Privacy policy

This translation is provided for information; in case of discrepancy, the French version prevails. Version of 27 October 2026. Replaces the version of 10 February 2021.

This page explains, simply, what data we receive, what we do with it and how to exercise your rights.

Who is responsible for your data?

The controller is DeepIT SRL, Rue de la Colonne 1A, 1080 Molenbeek-Saint-Jean (Brussels), Belgium, company number 0766.716.506.

For any question about your data or to exercise your rights: [email protected], or by post to the address above.

DeepIT SRL has not appointed a data protection officer: it is not required to (Article 37 of the GDPR), as its core activity is not the large-scale processing of sensitive data.

This policy covers the deepit.be website and our exchanges with visitors, prospects, customers and applicants. The DeepIT, DeepSense and DeepFlow websites belong to one and the same company and follow the same rules.

Our two roles

Controller: when you visit our website, write to us, call us, book an appointment, become a customer or apply for a job. This is what this page is about.

Processor: when we manage the IT or the installations of our customers, we may have access to the data they process, including patient data for medical and dental practices. We then act solely on their instructions, under the data processing agreement (Article 28 of the GDPR) that binds us to them. This processing is not covered by this page. To exercise your rights over that data, contact the practice or company concerned; we will help it to answer you.

What we receive, why and on what basis

For each situation: the data, the purpose, and the legal basis provided for by Article 6 of the GDPR.

You visit the website: the page viewed (its address, without parameters), the website you came from (its name only), campaign parameters (utm), the type of device (computer, mobile, tablet) and the country, inferred by Cloudflare. No cookie, no identifier, no stored IP address and no fingerprint of your browser. Purpose: to know which pages are useful. Basis: our legitimate interest (Article 6.1.f).
You fill in a form (contact, audit or quote request): the form fields (name, company, e-mail, telephone, message…), the page it was sent from, the source of your visit (for example “Google search” or a campaign), the browser type and an irreversible fingerprint of your IP address, which is used only to block abusive submissions. Purpose: to answer you and prepare an offer. Basis: pre-contractual measures taken at your request (Article 6.1.b); legitimate interest for the visit source and the fight against abuse (Article 6.1.f).
You book an appointment in our calendar: name, e-mail, telephone, chosen time slot, subject. Purpose: to organise the appointment. Basis: pre-contractual measures (Article 6.1.b).
You call us: your number, and the date and duration of the call. Calls received on our reception and support lines may be recorded, automatically transcribed and summarised, then attached to your request in our ticketing tool, in order to handle your request and keep proof of what was agreed. Basis: performance of the contract or pre-contractual measures (Article 6.1.b) and our legitimate interest in documenting requests (Article 6.1.f). The telephone greeting message announces that the call may be recorded and transcribed.
You are a customer and ask for assistance on the Support page: name, e-mail, company, description of the problem, any screenshot, urgency level. Purpose: to handle your request. Basis: performance of the contract (Article 6.1.b).
You are a customer: contact details of the contact persons, contracts, invoices, service requests, history, hardware inventory. Purpose: to provide the service and invoice it. Basis: contract (Article 6.1.b) and accounting obligations (Article 6.1.c).
You apply for a job: CV, cover letter, contact details, vacancy applied for, exchanges. Purpose: recruitment. Basis: pre-contractual measures (Article 6.1.b); your consent if we keep your application for a future vacancy (Article 6.1.a).
You are a customer and we write to you to present services similar to those you have ordered: name, position, e-mail, company. We send commercial electronic mail only to our customers and for similar services (exception under Article XII.13 of the Code of Economic Law); each message contains a free unsubscribe link. Basis: our legitimate interest (Article 6.1.f). We do not send advertising electronic mail to people who are not customers without their prior consent.

What happens to your request

Your request is recorded in the DeepIT Hub, our internal tool. A notification is sent to our [email protected] mailbox and a request is opened in our ticketing tool (Autotask) so that a team member can answer you. If your company is already known, the request is attached to its record; otherwise a prospect record may be created to follow up the exchange and prepare a proposal.

A job application stays in the Hub; only an internal notification is sent to the team.

A confirmed appointment is entered in our calendar and in Autotask, and you receive a confirmation e-mail.

Support page: we check that the address entered belongs to a known contact. If so, a confirmation link, valid for 30 minutes, is sent to that address; the ticket is opened only after you click. The e-mail does not repeat anything you wrote.

Bot protection (Cloudflare Turnstile)

To block bots that send unwanted messages, our forms use Turnstile, a Cloudflare service. The Cloudflare script loads only when you start filling in a form. Your browser then sends Cloudflare technical signals (IP address, TLS fingerprint, browser type, site key); on submission, our server sends Cloudflare the token received and your IP address to verify it.

Cloudflare acts on our behalf to detect bots. It also processes these signals on its own behalf, to improve its detection (see https://www.cloudflare.com/turnstile-privacy-policy/). It states that it cannot identify you from them. Basis: our legitimate interest in protecting the website (Article 6.1.f). Turnstile sets no cookie on our website; see the cookie policy.

No health data, no sale, no automated decision

Do not send health data through our forms. If a problem concerns patient data, describe it without attaching the data.

We do not sell your data. We do not take any automated decision producing legal effects concerning you (Article 22 of the GDPR).

Who receives your data

Only the DeepIT staff who need it have access to it. We also use suppliers (processors), bound by a contract in accordance with Article 28 of the GDPR, each for its own task. The main ones:

DeepIT Hub (forms, appointments, requests, website statistics): DeepIT tool, hosted in France by Scaleway SAS (Paris) together with its database.
Hosting of the website and tools: Scaleway SAS (France).
E-mail, calendar, files and video conferencing: Microsoft 365 (Microsoft Corporation).
Tracking of requests, customers and contracts: Autotask (Kaseya).
Website network, protection and bot protection: Cloudflare.
Telephony: 3CX and our telephone operators.
Artificial intelligence: Anthropic (Claude); depending on the project, OpenAI and ElevenLabs (transcription and voice).
For our customers, depending on the services: workstation monitoring (Datto RMM, Kaseya), backup (Redstor, Comet), technical documentation (Hudu), password vault (Keeper), backup monitoring (CheckCentral).
Accounting and payment: Horus (accounting), Twikey (SEPA direct debits), our bank and our accountant.
Ordering of hardware and licences: our distributors, for delivery and activation.

Data transfers outside the European Union

The Hub, the database and the website are hosted in France (Scaleway, Paris). Some of our suppliers are American or may process data in the United States. For each of them, here is the country, the safeguard governing the transfer and its status on 26/10/2026 (official lists consulted that day). You can obtain a copy of the safeguards (standard contractual clauses) by writing to [email protected]. The official lists are public: EU-US framework at https://www.dataprivacyframework.gov/list, standard clauses on eur-lex.europa.eu (Implementing Decision (EU) 2021/914). We do not transfer patient health data to these suppliers.

Microsoft Corporation (United States): e-mail and file data stored in the European Union (Microsoft “EU Data Boundary”), with access or processing possible from the United States. Safeguard: adequacy decision of the Commission of 10/07/2023 (EU-US framework, Microsoft Corporation certified, “active” status on dataprivacyframework.gov); failing that, standard contractual clauses of Microsoft's data protection addendum.
Cloudflare, Inc. (United States): network, protection and Turnstile bot protection; traffic passes through servers located all over the world. Safeguard: EU-US framework (Cloudflare certified; the list states “recertification under review”) and, as a fallback, standard contractual clauses of Implementing Decision (EU) 2021/914 included in its addendum (Articles 6.2 and 6.4).
Kaseya (Autotask and Datto RMM, United States): request tracking and workstation monitoring. Safeguard: EU-US framework (Kaseya US and Datto certified, “active” status). Autotask data is hosted in the European “EU1” zone.
Anthropic (United States): AI assistance (sorting requests, drafting). Anthropic is not certified under the EU-US framework. Safeguard: standard contractual clauses of Implementing Decision (EU) 2021/914 (modules 2 and 3) included in its data processing addendum. No European hosting is available through its direct offering.
OpenAI Ireland Limited (Ireland): transcription and team memory. The contract is concluded with this Irish company, which transfers the data to the OpenAI group companies in the United States on the basis of standard contractual clauses of Decision (EU) 2021/914 (modules 2 and 3) included in its data processing addendum (§4.1 and §8.1, read on 26/10/2026). OpenAI is not certified under the EU-US framework.
ElevenLabs (United States): transcription and voice of our voice assistants. Safeguard: EU-US framework (ElevenLabs certified, “active” status) and 2021/914 standard contractual clauses included in its addendum (Article 11).
Keeper Security (United States): DeepIT's password vault. Safeguard: EU-US framework (certified, “active” status).

Cookie-free audience measurement

To know which pages are read and where visitors come from, our server counts each page view from the request that your browser sends it anyway. Nothing is written to or read from your browser.

No cookie, no browser storage, no identifier: we cannot recognise you from one visit to the next.
Your IP address is used only, for one minute and in memory, to limit abuse; it is neither passed on nor kept.
Bots (search engines, AI assistants) are counted separately.
If your browser sends the Global Privacy Control or Do Not Track signal, your visit is not counted.
The details are deleted after 13 months; only anonymous totals are kept.
We use neither Google Analytics, nor an advertising pixel, nor any tool that identifies the companies visiting the website.

Artificial intelligence

We use AI tools to sort requests, transcribe calls, and prepare answers and interventions.

A DeepIT staff member reviews what is sent to you on our behalf.
We limit the personal data sent to these tools to what is strictly necessary and we do not send patient health data to them.
We use professional offerings (API access under contract), not consumer services.
An automated assistant (written or voice) tells you that it is one from the start of the exchange.

How long we keep your data

Details of pages viewed (without IP or identifier): 13 months, then anonymous totals.
Contact requests, quote requests and appointments with no follow-up: 3 years after the last exchange.
Prospects: 3 years after your last contact.
Calls: the recording and its transcript are kept for 12 months.
Customers (contracts, requests, history): term of the contract, then the applicable limitation period (up to 10 years).
Invoices and accounting documents: 7 years for books and supporting documents (Code of Economic Law, Articles III.86 and III.88) and up to 10 years for tax documents (Article 315 of the 1992 Income Tax Code).
Unsuccessful applications: 2 years after the last contact, unless you object.
At the end of the period, the data is deleted or anonymised.

Your rights

You can request access to your data, its rectification, its erasure, the restriction of processing and its portability. You can object to processing based on our legitimate interest and, without having to give reasons, to direct marketing. Where processing is based on your consent, you can withdraw it at any time.

Write to [email protected]. We reply within one month, which may be extended by two months for a complex request, in which case we tell you why. We may ask you to confirm your identity. It is free of charge, unless the request is manifestly excessive.

Security

We apply to our own systems what we do for our customers: encrypted exchanges, two-factor authentication, access limited to the people who need it, workstation protection, monitored and tested backups, passwords kept in a dedicated vault.

In the event of a personal data breach presenting a risk, we notify the Data Protection Authority within 72 hours and inform you if the risk is high (Articles 33 and 34 of the GDPR).

Complaints

You can write to us first. You can also lodge a complaint with the Data Protection Authority (APD/GBA), the supervisory authority of DeepIT SRL: Rue de la Presse 35, 1000 Brussels, +32 2 274 48 00, [email protected], www.dataprotectionauthority.be (online complaint on the APD/GBA portal). If you live in another country of the European Union, you can contact the authority of your country (Article 77 of the GDPR).

Changes

We update this policy when our processing changes. The version date appears at the top of the page. For a significant change, we announce it on the website and, for our customers, by e-mail.