Privacy Notice

1. Data controller

• Controller: Neal Gysemans (personal software engineering portfolio, Antwerp, Belgium)
• Privacy contact: dev.neal@hotmail.com

When this website operates in commercial enterprise mode, the full statutory enterprise identification details (registered name, geographic address, and KBO number) are published in the footer of every page alongside this notice.

2. Contact form and direct email inquiries

When you submit the contact form or send an email directly, only the details you provide yourself — your name, email address, subject, and message (together with technical delivery metadata) — are processed in order to read and reply to your inquiry (Art. 6(1)(f) GDPR legitimate interest in answering messages addressed to us, or Art. 6(1)(b) GDPR pre-contractual steps taken at your request).

• First-party Worker & email processor: Contact form submissions are validated transiently on our own Cloudflare Worker (POST /api/contact, zero form database) and relayed as an email to our inbox via Resend (operated by Plus Five Five, Inc., governed by Resend’s GDPR Data Processing Agreement and EU Standard Contractual Clauses, using EU eu-west-1 sending infrastructure where configured). Your inquiry is never stored in a marketing list or third-party CRM.
• Retention period: Contact messages and related email threads are kept for up to 12 months after your inquiry has been resolved, unless ongoing correspondence or a statutory obligation requires retaining them longer.
• Minors: This website and its contact channels are not directed at children under 13 years of age (Art. 7 of the Belgian Data Protection Act of 30 July 2018).

3. Cookies, self-hosted fonts, edge logs and anti-spam protection

This website sets zero analytics, advertising, or cross-site tracking cookies and serves all .woff2 font files directly from its own origin (zero external Google Fonts requests or third-party font CDN transfers).

• Cloudflare edge hosting & security logs: Static pages and assets are served via Cloudflare Workers Static Assets (Cloudflare, Inc.). To deliver pages reliably and defend against denial-of-service or automated abuse, Cloudflare transiently processes standard HTTP request metadata (IP address, requested URL, timestamp, and User-Agent) in edge security logs under legitimate network and information security interest (Art. 6(1)(f) GDPR; governed by Cloudflare’s DPA, EU-U.S. Data Privacy Framework certification, and Standard Contractual Clauses where applicable).
• Cloudflare Turnstile (anti-spam on /contact/): To protect the contact form against automated bot submissions, the contact page loads Cloudflare Turnstile (Cloudflare, Inc.) when form protection is active. Turnstile evaluates technical browser and network signals (such as IP address, TLS characteristics, and client integrity checks) without placing advertising or tracking cookies, strictly to verify that a submission comes from a real visitor (Art. 6(1)(f) GDPR legitimate security interest and Art. 129 of the Belgian Electronic Communications Act). If JavaScript is disabled in your browser, the form stays hidden and you can always reach out directly via dev.neal@hotmail.com.

4. Your GDPR rights and complaints

Under the General Data Protection Regulation (Art. 15–21 GDPR), you have the right to request access to, rectification or erasure of, or restriction of processing concerning your personal data, as well as the right to object to processing based on legitimate interest, by emailing dev.neal@hotmail.com.

You also have the right to lodge a complaint with the Belgian supervisory authority: Data Protection Authority (Gegevensbeschermingsautoriteit — GBA / Autorité de protection des données — APD), Drukpersstraat 35, 1000 Brussels, Belgium — gegevensbeschermingsautoriteit.be.