Privacy policy
The data we process, why, for how long, and how to exercise your rights.
Last updated: October 2026
Data controller
Nexa Smart Solutions SRL, Avenue Huart Hamoir 48, 1030 Schaerbeek, Belgium — CBE 0803.888.884. Contact: info@nexa-smart.be.
Data processed and purposes
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form | Name, organisation, email, phone (optional), subject, message, BACS summary if you attach it; hashed fingerprint of the IP address, kept for one hour to prevent abuse | Answer your request | Pre-contractual measures or legitimate interest (Art. 6.1.b and f GDPR) |
| BACS Qualifier | Your answers to the questionnaire | Compute your report, in your browser only: nothing is sent unless you attach it to a message | No transfer |
| Client area and NexaInsights | Credentials, second factor, connection logs (IP address, browser, date), technical data from the equipment in your building | Provide and secure the service | Performance of the contract and legitimate interest (Art. 6.1.b and f) |
| Audience measurement | Pages viewed, technical browsing data | Improve the site | Your consent (Art. 6.1.a), only if you accept |
| Job applications | CV, cover letter, contact details | Review your application | Pre-contractual measures (Art. 6.1.b) |
Retention periods
- Contact requests: 3 years after the last exchange, if they do not lead to a contract.
- Clients: for the duration of the contractual relationship, then 10 years for invoices and accounting records (legal obligation).
- IP address fingerprint (form protection): 1 hour.
- Client area connection logs: 90 days, for security purposes.
- Unsuccessful applications: 1 year after the end of the recruitment process, unless you agree to a longer period.
- Audience measurement: 13 months at most, only if you accept.
- Your cookie choices: 6 months.
Recipients and processors
Your data is reserved for Nexa Smart Solutions. It is neither sold nor rented.
- Hostinger International Ltd. (Cyprus): website hosting.
- Brevo (France): delivery of contact form messages to Nexa.
- Cloudflare, Inc.: security, bot protection (Turnstile) and traffic routing.
- Google Ireland Ltd.: fonts (Google Fonts).
- TWKL Venture (Belgium): audience measurement, developed and run for Nexa, only if you accept.
Some providers may process data outside the European Union. Such transfers rely on an adequacy decision (EU – US Data Privacy Framework) or on standard contractual clauses.
Security
Static site over HTTPS, without a database. Forms protected against bots. Messages sent by email, not stored on the site. Client area protected by two-factor authentication.
Your rights
You may at any time request access to your data, its rectification or erasure, restrict or object to its processing, request its portability and withdraw your consent.
Write to us at info@nexa-smart.be stating your request. We reply within one month.
Complaints
You may lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.
Updates
This policy may change. The date of the last update is shown at the top of the page.