Privacy statement of MCHLBLLN BV
1 Who is responsible
MCHLBLLN BV, Gulden Bodem 45 bus 302, 3800 Sint-Truiden, enterprise number 0772.728.625, is responsible (as controller) for the processing of your personal data as described here. Questions: michiel@michielbellen.be.
If you use a product that we build or host for another business, that business is responsible for your data and we are its processor. Its own privacy statement then applies.
2 Which data and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You request a quote or complete the intake | Name, company, email, phone, the conversation, photos you upload | Understanding your project and preparing a quote | Pre-contractual measures (Art. 6(1)(b) GDPR) |
| You become a customer | Contact details, company details and VAT number, what you ask us | Building, delivering, supporting | Performance of the contract (6(1)(b)) |
| You pay | Company details, payment details (via Mollie; we do not see card numbers) | Payment and invoicing | Contract and legal obligation (6(1)(b), 6(1)(c)) |
| You chat with support or email us | Name, email, the content of your message | Helping you; passing it on to the managing director where needed | Contract or legitimate interest (6(1)(b), 6(1)(f)) |
| You book an appointment | Name, email, time, subject | Scheduling the conversation | Pre-contractual or contract (6(1)(b)) |
| We contact a business about our services | Business contact details from public sources (e.g. the Crossroads Bank for Enterprises (KBO), the company's website) | Business prospecting | Legitimate interest (6(1)(f)); you can object at any time |
| You visit the website | Technical data (IP address, browser) in server logs; clicks on our own short links | Security, operation, knowing which messages work | Legitimate interest (6(1)(f)) |
3 Artificial intelligence
Our intake, quotes and support are prepared by AI systems (language models from Anthropic) under the supervision of the managing director. No decisions with legal effects for you are taken solely by automated means. You can discuss any quote and any important answer with a human.
4 With whom we share data
We do not sell data. We use the following processors, which act only on our instructions:
| Processor | Used for | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting of our servers and databases | Germany, Finland (EU) |
| Anthropic PBC | AI language models for intake, quotes, support and email | US |
| Mollie B.V. | Online payments and invoices | Netherlands (EU) |
| Postmark (ActiveCampaign LLC) | Sending emails | US |
| Hostinger (Hostinger Global S.à r.l., Luxembourg, and Hostinger operations UAB, Lithuania) | Domain names and mailboxes | EU |
| Google LLC | Calendar and video call for an appointment | US |
In addition, we pass data on to public authorities where the law requires it (for example for the VAT check through the European Commission's VIES, or to the tax administration).
5 Transfers outside the EU
Some processors are established in the United States. We transfer data only where there is an appropriate safeguard: the EU-U.S. Data Privacy Framework where the recipient is certified, or the standard contractual clauses of the European Commission.
6 Security
Our servers are located in Europe and can only be reached over encrypted connections. Secret keys are stored separately and protected. Backups are encrypted. Our automated development systems work without access to production data.
7 How long we keep data
- Quote and intake conversations that are not followed up: 3 years after the last contact.
- Customer data and project communication: for as long as you are a customer, and 3 years after that.
- Invoices and accounting records: 10 years (statutory retention obligation).
- Server logs: at most 90 days.
- Prospecting data: until you object, and otherwise at most 2 years without a response.
8 Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, in particular to prospecting. Email michiel@michielbellen.be; we answer within one month. If you are not satisfied, you can lodge a complaint with the Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.
9 Cookies
Our website uses only cookies that are needed for the site to work (for example to remember a session or a choice of language). We do not use analytics or advertising cookies and do not load scripts or fonts from third parties.
10 Changes
We update this statement when the way we work changes. The date at the top shows the version in force.