This privacy policy explains how Urbiflow ("Urbiflow", "we") processes personal data when you visit this website, contact us or apply for a job. We process personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data and, for processing in Morocco, Moroccan Law no. 09-08.
1. Data controller
Urbiflow, Nijvelsesteenweg 498, 1500 Halle, Belgium — enterprise number 1013.507.864. Urbiflow is a GIEXS company.
For any question about your personal data, contact us at privacy@urbiflow.com.
2. Which data we process, why and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering contact requests | Name, email, organisation, subject, message | Legitimate interest / pre-contractual steps (art. 6.1.f and 6.1.b GDPR) | Up to 2 years after the last contact |
| Quotation and information requests (RFQ / RFI) | Name, email, phone, job title, organisation, website, country, city, subject, message, products of interest, quantity, budget, date needed and reference, as far as you provide them | Pre-contractual steps and legitimate interest (art. 6.1.b and 6.1.f GDPR) | In our customer-relationship system for as long as needed to handle the request and the commercial relationship, up to 2 years after the last contact. This website removes the data as soon as the request has been transferred to that system (a copy is kept for at most 12 months if the transfer fails) |
| Recruitment | Name, email, phone, CV and attachments, profile URL, motivation, information you share during the procedure | Pre-contractual steps (art. 6.1.b) and consent for keeping your application for future vacancies (art. 6.1.a) | Up to 12 months after the end of the procedure, unless you are hired |
| Security and operation of the website | IP address, browser data, technical logs, including the decisions of the abuse protection of the forms (time, IP address and the e-mail address entered) | Legitimate interest in securing the website (art. 6.1.f) | Maximum 6 months |
| Anonymous visit statistics | Page visited, time, language, referring website (domain only), campaign tag from the link, country, device type and browser and operating system family. The country is derived from the IP address at the moment of the visit; the IP address itself is not stored. Downloads of brochures are recorded in the same way (which brochure, time, country, the page the link was on, device type and browser family). No cookie or identifier is used, so page views cannot be linked to a person or to each other. Visits by search engines and AI assistants are counted separately | Legitimate interest in understanding how the website is used and improving it (art. 6.1.f) | Daily counts 24 months; page-view and download logs 13 months |
| Access to the administration area | Name, email, password (hashed), activity log | Legitimate interest / employment contract | Duration of the user account + 1 year |
We do not use your data for automated decision-making or profiling, and we do not sell your data.
3. Recipients
Your data is only accessible to authorised staff who need it for the purposes above. We may share data with other companies of the GIEXS group where necessary (for example for a vacancy at a group company), with IT service providers acting as processors (hosting, email, customer-relationship software) under a data processing agreement, and with authorities where required by law.
4. International transfers
Urbiflow has sites in Belgium (EU) and Morocco. Recruitment data for positions in Morocco may be accessed by our Moroccan team. Morocco is not covered by an EU adequacy decision; such transfers are therefore based on the European Commission's Standard Contractual Clauses (art. 46 GDPR) and appropriate security measures. Processing in Morocco is also subject to Law 09-08 and declared to the CNDP where required.
5. Security
We take appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), hashed passwords, role-based access control and logging of administrative actions.
6. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw your consent at any time without affecting the lawfulness of earlier processing. To exercise your rights, email privacy@urbiflow.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority:
- Belgium: Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be
- Morocco: Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) — www.cndp.ma
7. Cookies
See our cookie policy.
8. Changes
We may update this policy. The date at the top of this page shows when it was last changed.