Legal information
Privacy policy
Data protection is at the heart of what we do; it applies equally to how we run our own website. This policy explains what data we process, why, on what legal basis, how long we keep it and what rights you can exercise.
1. Data controller
The data controller is Cyber Praxis SRL, a private limited company under Belgian law, with its registered office at Chaussée de Louvain 498, c5, 1380 Lasne (Belgium), registered with the Crossroads Bank for Enterprises under number 0845.238.402, trading under the name “Cyber Forensics”.
For any question regarding the protection of your data:
- Emailinfo@cyberpraxis.eu
- Telephone+32 2 318 42 25
- PostCyber Praxis SRL, Chaussée de Louvain 498, c5, 1380 Lasne, Belgium
2. The data we collect
2.1 Data you provide to us directly
When you contact us — through the form on this site, by email or by telephone — you typically provide us with:
- your first name and surname;
- your email address;
- your telephone number;
- where applicable, your company or capacity (lawyer, insurer, private individual…);
- any other information you choose to include in your message.
Recommendation. The contact form is not a secure channel for sensitive material. Keep your first message to a general description of your situation: we will then agree with you on an appropriate channel for confidential documents. Do not include health data, judicial data, credentials or passwords.
2.2 Technical data relating to your visit
Visiting the website involves processing technical data: IP address, browser type and version, operating system, pages viewed, date and time of the visit. This data is processed by our hosting provider for the purposes of delivering and securing the service.
The website also stores information in your browser's local storage and, once you have consented, third-party cookies. Full details are in our cookie policy.
2.3 Data processed in the course of our engagements
In the course of a digital investigation or expert engagement, we process data held on the media entrusted to us, which may relate to third parties. Those processing activities fall outside this policy, which concerns the website: they are governed, as the case may be, by the engagement agreement concluded with our client (we then generally act as a processor, under an agreement compliant with Article 28 GDPR) or by the mandate entrusted to us by a judicial authority (we then act within the specific legal framework governing court-appointed expert work).
3. Purposes and legal bases
We process your data only for specified purposes, each resting on a legal basis set out in Article 6 GDPR:
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Responding to your enquiry and, where relevant, preparing a quotation | Identification and contact data, content of the message | Pre-contractual steps taken at your request (Art. 6(1)(b)) and legitimate interest in handling enquiries addressed to us (Art. 6(1)(f)) |
| Managing the contractual relationship and performing our engagements | Identification, contact and billing data | Performance of the contract (Art. 6(1)(b)) |
| Complying with our accounting, tax and professional obligations | Billing data and supporting documents | Legal obligation (Art. 6(1)(c)) |
| Ensuring the operation, security and integrity of the website | Technical connection data, strictly necessary local storage | Legitimate interest in providing a secure, working service (Art. 6(1)(f)) |
| Enabling the contact form hosted by HubSpot | HubSpot cookies and data entered in the form | Your consent (Art. 6(1)(a)), withdrawable at any time |
| Communicating with you through the live chat and handling your enquiry | Content of the conversation, data you provide in it, technical identifier of the conversation | Your consent to enable the module (Art. 6(1)(a)), then pre-contractual steps and legitimate interest in replying (Art. 6(1)(b) and 6(1)(f)) |
| Measuring website audience | None — feature not currently enabled | Your consent (Art. 6(1)(a)) should it be enabled |
| Establishing, exercising or defending legal claims | Data relevant to the dispute concerned | Legitimate interest (Art. 6(1)(f)) |
We send no unsolicited commercial communications and carry out no automated decision-making or profiling producing legal effects concerning you.
4. Recipients and processors
Your data is never sold, rented or exchanged. It is accessible only to those members of our team who need it, and to the following service providers, which act as processors under an agreement compliant with Article 28 GDPR:
| Provider | Role | Data location |
|---|---|---|
| HubSpot, Inc. / HubSpot Ireland Ltd | Hosting of the contact form and follow-up of enquiries (European portal eu1) |
European Union, with possible access from the United States |
| Google Ireland Ltd | Delivery of the typefaces (Google Fonts) | European Union, with possible access from the United States |
| 3CX Limited (Nicosia, Cyprus) | Publisher of the live chat module and routing of conversations to our cyberpraxis.3cx.be instance |
European Union (Cyprus) |
| o2switch (Clermont-Ferrand, France) | Hosting of the pages and technical logs | France (European Union) |
Your data may also be disclosed to our advisers (lawyer, accountant, auditor) bound by professional secrecy, and to public or judicial authorities where the law requires it.
5. Transfers outside the European Economic Area
We consistently favour solutions whose data is hosted in the European Union: the site itself is hosted in France, the contact form uses HubSpot's European portal and the live chat runs through our own 3CX instance, whose publisher 3CX Limited is established in Cyprus, within the European Union.
Certain support or maintenance operations may nevertheless involve access from the United States. Such transfers are framed by the appropriate safeguards provided for in Chapter V GDPR, namely the European Commission's standard contractual clauses and, where applicable, certification of the providers concerned under the EU–US Data Privacy Framework. A copy of those safeguards is available on request.
6. Retention periods
We keep your data only for as long as is necessary for the purposes pursued:
| Category | Retention period |
|---|---|
| Enquiries that did not lead to an engagement (prospects) | 5 years from your last contact |
| Client files and correspondence relating to an engagement | 10 years from the end of the engagement, matching the limitation period for contractual liability under Belgian law |
| Accounting records and invoices | 10 years, in accordance with Belgian accounting and tax legislation |
| Proof of cookie consent | 6 months, after which you are asked again |
| Server technical logs | 12 months at most |
Once these periods expire, data is securely deleted or irreversibly anonymised.
7. Security
As a firm specialising in information security, we apply to our own processing the technical and organisational measures we recommend to our clients, in particular:
- encryption in transit (HTTPS/TLS) and encryption at rest of media holding engagement data;
- strict access control on a least-privilege basis, with strong authentication;
- physical security of our premises and analysis areas;
- a documented information security policy and continuous staff awareness training;
- access logging and compartmentalisation of case files;
- demanding contractual requirements when selecting our processors and partners.
Should a data breach be likely to result in a high risk to your rights and freedoms, we would inform you in accordance with Articles 33 and 34 GDPR.
8. Your rights
Under Articles 15 to 22 GDPR, you have the following rights:
- Right of access
- To know whether we process data concerning you, to access it and to obtain information about that processing.
- Right to rectification
- To have inaccurate data corrected or incomplete data completed.
- Right to erasure
- To obtain deletion of your data where there is no longer a legitimate reason to keep it.
- Right to restriction
- To request that processing be frozen, in which case we keep the data without otherwise using it.
- Right to object
- To object, on grounds relating to your particular situation, to processing based on our legitimate interest.
- Right to data portability
- To receive, in a structured, machine-readable format, the data you provided to us on the basis of consent or a contract, and to have it transmitted to another controller.
- Right to withdraw consent
- Where processing is based on your consent (cookies, HubSpot form), to withdraw it at any time, without affecting the lawfulness of processing already carried out.
- Right to lodge a complaint
- To refer the matter to the competent supervisory authority (see section 9).
Some of these rights are subject to limits: we cannot erase data we are legally required to retain, nor material forming part of an ongoing court-appointed expert engagement.
9. Complaint to the supervisory authority
If you consider that the processing of your data does not comply with the regulations, you may lodge a complaint with the Belgian Data Protection Authority:
- AddressRue de la Presse 35, 1000 Brussels, Belgium
- Telephone+32 (0)2 274 48 00
- Emailcontact@apd-gba.be
- Websitedataprotectionauthority.be
If you reside in another Member State, you may also contact the supervisory authority of your place of residence or work.
10. How to exercise your rights
Send your request:
- By emailinfo@cyberpraxis.eu
- By postCyber Praxis SRL, Chaussée de Louvain 498, c5, 1380 Lasne, Belgium
- By telephone+32 2 318 42 25
Please state which right you wish to exercise and, for requests by post, the address to which we should reply. We may ask for proof of identity where there is reasonable doubt as to the identity of the requester; that proof is destroyed as soon as verification is complete.
You will receive a reply within one month of receipt of the request. That period may be extended by two months for complex or numerous requests; we would inform you within the initial period. Exercising your rights is free of charge.
11. Changes to this policy
This policy may be adapted to reflect legal, technical or organisational developments. The date of the latest update appears at the top of the page. In the event of a substantial change we will inform you by appropriate means and, where the change concerns processing based on consent, we will seek your consent again.