Your data, clearly explained.

1. Who is responsible for your data

Exon ICT Group BV, Smederijstraat 32 Unit 15, 2960 Brecht, Belgium, company number BE 0699.934.875, is the controller for the personal data you entrust to us through this website or in the course of our services. Questions about your data go to Bjorn De Keirsmaeker, data protection contact, at bjorn@exon-ict-group.be or +32 3 663 46 56.

2. What data we process and why

Request for a free IT audit (contact form). You provide your name, office or company, e-mail address, optionally your phone number, your sector and role, and a message. We use this data to handle your request and get in touch with you. Legal basis: the steps you ask us to take before a possible contract (Article 6(1)(b) GDPR). If you apply for a job, we also process the data in your message and your CV, solely to assess your application.

Your website visit with your request. When you submit the form or the maturity scan, we add to your request which pages you viewed on our website that day and for how long, how you arrived on the website (for example through a search engine, LinkedIn or an e-mail from us) and, if known, the organisation behind the network (see point 3). Your request thus reaches our customer management system with that context, so that we can give you a relevant answer. This only concerns that single day's visit: we do not follow you across several days. Job applications are not included. Legal basis: our legitimate interest in following up your request properly.

Maturity scan. You answer three questions and enter your e-mail address. We keep your e-mail address, your score and the matching profile in order to send you the result and concrete tips and, if you wish, to propose an audit. Legal basis: your consent, given by entering your e-mail address, which you can withdraw at any time.

Newsletter. We occasionally send a newsletter to clients and to people who have subscribed. For this we use your name and e-mail address. Legal basis: your consent or, for existing clients, our legitimate interest in keeping you informed about our services. You can unsubscribe at the bottom of every newsletter.

Remote support (support page). You enter a session code you received from our technician. That code is not personal data. The session itself runs through ISL Online's software; what our technician sees during the session is covered by the agreement we have with your office as IT partner.

E-mail and phone. If you contact us directly, we process the data you share with us in order to reply and to deliver our services.

Client administration. If you are a client, we process the data needed for quotes, contracts, invoicing and support. Legal basis: the performance of our agreement and our legal obligations.

Technical data. To prevent abuse of the contact form, we keep an encrypted (hashed) form of your IP address for ten minutes. Our web server also keeps standard logs (IP address, timestamp, requested page, browser type) for the security and proper functioning of the website. Legal basis: our legitimate interest in a secure, working website.

3. No cookies, but visitor statistics

This website sets no cookies and uses no advertising services. We measure visits ourselves, on our own server, without an external analytics service. For each page viewed we record the page, the website you came from, any campaign codes in the link, the type of device and browser, your device's time zone and how long the page stayed open. To count the visitors of a single day, we derive a code from your IP address and browser data using a key that changes every day and is then erased. Your IP address itself is not stored, and this code does not allow us to recognise you from one day to the next or to identify you. We see how many visitors view a page and how they arrived, not who they are. Links in our e-mails contain a campaign code per mailing, not per recipient: we see how many visitors a mailing brought in, not who clicked. We keep these statistics for at most 25 months. Legal basis: our legitimate interest in knowing which information on our website is useful.

Organisation behind the network. On your first page view of the day, we look up your IP address once in the public register of RIPE NCC (Amsterdam), the body that registers IP addresses in Europe. If the network you are browsing from is registered in the name of an organisation, we record that organisation's name with your visit. If you browse through an ordinary internet provider (at home, on mobile or from a small office), we only record the name of that provider. We never use the names of contact persons from the register, do not store your IP address and do not link the organisation name to any other data about you. This shows us what kind of organisations consult our information. The organisation name is removed from the visit after twelve months. Legal basis: our legitimate interest in tailoring our services to the organisations that show interest. You can object to this via bjorn@exon-ict-group.be; we will then no longer record your organisation.

4. Who we share your data with

We do not sell your data and do not share it with third parties for their own purposes. We do rely on service providers that process data on our behalf:

• the hosting of this website, on servers in the European Union (Finland);
• Microsoft (Microsoft 365) for our e-mail and office applications, through which form and scan requests also reach us;
• Exact (Exact Online) for our client administration and accounting;
• Hetzner Online (Germany) for hosting our own customer management system, which also receives your requests;
• Mailchimp (Intuit Inc., United States) for sending our newsletter;
• ISL Online for remote support.

The required data processing agreements are in place with these parties. We do not transfer your data outside the European Economic Area unless a provider does so with the safeguards the GDPR requires (such as the EU-US Data Privacy Framework or standard contractual clauses). We also share data where the law obliges us to.

5. How long we keep your data

• Requests and scan results: as long as needed to follow them up. If you do not become a client, we delete them no later than twelve months after our last contact.
• Client data: for the duration of the agreement and afterwards for as long as the law requires, including seven years for accounting records.
• Newsletter: until you unsubscribe.
• Job applications: up to six months after the selection has closed, unless you agree to longer retention.
• The hashed form of your IP address: ten minutes. Server logs: a few weeks at most.

6. How we protect your data

The connection to this website is encrypted (https). Requests are sent to our mail environment over a secure connection. Access to your data is limited to the staff who need it. As an IT partner, we apply to our own environment the same security measures we recommend to our clients.

7. Your rights

You have the right to access your data, to have it corrected or erased, to have processing restricted, to object to processing based on our legitimate interest, to receive your data in a common file format and to withdraw consent you have given. Send your request to bjorn@exon-ict-group.be. We reply within one month. If there is reasonable doubt about your identity, we may ask you for additional information.

If you are not satisfied with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.

8. Minors

This website is aimed at offices and businesses. We do not knowingly collect data from persons under sixteen.

9. Changes

We may update this statement. The most recent version is always on this page. Last updated: 26 October 2026.