Privacy Policy

Last updated: 2 May 2026

This Privacy Policy explains how MVdW-Software (VAT BE 0729.544.225), Draaiersstraat 33, 9300 Aalst, Belgium, processes personal data. It is part of our Terms of Service. We process personal data in line with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Belgian law.

Contact for all privacy matters: [email protected].

1. Who is responsible?

Our role depends on the situation:

  • Controller: for the data of visitors of this website, of prospects, and of our clients' contact persons (see sections 2 to 4), MVdW-Software decides why and how data is processed and is the controller.
  • Processor: when we process personal data on behalf of a client while performing a project (see section 5), the client is the controller and we are the processor. The client's privacy notice and our agreement with the client then apply first.

2. Website visitors

What Why Legal basis
Web server logs (IP address, date and time, requested page, browser and device information) Deliver the site, keep it secure, and detect abuse Legitimate interest (Art. 6(1)(f) GDPR) in a secure and working website
Google Analytics (a Google Analytics 4 measurement tag): pseudonymous identifiers, pages viewed, approximate location, device and browser information Understand how the site is used and improve it See section 7 on cookies
E-mails you send us (name, e-mail address, content of your message) Answer your question or request Legitimate interest, or steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR)

We do not use the website to sell your data, and we do not make decisions about you based on automated processing.

3. Prospects and clients

For quotations, projects, invoicing and support we process contact details (name, company, e-mail address, telephone number, address, VAT number), correspondence, and the details of the agreed services and payments. We use this to prepare and perform our agreements (Art. 6(1)(b)), to comply with legal obligations such as accounting and tax law (Art. 6(1)(c)), and for our legitimate interest in managing our business and defending legal claims (Art. 6(1)(f)).

We use a private, internally hosted GitLab instance (git.mvdw-software.com) for the version control of our projects and for issue tracking. It is not publicly accessible. Issues and related discussions, for example bug reports or support requests, may contain personal information such as your name, e-mail address or other details you choose to include. We use this information only to handle your request or project (Art. 6(1)(b) and (f)), and it stays on our own infrastructure.

4. Public services and software products

For public services (such as the package repositories and CI server) and for software we sell (for example through SpigotMC.org or the Odoo Apps Store), we process the technical data needed to operate the service, and, for sales, the order data we receive from the marketplace. Marketplaces act as controllers of their own customer data; their privacy policy applies to the data they collect.

5. Personal data we process on behalf of clients

5.1. When a client gives us access to personal data, for example databases, logs, location data, device data or documents, to build, analyse or maintain software, we process it as a processor on the client's behalf. We:

  • process it only on the client's documented instructions and only to deliver the agreed services;
  • do not use it for our own purposes, and do not sell or share it;
  • limit access to the persons who need it and who are bound by confidentiality;
  • prefer anonymised, pseudonymised or synthetic data, and ask the client to avoid special categories of data (Art. 9 GDPR) unless this is agreed beforehand;
  • assist the client with requests from data subjects, security, personal data breach notification and data protection impact assessments;
  • notify the client without undue delay after becoming aware of a personal data breach affecting its data;
  • delete or return the data when the services end, at the client's choice, unless the law requires us to keep it; and
  • make available the information reasonably needed to demonstrate compliance, and allow audits under reasonable conditions.

5.2. Where a client requires a formal data processing agreement (Art. 28 GDPR), we will conclude one on request. That agreement, and any other specific agreement with the client, prevails over this Privacy Policy for the data it covers, as described in our Terms of Service.

5.3. The client remains responsible for the lawfulness of the processing it instructs, for informing data subjects, and for providing no more personal data than necessary.

6. Security

We apply technical and organisational measures appropriate to the risk, taking into account the state of the art and the costs. These include:

  • access control and the principle of least privilege, with strong or multi-factor authentication where available;
  • encrypted connections (TLS) for our website and services, and encryption of devices and backups that hold client data;
  • separation of client data per project, and keeping client data out of public repositories and public services;
  • keeping systems and dependencies up to date and monitoring them for vulnerabilities;
  • regular backups and a procedure to restore them;
  • deletion of data that is no longer needed.

No system is completely secure. If you believe you found a vulnerability, please report it privately to [email protected].

7. Cookies and third-party services

7.1. This website may store small files (cookies) or use similar technologies in your browser to store settings and to measure how the site is used.

7.2. Google Analytics. We use Google Analytics, a service of Google Ireland Limited (and Google LLC), to produce statistics about the use of this site. It uses cookies and identifiers and sends data such as your IP address and device information to Google, which may process it outside the EEA under the safeguards Google applies (such as the EU-U.S. Data Privacy Framework and standard contractual clauses). You can block it with your browser settings, a content blocker or the Google Analytics opt-out browser add-on.

7.3. Resources loaded from other providers. To display the site we load fonts and icons from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), jsDelivr (cdn.jsdelivr.net) and cdnjs / Cloudflare (cdnjs.cloudflare.com). When your browser requests these files, those providers receive your IP address and browser information.

7.4. Links. This site links to other websites (for example social networks and publication databases). Their privacy policies apply once you visit them.

8. Recipients and international transfers

We do not sell personal data. We share it only with:

  • service providers that help us operate our business (hosting, e-mail, accounting and invoicing, backup, and the third parties named in section 7), under agreements that protect your data;
  • clients and their authorised parties, when you are involved in a project;
  • authorities and advisors (accountant, legal advisor, tax authorities) where the law requires or where needed to establish, exercise or defend legal claims.

Where data is transferred outside the European Economic Area, we make sure that an adequacy decision, standard contractual clauses or another valid safeguard under Chapter V of the GDPR applies. Client data is not transferred outside the EEA without such safeguards, and, for processing as a processor, only as permitted by the client.

9. Retention

We keep personal data no longer than necessary for the purposes above:

  • server logs: at most 12 months, unless needed to investigate abuse;
  • analytics data: according to the retention period configured in Google Analytics (at most 14 months);
  • e-mail correspondence and prospect data: up to 2 years after the last contact, unless a project follows;
  • client and accounting records: 7 years after the end of the financial year, as required by Belgian accounting and tax law;
  • client project data processed as processor: until the end of the project or the client's instruction to delete it, followed by deletion from our systems and from backups within the backup rotation period, unless the law requires otherwise;
  • project archive: at the end of a project we may keep an archived copy of the software we developed for the client for an indefinite period. Before archiving, all personal data, as well as the client's confidential information and supplied intellectual property, are removed from it, so the archive does not contain personal data.

10. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to the processing, to data portability, and to withdraw consent at any time where processing is based on consent (without affecting earlier processing). You can object at any time to processing based on our legitimate interest.

To exercise your rights, e-mail [email protected]. We will answer within one month. We may ask you to identify yourself. If your request concerns data that we process as a processor for a client, we will refer it to that client, who is the controller.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be, or with the supervisory authority in your country of residence. We would appreciate the chance to resolve your concern first.

11. Changes

We may update this Privacy Policy, for example when our services or the law change. The current version is always published on this page with its date. For significant changes affecting existing clients, we will inform them directly.

12. Contact

MVdW-Software · Draaiersstraat 33, 9300 Aalst, Belgium · VAT BE 0729.544.225 · [email protected]