Last updated: 7 October 2026
1. Who we are
This website and the SEO consultancy services of Raf Polus are operated by RAPO BV, a private limited company (BV) under Belgian law, with registered office at Landbouwstraat 155, 1030 Schaarbeek, Belgium, enterprise number 1031.625.484 (“we”, “us”). We are the controller of the personal data described in this notice.
For any privacy question or request, contact Raf Polus at raf@rafpolus.com.
2. What this notice covers
This notice explains how we process personal data of visitors of rafpolus.com, people who contact us, and contact persons at our clients, prospects, partners and suppliers.
When we process personal data on behalf of a client as part of our services (for example a client’s sales or customer data), we act as the client’s processor under a data processing agreement. The client’s own privacy notice applies to that processing, not this one.
3. Which data we process, why, and for how long
| Situation | Data | Purpose and legal basis | How long we keep it |
| You fill in the contact form or email us | Name, email address, company, website URL, your message and our correspondence | Answering your question and discussing a possible collaboration. Legal basis: steps at your request before entering into a contract, and our legitimate interest in responding to business enquiries. | Up to 2 years after our last contact, unless the conversation leads to an engagement. We delete messages earlier when they are no longer relevant. |
| You or your company are our client or supplier | Name, job title, business contact details, contract, proposal, timesheet and invoicing data, correspondence | Preparing and performing our agreement, invoicing and accounting. Legal basis: performance of a contract, and our legal obligations under Belgian accounting and tax law. | For the duration of the collaboration and afterwards as long as needed for possible claims. Accounting and invoicing records: 10 years, as required by Belgian law. |
| Business networking and prospecting | Name, job title, company and professional contact details, typically from LinkedIn, events or referrals | Maintaining our professional network and approaching companies about our services. Legal basis: our legitimate interest in developing our business. You can object at any time. | Up to 2 years after our last contact, or until you object. |
| You visit rafpolus.com | Technical data such as IP address, browser, device and pages visited | Delivering and securing the website (server logs). Legal basis: our legitimate interest in a working, secure website. | Server logs are kept by our hosting provider for a limited period, in line with its retention policy. |
| You accept analytics cookies | Pseudonymous usage data: pages viewed, approximate location, device and browser type, traffic source | Understanding how the website is used so we can improve it, via Google Analytics 4. Legal basis: your consent, which you can withdraw at any time via the cookie settings. | 14 months after your last visit (the period restarts each time you return to the website). |
We do not sell your personal data, and we do not use it for automated decision-making or profiling with legal or similarly significant effects.
4. Cookies
Strictly necessary cookies make the website work and are placed without consent. Analytics cookies are only placed after you accept them in the cookie banner. You can change your choice at any time via the “Manage consent” tab on every page, or delete cookies in your browser settings.
| Cookie | Provider | Purpose | Duration |
| _ga | Google Analytics | Distinguishes visitors (pseudonymous ID) | 2 years |
| _ga_<ID> | Google Analytics | Keeps track of the session | 2 years |
| cmplz_* | Complianz (on our own website) | Remembers your cookie choice | 365 days |
5. Who receives your data
We only share personal data where necessary, with:
- Microsoft Ireland Operations Ltd (Microsoft 365 / Outlook): email and document storage.
- Nomeo (Belgium): website hosting.
- Google Ireland Ltd: Google Analytics, only if you accept analytics cookies.
- Other IT and software providers that support our work, including productivity and AI tools, bound by appropriate contractual safeguards.
- Our accountant, our bank, and subcontractors bound by confidentiality, where needed for the purposes above.
- Authorities, where we are legally required to.
6. Transfers outside the European Economic Area
Some of these providers, or their sub-processors, may process data outside the EEA, in particular in the United States. In that case we rely on appropriate safeguards, such as the EU-US Data Privacy Framework for certified companies or the European Commission’s Standard Contractual Clauses.
7. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to object to processing based on our legitimate interest (including prospecting), to data portability, and to withdraw your consent at any time without affecting earlier processing.
To exercise your rights, email raf@rafpolus.com. We will respond within one month. We may ask you to confirm your identity.
8. Complaints
If you believe we do not handle your data correctly, please contact us first. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be, or with the supervisory authority in your own country.
9. Security
We protect personal data with appropriate technical and organisational measures, including multi-factor authentication, encrypted devices and connections, and access limited to what is necessary.
10. Changes
We may update this notice when our practices or the law change. The date at the top shows the latest version.