Corporate Website Privacy Policy
Effective date: 8 October 2026 · Scope: emixana.com corporate website
1. Controller and contact
The controller for the EMIXANA corporate website is the website operator identified in the Legal Notice. Privacy enquiries and data-subject requests may be sent to [email protected]. This notice covers this corporate website and enquiries; it does not replace privacy information for the XANDER SaaS application.
2. Personal data we may process
When you contact us, we may receive your name, email address, organization, telephone number if provided, enquiry and subsequent correspondence. Website hosting and security systems may also process IP addresses, request timestamps, browser/device information and technical logs. The public contact form, where present, opens your email application; it does not itself submit information to a database hosted by this static website.
3. Purposes and legal bases
We process enquiries to respond to your request and take requested pre-contractual steps (GDPR Article 6(1)(b) where applicable), or based on legitimate interests in managing business correspondence (Article 6(1)(f)). We process security and access logs for website protection and troubleshooting based on legitimate interests (Article 6(1)(f)). Where a legal obligation requires retention or disclosure, Article 6(1)(c) may apply. Any optional tracking requiring consent must not run until consent has been obtained.
4. Recipients and service providers
Data may be accessible to authorized personnel and to actual infrastructure, email, security or professional advisers where necessary. The website currently uses Cloudflare for DNS/proxy/security and Hetzner hosting, as configured for the site. Email correspondence uses the configured mailbox provider; the provider and its processing terms should be verified in the operational register. We do not publish an invented list of subprocessors.
5. International transfers
Service providers may process or access data outside the European Economic Area depending on their configuration. Any transfer requiring safeguards must rely on a lawful mechanism, such as an applicable adequacy decision or standard contractual clauses, with supplementary measures where required. This notice does not claim that every provider processes data exclusively in the EEA.
6. Retention
Business enquiries and correspondence are retained only as long as reasonably needed to handle the enquiry, follow up a business relationship, or meet applicable legal obligations. Technical logs follow the actual hosting and security retention configuration. A fixed period is not asserted here without a verified retention schedule; you may request information about a specific record or ask for deletion where applicable.
7. Your rights
Subject to the GDPR conditions and exceptions, you may request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent where consent is the legal basis. We may ask for proportionate identity verification before acting on a request.
8. Complaints
You may complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), https://www.dataprotectionauthority.be, or another competent supervisory authority.
9. Security
We use proportionate technical and organizational protections appropriate to the website and the information involved, including HTTPS and access restrictions. No internet service can guarantee absolute security. Please do not send passwords or sensitive health records through general enquiries.
10. Changes
Material changes to this policy will be reflected on this page with an updated effective date. Effective date: 8 October 2026.
Legal basis
Regulation (EU) 2016/679, in particular Articles 5, 6, 12–22, 28, 32 and 44–49, as applicable.