Privacy policy

What we collect when you use this website, why we are allowed to, how long we keep it and how you get rid of it.

Last updated 28 September 2026

Who is responsible

BrandForge is the trade name of Arne Van Daele, a branding and web development studio based in Blankenberge, Belgium. We are the data controller for everything described on this page.

Registered name: Arne Van Daele
Address: Limburg Stirumstraat 33B, 8370 Blankenberge
Company number: 0719.679.721
VAT: BE0719.679.721
Email: hello@brandforge.be
Phone: +32 496 02 25 73

We are not required to appoint a data protection officer and have not appointed one. Write to the email address above and it reaches the person who makes these decisions.

What this covers

This page covers this website, the enquiries sent through it, and the client portal that clients sign in to. Work we do for you as a client is covered by the agreement we sign, which sets out separately how we handle anything you give us access to.

What we collect, and why

Everything below is collected because you sent it or because serving the page requires it. There is nothing else.

What	Why	Legal basis	Kept for
The enquiry form: your name, email address, and optionally your company and when you would like to start, plus the message you write.	To read your enquiry and answer it.	Steps taken at your request before entering into a contract, and our legitimate interest in replying to people who contact us (GDPR Article 6(1)(b) and 6(1)(f)).	24 months after our last contact about it, then deleted.
Anti-spam signals attached to that form: your IP address, your browser's user agent string, how long the form took to fill in, and two checks on what you sent — whether the message is mostly links, and whether the domain of your email address accepts mail at all.	To tell a person from a bot without putting a puzzle in front of you. Stored rather than only checked, so that if we wrongly flag a real enquiry we can find it and read it instead of losing it.	Our legitimate interest in keeping the form usable (Article 6(1)(f)).	12 months.
How you arrived, attached to that form: any campaign parameters in the link you clicked (utm_source and similar, or an advertising click identifier), the domain of the site that linked you, the first page you landed on, and whether you opened the form from one of the tools on this site: the service picker, a calculator, the website check, the positioning check or the logo preview.	To know which advertising, referrals and parts of the site actually produce enquiries, so money is not spent on guesses. The domain only, never the full address of the page you came from, and of the tool only which one it was — not what you entered in it. Nothing that identifies you personally.	Our legitimate interest in knowing whether our own advertising and website work (Article 6(1)(f)).	24 months, alongside the enquiry it belongs to.
A job application, from a vacancy or the open application form: your name, email address, optionally your phone number and a link (portfolio, LinkedIn or similar), what you write, and your CV if you add one. The same anti-spam signals as the enquiry form are used to check it, but not kept with it.	To consider your application, and to come back to you if a role that suits you opens later. Your CV is stored where only we can reach it, and is never published.	Steps taken at your request before entering into an employment contract (Article 6(1)(b)), and our legitimate interest in being able to contact suitable candidates for a later opening (Article 6(1)(f)).	12 months after it arrives, then deleted together with your CV. Ask by email and we delete it sooner.
A call you book on this site: the time you picked, your name, email address, phone number when you want to be called, optionally your company and what the call is about, and how you arrived, as described for the enquiry form. The same anti-spam signals as the enquiry form are used to check it, but not kept with it.	To have the call, to send you the appointment and a link to move or cancel it, and to know which parts of the site lead to a conversation.	Steps taken at your request before entering into a contract (Article 6(1)(b)), and our legitimate interest in knowing whether our own advertising and website work (Article 6(1)(f)).	24 months after the call, then deleted.
A line you check with the positioning check on the brand strategy page: the text and the market you typed. Nothing else, and not linked to you.	To assess it and show you the result. It is sent to Anthropic, our AI provider, to be read.	Our legitimate interest in offering the tool you chose to use (Article 6(1)(f)).	Not stored by us. Held in the server's memory for up to 24 hours so the same line is not assessed twice, then gone.
Server logs: the address requested, the time, the response, your IP address and your user agent.	To keep the site up and to investigate faults and abuse.	Our legitimate interest in security and availability (Article 6(1)(f)).	Per our hosting provider's retention, currently Hetzner.
Email you send us, and our replies.	To have the conversation you started.	The same basis as the enquiry itself.	As long as the working relationship, then per our bookkeeping obligations where an invoice was issued (seven years under Belgian law).
Your portal account: your name, email address and role, plus your password — never as you type it, but as a scrypt derivation it cannot be worked back from. Alongside it, when the account was created and when you last signed in. Before the account exists there is an invitation holding your name and email address.	To give you access to your own projects and documents, and to know who is looking.	Performance of our contract (Article 6(1)(b))	As long as your account exists. An unused invitation expires after seven days. When the working relationship ends we delete the account on your request, and otherwise when we clear out the rest of the file.
A comment you leave in the portal about a finished project: your words, your name, optionally your role and your company, and whether you gave permission to publish them.	To know how it went. If you gave permission, we may put the comment on this website’s homepage with your name, role and company — possibly shortened or translated, but never changed in substance. Without permission, only we read it.	Your consent (Article 6(1)(a)) for the publication, and our legitimate interest in learning from our work (Article 6(1)(f)) for the rest	As long as your account exists. You can withdraw your permission at any time by email, and we take the comment off the website straight away.
Your sign-in sessions: your IP address, your browser’s user agent, and when the session started and was last used.	To keep you signed in without logging in again on every page, and so that it is possible to see whether someone other than you is in your account.	Performance of our contract (Article 6(1)(b)), and our legitimate interest in the security of the portal (Article 6(1)(f))	14 days, or until you sign out.
The portal’s log: which action happened when, by which email address and from which IP address. Failed sign-in attempts too, with the address that was typed — never the password.	To be able to establish who did what, and to notice when someone is working through passwords.	Our legitimate interest in the security of the portal (Article 6(1)(f))	24 months.

What we do not do

Worth stating plainly, because most sites you visit do the opposite:

Visitor statistics, from software we run ourselves on our own subdomain. It records the page viewed, the site that linked you, your country and whether you are on a phone or a desktop. It sets no cookie and stores nothing on your device. Your IP address and browser string are combined into a one-way hash that changes daily, so returning visits can be counted within a day without either being stored or you being identified. No other company receives any of it, because no other company is involved. Legitimate interest in knowing whether the site works (Article 6(1)(f)), kept for 12 months.
No advertising or tracking pixels, no Meta pixel, no LinkedIn tag, no remarketing.
No profiling, no scoring, and no decisions about you made automatically.
No newsletter, and no adding you to a list because you sent an enquiry.
We never sell your data and never share it for anyone else's marketing.

Who else can see it

Only the suppliers we need in order to run the site and reply to you. They act on our instructions and cannot use your data for their own purposes.

Hosting: Hetzner — runs the server and therefore holds the database and the logs.
Email: Our mail provider, which carries the message when we reply to you.
AI: Anthropic, for the positioning check only: the line and market you typed there are sent to it to be assessed. It acts as our processor under its commercial terms, which do not let it train its models on what it receives.

One exception, and only with your own permission: a comment you gave us to publish appears on the homepage with your name, role and company, where anyone can read it.

We hand data to authorities only where the law actually requires it, and not on a request that has no legal force behind it.

Where it is stored

On servers in the European Economic Area, with no exception. Nothing on this site is loaded from anywhere else, so no personal data leaves the EEA at all — there is no transfer for us to justify and none for you to take our word about.

Your rights

Under the GDPR you can ask us to:

give you a copy of what we hold about you,
correct it if it is wrong,
delete it,
stop or limit what we do with it,
object to us relying on legitimate interest, in which case we stop unless we can show a reason that outweighs your objection,
send it to you or to someone else in a portable format.

Email hello@brandforge.be and say what you want. We do not charge for this and we will reply within one month. We may ask you something to confirm you are who you say you are, but never more than we need for that.

If you are not satisfied

Tell us first, because most of this is a misunderstanding we can fix. If that goes nowhere you have the right to complain to the Belgian supervisory authority:

Authority: Gegevensbeschermingsautoriteit / Autorité de protection des données
Address: Drukpersstraat 35, 1000 Brussels
Phone: +32 (0)2 274 48 00
Email: contact@apd-gba.be
Web: www.gegevensbeschermingsautoriteit.be

Changes to this page

If what we do changes, this page changes first and the date at the top moves. We do not quietly widen what we collect and update the policy afterwards.