Your data, clearly explained.
What data we process, why, for how long, who we share it with and what your rights are. No small print.
1. Who is responsible for your data
Exon ICT Group BV, Smederijstraat 32 Unit 15, 2960 Brecht, Belgium, company number BE 0699.934.875, is the controller for the personal data you entrust to us through this website or in the course of our services. Questions about your data go to Bjorn De Keirsmaeker, data protection contact, at bjorn@exon-ict-group.be or +32 3 663 46 56.
2. What data we process and why
Request for a free IT audit (contact form). You provide your name, office or company, e-mail address, optionally your phone number, your sector and role, and a message. We use this data to handle your request and get in touch with you. Legal basis: the steps you ask us to take before a possible contract (Article 6(1)(b) GDPR). If you apply for a job, we also process the data in your message and your CV, solely to assess your application.
Maturity scan. You answer three questions and enter your e-mail address. We keep your e-mail address, your score and the matching profile in order to send you the result and concrete tips and, if you wish, to propose an audit. Legal basis: your consent, given by entering your e-mail address, which you can withdraw at any time.
Newsletter. We occasionally send a newsletter to clients and to people who have subscribed. For this we use your name and e-mail address. Legal basis: your consent or, for existing clients, our legitimate interest in keeping you informed about our services. You can unsubscribe at the bottom of every newsletter.
Remote support (support page). You enter a session code you received from our technician. That code is not personal data. The session itself runs through ISL Online's software; what our technician sees during the session is covered by the agreement we have with your office as IT partner.
E-mail and phone. If you contact us directly, we process the data you share with us in order to reply and to deliver our services.
Client administration. If you are a client, we process the data needed for quotes, contracts, invoicing and support. Legal basis: the performance of our agreement and our legal obligations.
Technical data. To prevent abuse of the contact form, we keep an encrypted (hashed) form of your IP address for ten minutes. Our web server also keeps standard logs (IP address, timestamp, requested page, browser type) for the security and proper functioning of the website. Legal basis: our legitimate interest in a secure, working website.
3. No cookies, but anonymous visitor statistics
This website sets no cookies and uses no advertising services. For visitor statistics we use Plausible Analytics, a European service with servers in the EU that uses no cookies, stores no personal data and does not follow visitors across websites. We see how many visitors view a page and how they arrived, not who they are. Your IP address is not stored. Legal basis: our legitimate interest in knowing which information on our website is useful.
4. Who we share your data with
We do not sell your data and do not share it with third parties for their own purposes. We do rely on service providers that process data on our behalf:
- the hosting of this website, on servers in the European Union (Finland);
- Microsoft (Microsoft 365) for our e-mail and office applications, through which form and scan requests also reach us;
- Exact (Exact Online) for our client administration and accounting;
- Mailchimp (Intuit Inc., United States) for sending our newsletter;
- ISL Online for remote support;
- Plausible Insights OÜ (Estonia, servers in the EU) for anonymous visitor statistics.
The required data processing agreements are in place with these parties. We do not transfer your data outside the European Economic Area unless a provider does so with the safeguards the GDPR requires (such as the EU-US Data Privacy Framework or standard contractual clauses). We also share data where the law obliges us to.
5. How long we keep your data
- Requests and scan results: as long as needed to follow them up. If you do not become a client, we delete them no later than twelve months after our last contact.
- Client data: for the duration of the agreement and afterwards for as long as the law requires, including seven years for accounting records.
- Newsletter: until you unsubscribe.
- Job applications: up to six months after the selection has closed, unless you agree to longer retention.
- The hashed form of your IP address: ten minutes. Server logs: a few weeks at most.
6. How we protect your data
The connection to this website is encrypted (https). Requests are sent to our mail environment over a secure connection. Access to your data is limited to the staff who need it. As an IT partner, we apply to our own environment the same security measures we recommend to our clients.
7. Your rights
You have the right to access your data, to have it corrected or erased, to have processing restricted, to object to processing based on our legitimate interest, to receive your data in a common file format and to withdraw consent you have given. Send your request to bjorn@exon-ict-group.be. We reply within one month. If there is reasonable doubt about your identity, we may ask you for additional information.
If you are not satisfied with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.
8. Minors
This website is aimed at offices and businesses. We do not knowingly collect data from persons under sixteen.
9. Changes
We may update this statement. The most recent version is always on this page. Last updated: 22 September 2026.