Privacy

Data controller

Scandalook SRL, operating under the Wintermute brand, is responsible for the processing described here. Enterprise number: 0776.698.004. Registered office: Chaussée de Wavre 1630, box 1, 1160 Auderghem, Belgium.

For questions or requests about your data: contact@wintermute.be, +32 497 20 32 02, or by post to the registered office.

Browsing the website

The site uses no analytics tools or advertising trackers. The booking form is used solely to organise appointments. The management area is restricted to Wintermute. No content from your visit is sent to an AI service. The automation examples are illustrative.

Fonts and images are served with the website, without loading them from an external font provider or image library.

Your contact enquiries

Contact links open your email application. No message is sent automatically. If you write to us, we process your email address and the information you provide: name, professional contact details, enquiry contents and any attachments. Please limit your message to the information needed.

We use this data to answer your enquiry, prepare a proposal and follow up on our exchanges. The legal basis is taking precontractual steps at your request when you are personally a party to the prospective contract (Article 6(1)(b) GDPR). For professional exchanges on behalf of an organisation and other enquiries, it is our legitimate interest in communicating with our contacts and developing our business (Article 6(1)(f)).

Contacting us is optional. Without a reply address and sufficient information about your enquiry, we cannot respond. Messages are not used for decisions with legal effects based solely on automated processing.

Recipients and email

Information is accessible to authorised people at Scandalook SRL handling your enquiry and the technical providers needed for that purpose. The contact@wintermute.be mailbox is hosted by OVHcloud (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France).

Your own email provider is also involved in sending your message. Data may be disclosed to competent authorities where legally required. It is not sold to third parties.

Retention of correspondence

Business enquiries that do not lead to an engagement are deleted no later than 12 months after the last exchange.

If an enquiry leads to an engagement, we retain the relevant information throughout the contractual relationship. Only records needed to meet legal obligations or establish, exercise or defend legal rights may then be archived with restricted access for the applicable statutory periods. Other information is deleted when it is no longer needed.

Appointments and reminders

When you book a demo, we process your name, email address, appointment date, time, format and language, plus your company and enquiry if you choose to provide them. For a demo at your offices, your complete business address is required to arrange the visit. Your name, email address and time slot are required to organise the appointment. Please avoid sensitive information in the free-text field.

These details are used to reserve your time, send confirmations and reminders, handle cancellations and prepare our conversation. The legal bases are the same as for contact enquiries: pre-contractual steps at your request (GDPR Article 6.1.b) or our legitimate interest in managing business correspondence (Article 6.1.f). Reminders are not marketing messages.

The calendar uses Firebase/Google Cloud (Firestore and server functions), and emails are sent through OVHcloud. All three sites share one calendar. Booking records are deleted no later than 12 months after the appointment date, including cancelled appointments. Application email-delivery records are deleted no later than 30 days after that date. Messages kept in the mailbox follow the retention periods for correspondence described above.

Temporary technical identifiers help prevent abuse. The private area uses a strictly necessary session cookie, __session, valid for a maximum of 8 hours. The login link is single-use and expires after 15 minutes. The cancellation link in your confirmation provides access to your appointment: do not share it.

Hosting and technical data

The website uses Firebase Hosting (Google). Firebase processes IP addresses to detect abuse and analyse hosting usage. Its documentation states that these addresses are retained for a few months. Our legitimate interest is to maintain the website’s availability and security.

Google’s infrastructure may process data outside the European Economic Area, including in the United States. Firebase’s terms provide applicable transfer mechanisms, including the EU–US Data Privacy Framework for certified entities and, where applicable, standard contractual clauses. These safeguards can be consulted through the references below.

Cookies and language preference

The website does not use advertising or audience analytics cookies. The language selector saves only your choice in your browser’s local storage, under the key wintermute-language, to remember the language you requested. This value is not sent to a third-party service.

This preference does not expire automatically: it stays in this browser until replaced or until the website’s data is cleared. You can remove it through your browser settings. Without a saved preference, the website follows your browser’s first supported language, falling back to French. An address containing /fr/, /nl/ or /en/ opens that language directly.

Your rights

Under the conditions set out in the GDPR, you may request access to your data, rectification or erasure, restriction of processing and, where applicable, data portability. You may also object, on grounds relating to your particular situation, to processing based on our legitimate interests. You may object to the use of your data for direct marketing at any time.

Send your request to contact@wintermute.be or to the registered office. We normally respond within one month. If the complexity or number of requests requires an extension, we will inform you within that period. A proportionate identity check may be necessary if there are reasonable doubts about your identity.

You may lodge a complaint with the Belgian Data Protection Authority (APD/GBA) or the supervisory authority of your habitual residence, workplace or the place of the alleged infringement. The Belgian authority’s link is provided below.

Further information

Firebase: privacy, technical data and retention

Firebase: data processing and transfer terms

Belgian Data Protection Authority: lodge a complaint (French)