Privacy policy

Draft document

This policy is provisional and will be reviewed by a lawyer. The company Hallfort SRL (en constitution) is being incorporated.

Until quote requests open, the quote page has no form and the site collects no requests. If you e-mail us, your address and message are received in the publisher's mailbox (Gmail, a Google service) and kept as long as needed to answer you and follow up your project. Only the technical server logs of the host keep a trace of the connection (see sections 2 and 6).

1. Data controller

Until the company is registered, the data controller is: Ash Ross, Rue du Fossé aux Loups 11, 1000 Bruxelles, ash.ross@gmail.com.

Once registered, the data controller will be Hallfort SRL (en constitution), [to be completed before launch], company number [to be completed before launch]. Contact for any question about your data: ash.ross@gmail.com.

2. The data we collect

Quote and contact forms: name, e-mail address, phone number, postal code and details of your project (type and dimensions of the building, options chosen, free message). The postal code is used to locate the site for snow and wind loads and transport.

Technical data: the site's host processes the IP address and the technical connection data needed to deliver and secure the site. We do not access it to identify you.

We do not collect sensitive data. Please do not enter any in the free fields.

3. Purposes and legal bases

Answering your request, preparing a quote and discussing it with you: pre-contractual steps taken at your request (GDPR, Article 6(1)(b)).

Performing the contract if you order (study, fabrication, delivery, assembly, after-sales): performance of a contract (Article 6(1)(b)).

Keeping our accounts and meeting our legal obligations: legal obligation (Article 6(1)(c)).

Following up requests that went no further (getting back to you about your project, finding an exchange in case of dispute), securing the site and defending our rights: legitimate interest (Article 6(1)(f)). You may object to this.

We do not send commercial prospecting without your prior consent.

4. Who receives your data

Your data is never sold. It is accessible to our team as far as necessary and to the recipients below. Our technical providers (e-mail sending, hosting) are processors bound by a contract in line with Article 28 of the GDPR. Partner fabricators and assembly crews, our advisers and the authorities process the data they receive for their own task, as separate controllers:

Sending e-mails (request notifications and replies): Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States.

Hosting of the site: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States.

Partner fabricators and assembly crews: only when you ask us to prepare a quote, and for the data needed for that preparation (contact details, address or postal code of the site, project characteristics). They will be bound to us by contract once selected and may use that data only for your project.

Our advisers (accountant, lawyer) and the authorities, where the law requires it.

5. Transfers outside the European Union

Resend and Vercel state in their published data processing agreements (vercel.com/legal/dpa and resend.com/legal/dpa, read on 24 October 2026) that their main processing operations take place in the United States. Your data may therefore be transferred outside the European Union.

Safeguards: both agreements provide for the standard contractual clauses adopted by the European Commission (decision 2021/914), an appropriate safeguard within the meaning of Article 46 of the GDPR. Resend also states that it complies with the EU-US Data Privacy Framework and holds the corresponding certification. For Vercel, that certification is not mentioned in the agreement we read: to be verified.

You may ask for information about these safeguards by writing to ash.ross@gmail.com.

6. Retention periods

Quote and contact requests that went no further: 3 years from the last contact, then erased.

Customers, accounting documents (accepted quotes, orders, invoices and other supporting documents): kept for 7 years from 1 January of the year after the books are closed, as Belgian accounting law requires (Code of economic law, Article III.88).

Customers, documents required by tax and VAT law (invoices and VAT-related documents): kept for the period that law imposes, which may be longer than the accounting period for some documents. Period to be verified by the accountant.

Other data in the customer file (exchanges, drawings, site information): kept as long as it serves to perform the contract and the guarantees, then erased. Period to be set before launch. An ongoing dispute extends the retention of the relevant documents.

Technical connection data (server logs): the host processes it to deliver and secure the site. Criteria: retention limited to what is needed for the security of the site and the analysis of incidents. The period the host applies is to be confirmed in its data processing agreement before launch. Processing the host carries out on its own account falls under its own privacy policy.

7. Your rights

You may ask for access to your data, rectification, erasure, restriction of processing, portability, and you may object to processing based on our legitimate interest (GDPR, Articles 15 to 21), by writing to ash.ross@gmail.com. We may ask you to prove your identity.

We reply within one month of receiving the request. That period may be extended by two months if the request is complex, and we will tell you (Article 12(3)).

8. Complaint to the supervisory authority

If you believe your rights are not respected, you may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données, APD), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be. The APD asks you to first exercise your rights with the controller and to wait one month before filing a complaint, except in justified cases.

You may also contact the supervisory authority of your country of residence, your place of work or the place of the infringement (Article 77).

9. Cookies and trackers

The site uses no cookies, no audience measurement tool, no advertising tracker and no third-party tracking service. No consent banner is therefore needed.

10. Security and changes

Exchanges with the site are encrypted (HTTPS). Access to requests is limited to those who need it.

We will update this policy if our practices change. The update date is shown at the top of the page. The French version prevails in case of discrepancy with the translations.