Privacy policy

Coderits builds websites for business owners and is the business of Kiano. For the data described below I am the controller within the meaning of the GDPR. The company details and the email address for privacy questions are on the legal information page.

If I maintain your website and data of your visitors or customers passes through it, then for that data I am the processor and you are the controller. The data processing agreement applies to that.

The GDPR requires me to state per purpose on what basis I process. In my case there are four.

Performance of the agreement. Carrying out your project, discussing progress with you, keeping your portal and previews working, and creating your invoices. Without this data I cannot carry out the assignment.

Legal obligation. Keeping invoices and the related data for my bookkeeping and VAT administration.

Legitimate interest. Securing the site and the portal, countering abuse and spam, investigating faults and, if it were needed, substantiating a claim. I weigh that against your privacy and therefore keep it to a minimum.

Consent. Email updates about your request, if you ticked that when creating your account. You can withdraw your consent at any time, without that affecting anything else.

I never sell your data to others and I do not use it for advertising.

Payments and subscriptions run through Stripe Payments Europe. When you pay, you share your payment details directly with Stripe: I never see your card number or bank details.

I only keep what I need for my records: the amount, the date, the payment method and a reference to the payment at Stripe. Stripe processes that data as an independent controller under its own privacy policy, available at stripe.com/privacy.

I work with a small number of service providers I need to make the service work. They may only use your data for what I ask of them.

The hosting provider where the site and the database live. They can technically reach the data, but do not use it.

Stripe Payments Europe for payments and subscriptions.

The mail provider that sends the emails you receive from the portal.

Cloudflare, which the traffic to this site passes through before it reaches my server. That means Cloudflare sees your IP address and which page you request. When visitor statistics are switched on, the counting for those also happens at Cloudflare; the cookie policy sets out what that does and does not involve.

Beyond that I pass on nothing, unless the law obliges me to or it is necessary to defend my rights.

All of these parties are in the European Economic Area or work under a valid transfer mechanism. I do not knowingly put anything outside the EEA.

The site runs entirely over an encrypted connection. Passwords are only stored as an irreversible hash, so I cannot see them myself. The client portal is walled off per client: you only see your own projects, files and invoices, and that is checked again on every request.

I keep the software the site runs on up to date, and I grant administrator access only to myself.

If there were a data breach with a risk to you despite all this, I will tell you and report it to the Belgian Data Protection Authority within 72 hours where required.

You have the right of access to what I hold about you, to correction if something is wrong, and to erasure of anything I am not legally required to keep.

You can have the processing restricted, object to processing based on legitimate interest, and have your data ported to another party in a common file format.

If you gave consent for email updates, you can withdraw it at any time through your profile or with a message.

Send your request to the email address for privacy questions on the legal information page. I respond within a month. If I cannot meet a request, I explain why.

If you are not satisfied with how I handle it, you can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be. I would rather hear it from you first, but that right is always yours.

I do not take decisions about you that are made by a computer alone and that affect you. A person is always involved, and that person is me.

I may update this privacy policy, for example if I start working with a different service provider. The date at the top says when the latest version was made. For a change that really alters something for you, I will let you know.