Privacy policy

Who is responsible for your data

IZK Agency is not yet incorporated. The data controllers are its three founders, Imran Hamdouchi Samadi, Zakaria El Moudni and Kevin Heirman, who run the web studio in their own names from Brussels. This section will be completed once the company is registered.

We have not appointed a data protection officer: the law does not require one for an organisation of our size that does not process sensitive data at scale. For any question, write to us at the address at the bottom of this page: the person who answers you is the person who handles your data.

The data collected

The contact form: your name, your email address, the kind of project, your message and the language of the page you write from (so we can reply in that language). Name, email and message are required: without them we cannot reply. Nothing else is asked. The contact service also sends a confirmation email to the address you gave, and does not keep that address beyond sending it.

WhatsApp: if you choose to write to us on WhatsApp, we receive your phone number, your profile name and your messages. The service is provided by WhatsApp (Meta group), which processes this data under its own privacy policy.

Server logs: like any web server, the one hosting this site records each request in a technical log: IP address, date and time, page requested, browser used and referring page. These logs are used only for security and for diagnosing failures.

Spam protection: when the form is sent, the IP address is kept in the contact service’s memory for a few minutes to detect submissions sent too close together. It is never written to disk and disappears on its own. To stop one address from receiving repeated confirmations, the service also keeps in memory, for one hour, a non-reversible fingerprint of the email address (not the address itself), never written to disk.

Audience measurement: the site’s pages (demos excluded) load Cloudflare Web Analytics, see the cookies section. Your browser contacts a Cloudflare server for this, so its IP address is sent to Cloudflare.

Visit statistics, only if you accept them: Google Analytics 4 records a pseudonymous identifier kept in a cookie, the pages viewed, the length and path of the visit, the referring site, the device type, the browser and an approximate location derived from the IP address. Google Analytics 4 does not store the IP address itself.

This site uses no advertising tool and no social network pixel.

This site has no user accounts. Fonts are hosted on our own server: your browser does not contact Google or any other third party to display them.

Why, and on what legal basis

Answering your request and preparing a possible quote: the legal basis is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). If a project is signed, performance of the contract takes over.

Keeping the site secure (server logs, spam protection): the legal basis is our legitimate interest in protecting the site and the form against abuse (Article 6(1)(f) GDPR). This interest does not override your rights: the data is minimal and kept for a very short time.

Knowing whether the site is being read (anonymous audience measurement): the legal basis is our legitimate interest in knowing how much our site is visited (Article 6(1)(f) GDPR).

Measuring traffic to the site and how well our advertising works, with the tools listed on the Cookies page: the legal basis is your consent (Article 6(1)(a) GDPR, and the Belgian Electronic Communications Act for cookies), given category by category in the cookie banner. You can withdraw it at any time through ‘Manage cookies’, at the bottom of every page, without affecting what was done before.

Your data is used for nothing else: no marketing, no newsletter, no resale, no profiling. No automated decision is made about you.

For how long

Contact messages and the exchange that follows (email or WhatsApp): 3 years after our last exchange if no project comes of it. If a project is signed, for the duration of the collaboration, then for as long as Belgian accounting and tax rules require for the documents they cover (quotes, invoices).

Server logs: 14 days, then deleted automatically.

IP address for spam protection: a few minutes, in memory only.

Email address fingerprint for abuse protection: one hour, in memory only.

Your cookie choice: 6 months, in your browser, after which you are asked again.

Google Analytics data: 2 months at Google, then deleted automatically. Measurement cookies: 13 months at most.

You can ask us to delete your messages before these periods end, at any time.

Who receives your data

Your data is never sold or rented. Only the founders of IZK Agency read it, and technical providers process it on our behalf, each limited to its role:

Hetzner Online GmbH (Germany) hosts the site and its logs, on servers located in Germany.

Resend (United States) delivers the form’s messages by email, along with the confirmation email sent to the address you gave. Resend is certified under the EU-US Data Privacy Framework and also applies the European Commission’s standard contractual clauses.

ImprovMX (United States) forwards emails sent to izk.agency to our inbox. It states that it processes data in the United States and in Europe. It is not certified under the Data Privacy Framework: transfers rely on the European Commission’s standard contractual clauses, incorporated into its data processing agreement.

Google (Gmail) hosts the inbox where your messages arrive. Google is certified under the EU-US Data Privacy Framework and applies the standard contractual clauses.

Cloudflare, Inc. (United States) measures the site’s audience with Cloudflare Web Analytics, without cookies: see the cookies section. Cloudflare is certified under the EU-US Data Privacy Framework.

Google Ireland Limited and Google LLC (United States) measure traffic to the site with Google Analytics 4, if you accept it, as processors.

For Resend, ImprovMX, Google and Cloudflare, transfers to the United States rely on these mechanisms, recognised by the GDPR (Articles 45 and 46). The EU-US Data Privacy Framework was upheld by the General Court of the European Union in September 2025; an appeal is pending before the Court of Justice, which is why the standard contractual clauses serve as a safety net. You can ask us for the details of these safeguards.

Cookies and browser storage

This site sets statistics or marketing cookies only with your consent, given in the cookie banner; until then, your browser contacts none of these services. The details, cookie by cookie (name, provider, purpose, duration), are on the Cookies page. You can change your mind at any time through ‘Manage cookies’, at the bottom of every page.

Your choice is kept in the browser’s local storage (localStorage), with its date and the version of this policy, for 6 months.

It uses the browser’s session storage (sessionStorage) for three things that involve no personal data: remembering that the opening animation has already played, so it does not replay on every page, remembering that you closed the floating contact window, and simulating a shopping cart on the demo pages. This information stays on your device, is never sent anywhere and disappears when you close the tab.

A single demo, the healthcare one, offers to enlarge the text. If you use that button, the setting is kept in the browser’s local storage (localStorage) so it is applied again on your next visit to that demo. It contains no personal data, stays on your device, is never sent anywhere, and is erased when you clear the site’s data in your browser.

The site’s pages (demos excluded) load Cloudflare Web Analytics, an audience measurement tool designed to use no cookie, store nothing in your browser and not track you from one site to another. It counts page views and visitors, with the page viewed, the referring site, the country, the browser and the device type. It only tells us whether the site is being read, never who you are.

Security

The site is served over HTTPS only: what you send is encrypted between your browser and our server. The form is checked on the server, protected against bursts of submissions, and messages are not stored in any database on the server: they go straight out by email.

In the event of a data breach likely to put you at risk, we will notify the Data Protection Authority within 72 hours and, if the risk is high, inform you directly.

Your rights

The GDPR gives you the following rights over your data, which you can exercise free of charge by writing to us:

Access: find out whether we hold data about you and receive a copy.

Rectification: have inaccurate or incomplete data corrected.

Erasure: have your data deleted, unless the law requires us to keep it (an invoice, for example).

Restriction: have the use of your data frozen while a dispute is checked.

Portability: receive the data you gave us in a common format, or have it sent to someone else.

Objection: object to processing based on our legitimate interest; we stop unless there are compelling grounds, such as defending against an attack.

Withdrawal of consent: withdraw the consent you gave for cookies at any time, through ‘Manage cookies’ at the bottom of every page, as easily as you gave it.

We reply within one month, extendable by two months for a complex request (we will tell you if so). If we have reasonable doubt about your identity, we may ask you to confirm it, only to avoid disclosing your data to someone else.

Lodging a complaint

If you believe we are not respecting your rights, you can lodge a complaint with the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, contact@apd-gba.be. You may also go to the courts. We invite you to write to us first: most questions are settled faster directly.

Changes

This page is updated whenever what the site does changes (new provider, new tool, the company being registered). The date at the top shows the latest version.