Privacy Policy

Who We Are

SCL UP ("we", "us", "our") is a consulting studio providing business analysis services.

This policy explains what personal data we collect when you use our website, why we collect it, how we use it, how long we keep it, and the rights you have under the EU/EEA General Data Protection Regulation (GDPR).

1) Data Controller

• Legal entity: SCL UP BV
• Registered address: Avenue Louise 167 B12, Brussels, Belgium
• Company number: 0774292404
• Data protection contact: info@sclup.be
• EU representative / DPO: Not required / Not appointed

2) What Data We Collect and From Where

a) Contact / RFP Form ("Let's Talk")

When you submit our contact form, we collect:

• Name (required)
• Email address (required)
• Company (required)
• Message (required)
• Attachment(s) (optional: PDF or images up to 10MB)
• Consent checkbox confirming you agree to this policy

Purpose: to respond to your enquiry, assess your request for services, prepare a proposal, and maintain records of correspondence.

Legal bases:

• Article 6(1)(b) – Contract / pre-contract steps: responding to your request, preparing a proposal
• Article 6(1)(f) – Legitimate interests: keeping basic records of business communications and activity
• Article 6(1)(a) – Consent: where explicitly indicated, e.g., you tick the consent box or opt-in to follow-ups

b) Direct Communications

If you email us directly or book a meeting via a third-party scheduling page, we process the contact details and any information you share to handle your request.

Legal bases: Article 6(1)(b) and 6(1)(f).

c) Website Operation Data

Our hosting provider may collect technical logs (e.g., IP address, timestamps, user agent, basic request data) to deliver the site and ensure security.

Legal bases: Article 6(1)(f) – our legitimate interests in running a secure website.

3) How We Use Your Data

• Respond to enquiries, provide proposals, and deliver our services
• Maintain business records, including correspondence and proposals
• Secure and operate our website (fraud prevention, abuse detection, debugging)
• Comply with legal obligations (e.g., tax, accounting)

We do not sell your data or use it for behavioural advertising.

4) Cookies & Tracking

• We do not use analytics or advertising cookies on this site.
• Essential, strictly necessary cookies (if any) may be set by our hosting or embedded services solely to provide the site or a booked meeting.
• If we introduce analytics or any non-essential cookies in the future, we will show a banner asking for your consent and update this policy.

See our Cookies Policy for more information.

5) Who Receives Your Data (Processors & Recipients)

We use reputable service providers to operate the site and handle enquiries. These include:

• Hosting/CDN: Netlify (static site hosting, security and server logs)
• Email delivery / contact form processing: Resend (delivers contact-form submissions to our mailbox at info@sclup.be)
• Email & productivity suite: Our business email inbox (info@sclup.be)
• Scheduling (if you choose to use it): A third-party booking tool you access from our site may act as an independent controller for its booking pages.

We have agreements and safeguards in place with our service providers as required by GDPR.

6) International Transfers

Some providers may process data outside the EU/EEA (e.g., the United States). Where this happens, we rely on adequacy decisions (if applicable) or the European Commission's Standard Contractual Clauses (SCCs) with additional safeguards where appropriate.

7) Data Retention

• General enquiries / proposals: kept for up to 24 months from last contact if no contract is formed, so we can follow up on prior discussions and avoid duplicate threads.
• Client/project records & contracts: retained for 7 years (or longer if required) to comply with legal, tax, and audit obligations.
• Invoices & accounting records: retained for 7 years under Belgian law.
• Attachments uploaded with contact forms: kept as part of the enquiry record under the same periods above; if clearly out of scope or sensitive beyond what's needed, we may delete them earlier.
• Technical logs: retained by hosting providers for short, security-oriented periods (typically 30–90 days), unless needed to investigate incidents.

We may keep data longer where necessary to establish, exercise, or defend legal claims.

8) Your Rights Under GDPR

You have the right to:

• Access your personal data and request a copy
• Rectify inaccurate or incomplete data
• Erase your data (where GDPR allows)
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Data portability for data you provided to us under consent or contract
• Withdraw consent at any time (where we rely on consent)

To exercise your rights, contact us at info@sclup.be. We may need to verify your identity before fulfilling your request.

You also have the right to lodge a complaint with your local Data Protection Authority (e.g., Belgium: Autorité de protection des données / Gegevensbeschermingsautoriteit).

9) Security

We implement reasonable technical and organisational measures to protect your data, including access controls, encryption in transit, and least-privilege practices with our providers. No system is 100% secure; if we discover a personal data breach that poses a risk to you, we will notify you and the relevant authority where required by law.

10) Children's Data

Our services and site are aimed at business users. We do not knowingly collect data from children under 16. If you believe a child has provided personal data, please contact us so we can delete it.

11) Links to Third Parties

Our website may link to third-party sites (e.g., scheduling pages, case-study assets). Those sites have their own privacy practices. Please review their notices when you visit them.

12) Changes to This Policy

We may update this policy from time to time. We will post any changes on this page and update the effective date above. If changes are material, we will provide additional notice where appropriate.

13) Contact Us

Questions or requests about this Policy or your personal data: