal.com, Inc. (United States): scheduling an introductory call. When you book a slot, Cal.com processes your name, email address, the chosen time and any note you add. The Cal.com booking script is loaded on every page so the scheduler opens quickly, which means Cal.com also sees your IP address.
We may also share data with our accountant, legal advisers or public authorities, where this is necessary for a contract with you or required by law.
5. Transfers outside the European Economic Area
Our hosting provider is based in the United States, and Google may transfer Google Analytics data to the United States. For those transfers we rely on the EU-US Data Privacy Framework where the recipient is certified under it, and in addition on the standard contractual clauses approved by the European Commission, supported by appropriate technical and organisational measures.
If you want to know which safeguards apply to a specific party, email gregory@illustrated.be.
6. How long we keep your data
Contact form that does not lead to an engagement: 12 months after the last contact.
Contact form that does lead to an engagement: for the duration of the engagement and 10 years afterwards, in line with the limitation period for contractual liability.
Invoices and other accounting records containing your data: 7 years, as required by accounting law.
Newsletter subscription: until you unsubscribe, and up to 12 months afterwards to evidence that the unsubscribe was processed.
Open applications: up to 1 year after your last contact with us, unless you ask us to delete them sooner.
Server logs: according to our hosting provider's standard policy.
After these periods your data is deleted or anonymised.
7. Your rights
You have the right to:
request access to the data we hold about you
have inaccurate data corrected
have your data erased
have processing restricted
object to processing that relies on our legitimate interest
receive your data in a readable format, or have it transferred
withdraw your consent, for anything that relies on consent
Send your request to gregory@illustrated.be. We respond within one month. We may ask you to confirm your identity before releasing any data.
If you are not satisfied with how we handle your request, you can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be.
8. Security
We take reasonable technical and organisational measures to protect your data: encrypted connections, access limited to those who need it, and providers bound by the same requirements. No measure offers absolute certainty, but we treat our visitors' data with the same care as our clients'.
9. Changes to this policy
We update this policy when our website or our practices change. The date at the top indicates the latest version. If a change is significant, we will tell you about it directly.