Who is responsible
The controller is Raphaël Genu, trading as UpInTown, Kerkedelle 51 boîte A, 1200 Woluwe-Saint-Lambert, company number 1034.448.184. For any question about your data: hey@upintown.dev.
Data processed and why
- Contact form. Name, email, business or website (optional), need, plan, message and how you heard about UpInTown. This data is used to answer your request and prepare a quote, at your request. It is sent by email and not stored on the server. A confirmation email is sent to you.
- Messages and calls. Emails, WhatsApp messages and calls (phone, WhatsApp, Google Meet) are used to prepare and follow your project. Calls are never recorded or transcribed.
- Clients. Business contact details, company or VAT number, files provided for the site (logo, photos, text), quotes and invoices. This data is used to perform the contract and to meet accounting and tax obligations.
- Payments. Subscriptions are paid through Stripe, which processes the payment data. UpInTown never sees your card number. Projects are paid by bank transfer: the payer's name and account then appear on the bank statement.
- Abuse protection. To limit automated form submissions, the IP address is kept in memory for 1 hour at most, without being stored. This is a legitimate interest: protecting the site.
- Visit statistics. To know which pages are read and how visitors find the site, UpInTown uses Umami, installed on its own server at Hetzner in Germany. It measures the pages viewed, the site you came from, your country and approximate city, language, device and browser type, and a few actions such as a click on a contact link or sending the form (never what you write in it). Umami sets no cookies and does not store your IP address: it is only used, with the browser type, to compute an identifier that changes every day. Your browser's "Do Not Track" setting is respected. This is a legitimate interest: understanding how the site is used in order to improve it.
What this site does not do
This site sets no cookies, uses no advertising tools and does not follow you across other sites. Apart from the statistics described above, the server keeps no log of visits. Your data is never sold or used for automated decisions.
Retention
- Requests that do not lead to a project: 12 months after the last exchange, then deleted.
- Clients: for the duration of the contract, then site files and data are deleted as described in the terms of service.
- Quotes and invoices: for the period required by Belgian accounting and VAT law.
- IP address for abuse protection: 1 hour at most, in memory.
Service providers
UpInTown uses the following providers, which process data only for the service described:
- Hetzner (Germany): website hosting
- Resend (United States): delivery of contact form messages
- Zoho (European Union): email
- Google Workspace (Ireland, possible transfers outside the EU): client file storage and video calls (Google Meet)
- WhatsApp (Ireland, possible transfers outside the EU): messages and calls
- Stripe (Ireland): monthly subscriptions, quotes and invoices
- Accountable (Belgium): invoicing and accounting
Transfers outside the European Union are covered by the safeguards provided by the GDPR (European Commission standard contractual clauses or the EU-US Data Privacy Framework).
Your rights
You can ask to access, correct, delete or port your data, to restrict its processing, or object to processing based on legitimate interest. Write to hey@upintown.dev: you will get an answer within one month.
If you believe your data is not handled properly, you can lodge a complaint with the Belgian Data Protection Authority.
Security
Accounts are protected by two-factor authentication, with a hardware key for the main services. The site is served over HTTPS, the server exposes only web ports and is updated regularly.
Client websites
For the sites and email UpInTown manages for its clients, the client is the controller and UpInTown acts as processor, under the agreement annexed to the terms of service.
