legal@it-jay:~ (zsh)

status: 200 OK [GDPR compliant] // rev: 2026.1

$ cat privacy_policy.md

Privacy Policy

Principles of personal data processing and privacy protection across IT-JAY services and platforms.

$ cat 01_data_controller.json

data controller

"Section 01": Data Controller

{

"controller": "IT-JAY, Jędrzej Dec",

"address": "Hofkensweg 42, 9420 Erpe-Mere, Belgium",

"cbe_vat": "BE 0661.654.321",

"email": "info@it-jay.be"

}

$ cat 02_data_categories.json

data categories

"Section 02": What Personal Data Do We Collect and per Activity?

Because we offer a wide range of services, we collect data depending on the service you purchase.

{

"A_admin_hardware": {
"nace": "46.500, 47.400, 47.910",
"data": "First and last name, company name, address, delivery address, email, phone, VAT number, payment details",
"purpose": "Order processing, invoicing, hardware shipping, handling warranty claims"
},

"B_it_services_software": {
"nace": "62.010, 62.020, 62.030, 63.110, 63.120",
"data": "Passwords (encrypted), IP addresses, server logs, metadata, user-agent, session cookies",
"purpose": "Portal access, application protection, uptime monitoring, bug fixing"
},

"C_photography_media": {
"nace": "74.201, 74.209, 73.110",
"data": "Portrait photos, likeness, shoot location, visual characteristics",
"purpose": "Execution of assignment, retouching, delivery, IT-JAY portfolio (subject to no objection)"
},

"D_hardware_service": {
"nace": "95.290, 62.090",
"data": "Data stored on client drives/computers (no viewing or copying; strictly for recovery/backup)",
"clause": "Absolute professional secrecy and confidentiality"
},

"E_training_consulting": {
"nace": "85.592, 85.599",
"data": "Participant names, evaluation forms, certificate details, professional profile",
"purpose": "Registration, certificate issuance, training curriculum customization"
}

}

$ cat 03_legal_grounds.json

art. 6 GDPR

"Section 03": Legal Grounds for Processing

// Art. 6 General Data Protection Regulation (GDPR):
{

"01_contract_performance": "Hardware delivery, software development, photo shoots, equipment repair",

"02_legal_obligation": "Retaining invoices and accounting records for Belgian tax authorities",

"03_legitimate_interest": "Network security (IP logs), fraud prevention, B2B portfolio presentation",

"04_consent": "Optional cookies, publishing portrait photos (can be withdrawn at any time)"

}

$ cat 04_security_encryption.json

art. 32 GDPR

"Section 04": Storage, Location & Encryption

// Technical and organizational safeguards:
{

"crm_administration": "ZOHO EU Datacenters (European Economic Area), ISO 27001 and GDPR compliant",

"backups": "Google Drive with APFS volume (locally encrypted with strong key; Zero-Knowledge – no third-party access)",

"web_applications": "Encrypted authentication, hashed session cookies, protection against SQLi and session hijacking"

}

$ cat 05_retention_periods.json

data retention

"Section 05": Data Retention Periods

// Data retention depending on category:
{

"accounting_invoices": "7 years (statutory obligation under Belgian tax law)",

"server_logs_ip": "Maximum 6 months (unless retained longer due to an ongoing security incident)",

"photography_raw_files": "Finalized images: as long as portfolio is maintained; raw files (RAW): periodically deleted",

"training_data": "Up to 3 years after training completion to verify issued certificates"

}

$ cat 06_data_recipients.json

data processors

"Section 06": Sharing Data with Third Parties

// Entities with signed Data Processing Agreements (DPA):
{

"cloud_hosting": "ZOHO Corporation (CRM), Google (encrypted backup), dedicated VPS providers",

"logistics_partners": "Courier services (Bpost, PostNL) delivering hardware and physical prints",

"accounting": "External licensed accounting office managing corporate bookkeeping"

}

$ cat 07_cookies.json

cookies

"Section 07": Cookies on IT-JAY Platforms

// Platform cookie policy:
{

"essential_session_cookies": "Used exclusively for customer portal functionality (logins, form security)",

"analytical_cookies": "None – to protect your privacy, IT-JAY does not use tracking or analytics cookies",

"user_consent": "Not required for strictly technical cookies (no commercial profiling)"

}

$ cat 08_your_rights.json

user rights

"Section 08": Rights Granted Under GDPR

// Rights guaranteed under Art. 15-22 GDPR:
{

"individual_rights": [
"Right of access and obtaining a copy of data",
"Right to rectification of inaccurate or incomplete data",
"Right to erasure (right to be forgotten)",
"Right to restriction of processing and right to object",
"Right to data portability (e.g., SQL / CSV dump)"
],

"request_contact": "info@it-jay.be",

"response_time": "Within 30 calendar days"

}

$ cat 09_supervisory_authority.json

supervisory authority GBA

"Section 09": Data Protection Authority (GBA / APD)

In case of concerns regarding data processing, you have the right to lodge a complaint with the competent Belgian supervisory authority:

{

"authority": "Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD)",

"address": "Drukpersstraat 35, 1000 Brussels, Belgium",

"email": "contact@apd-gba.be",

"website": "https://www.gegevensbeschermingsautoriteit.be"

}