Short version: we use your details to talk to you, to work for you and to invoice you. We don't sell them, this website runs no analytics, and you can ask to see or delete what we have at any time.
1. Who we are
| What | Detail |
|---|---|
| Controller | Digi Duck AI |
| Run by | Iliace Vermeulen, sole trader (eenmanszaak) |
| Enterprise number | BE 1023.452.443 |
| Registered address | Lindestraat 93, 2880 Bornem, Belgium |
| VAT | exempt from VAT under art. 56bis of the Belgian VAT Code |
| Privacy questions | iliacevermeulen@digiduckai.com |
Digi Duck AI is a one-person business. Where this statement says "we", it means Iliace Vermeulen. There is no separate data protection officer, and you don't need one: email the address above and a person answers.
2. Who this is about
This statement covers people who visit this website, people who book a call or email us, people at businesses we contact first, and our clients and the people we work with there.
It does not cover your customers' data running through a system we build for you. For that data you are the controller and we are the processor, and it is set out in the data processing agreement we sign before anything goes live. The governance page explains how that works.
3. What we collect, why, and on what legal basis
Visiting this website
- What: the technical data your browser sends with every request: IP address, browser type, the page asked for, the time.
- Why: to deliver the page and keep the site secure.
- Legal basis: legitimate interest (article 6(1)(f) GDPR). A web page cannot be delivered without it.
This website runs no analytics, no advertising pixels and no tracking, and stores nothing on your device. The cookie policy lists the few moments where a third party is involved.
Booking a call
The booking calendar on Book a Call is Google's appointment scheduling. When you book, you give us your first and last name, email address, phone number, business name, website, trade, team size and a monthly revenue range.
- Why: to prepare the call, and to know before the call whether we can help, so your twenty minutes aren't wasted.
- Legal basis: steps taken at your request before entering into a contract (article 6(1)(b) GDPR).
Emailing us
- What: your name, email address and whatever you write.
- Why: to answer you.
- Legal basis: legitimate interest (article 6(1)(f) GDPR), or steps before a contract when you ask about working together (article 6(1)(b) GDPR).
When we contact you first
We look for appointment-driven service businesses in Belgium that could use what we build. For that we use publicly available business information (company websites, public company registers, business listings, company pages on social networks) and a business data provider, Apollo.
- What: company name, sector, location, a size indication, website, public business contact details, and where available the name and role of the person running the business.
- Why: to judge whether a business fits, and to send one relevant first message.
- Legal basis: legitimate interest (article 6(1)(f) GDPR). Our interest is finding clients for a service businesses can actually use. We keep it proportionate: business context only, one first message, and we stop the moment you ask.
- Email: we send unsolicited first-contact emails only to general company addresses, such as info@ or contact@. Belgian law (Royal Decree of 4 April 2003) does not allow unsolicited commercial email to addresses of individual people, including name.surname@company addresses, without prior consent, and we don't send those.
- Every commercial email tells you how to object, and objecting takes one reply.
- Where we found you: if you ask, we tell you exactly where your details came from.
Working together
- What: the contact details of the people we work with, company details, the agreement, project communication, invoices and payment details.
- Why: to deliver the work, to invoice it, and to meet our accounting and tax obligations.
- Legal basis: performance of a contract (article 6(1)(b) GDPR) and legal obligation (article 6(1)(c) GDPR).
Case studies and references
We only name you, your business or your results in public with your prior written consent (article 6(1)(a) GDPR). You can withdraw that consent for future use at any time.
Social media
If you send us a message on LinkedIn, Instagram or TikTok, that platform also processes your data under its own privacy policy. We use what you send only to reply to you.
4. Who else sees your data
We don't sell your data, and we don't share it with anyone for their own marketing. These services process data on our behalf, each under its own data processing terms:
| Service | What we use it for | What it sees | Where |
|---|---|---|---|
| Google (Google Workspace, Google Calendar) | business email, calendar, the booking page, Google Meet | booking details, email, meeting invitations | Google Ireland Ltd; transfers to the US rely on the EU-US Data Privacy Framework |
| Vercel Inc. | hosting this website | technical request data | USA, certified under the EU-US Data Privacy Framework |
| Anthropic PBC (Claude) | AI assistance with research and drafting. A person reads and decides everything that goes out | business information on prospects, and the drafts we write about them | USA. Today this runs on a Claude subscription under Anthropic's consumer terms, with the setting that allows conversations to be used for model training switched off. Anything involving a client's own data, or their customers' data, runs on the Anthropic API under Anthropic's commercial terms with a data processing agreement - agreed before that build goes live |
| Apollo (ZenLeads Inc.) | business contact data for prospecting | business information on prospects | USA, certified under the EU-US Data Privacy Framework |
| Accountable (Accountable SA, Brussels, Belgium) | invoicing and bookkeeping | client company details, invoices | Belgium |
| Stripe | payments from clients | company details, invoice amounts, payment details | Stripe Payments Europe, Ltd. (Ireland); transfers to the US under the EU-US Data Privacy Framework |
Where the law requires it, for example towards the tax authorities, we pass on what is legally required and nothing more.
5. How long we keep it
| Data | How long |
|---|---|
| Technical request data | held by our hosting provider for operating and securing the site; we don't export or keep it |
| Booking details and emails, if we don't start working together | 12 months after our last contact, then deleted |
| Prospecting data, no reply | 12 months after the first message, then deleted |
| Prospecting data, you objected | deleted straight away, except your email address or company name and the date, kept on a do-not-contact list so we never contact you again |
| Agreements and project communication with clients | for the duration of the engagement, then 10 years, the limitation period for contractual claims in Belgium |
| Invoices and accounting records | 10 years, as Belgian accounting and tax law requires |
| Consent for a case study | until you withdraw it |
6. Transfers outside the European Economic Area
Some of the services above are based in the United States. Those transfers rely on the EU-US Data Privacy Framework (Google, Vercel, Apollo, Stripe) or on the safeguards in the terms that apply to our own account (Anthropic). Ask us and we point you to the document that applies.
7. How we protect it
- One person has access: Iliace Vermeulen. There are no employees with access to this data.
- Business accounts, not personal ones: email, calendar and invoicing run on dedicated business accounts. Prospect lists are kept as working files on our own computer.
- The AI assistants we use cannot send email, delete data or publish anything. They prepare research and drafts; a person decides what happens with them.
- Nothing on this website tracks you.
- No borrowed badges: we don't hold certifications such as ISO 27001 or SOC 2, and we don't suggest otherwise.
8. Your rights
You have the right to access the data we hold about you, to have it corrected, to have it deleted, to restrict its use, to object to its use (always, and without giving a reason, when it is used for direct marketing), to receive it in a portable format, and to withdraw consent you gave.
Email iliacevermeulen@digiduckai.com. It costs nothing. We answer within one month; if we need longer we tell you why within that month. If we can't be sure the request comes from you, we may ask you to confirm who you are.
9. Complaints
You can come to us first, but you don't have to. You can always file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.
10. Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects. AI helps us research and draft; a person decides whom to contact and what to send.
11. Changes
The version and date at the top show which version applies. When something material changes, we say so on this page, and we tell clients by email.