Privacy policy

Last updated: 16 August 2026 — Compliant with Regulation (EU) 2016/679 (GDPR)

1. Data controller

▸ EASA srl is not required to appoint a Data Protection Officer (DPO): the activity does not fall within any of the cases set out in Article 37 GDPR. To be reassessed if the scale of processing changes.

2. Data collected and purposes

Data	Purpose	Legal basis	Retention
Email address (sign-up form)	To inform you when the group's services open	Consent (Art. 6(1)(a))	Until consent is withdrawn, or 24 months without interaction
Email, name, message content (direct contact)	To answer your enquiry	Pre-contractual measures / legitimate interest (Art. 6(1)(b) and 6(1)(f))	3 years from the last exchange
Technical server data (IP address, timestamp, user agent)	Security, abuse prevention, logging	Legitimate interest (Art. 6(1)(f))	12 months maximum

We collect no special category data within the meaning of Article 9 GDPR. No automated decision-making or profiling is carried out.

3. Cookies

▸ If Google Analytics, Meta Pixel or an equivalent tool is added later, this section must be revised and a compliant consent banner must be implemented.

4. Recipients and processors

Your data is neither sold, rented nor transferred to third parties for commercial purposes. It may be processed by the following technical providers, acting as processors within the meaning of Article 28 GDPR:

• Website host — OVH SAS, 2 rue Kellermann, 59100 Roubaix, France — VAT FR 22 424 761 419 (servers located in France, European Union)
• Email provider — [Google Workspace / other]
• Form service — [Formspree / Netlify / other]

▸ To be completed according to the providers actually selected, and to be verified: each must offer appropriate safeguards (standard contractual clauses for transfers outside the EU/EEA).

5. Transfers outside the European Union

Certain providers may process data outside the European Economic Area. Such transfers are governed by the standard contractual clauses adopted by the European Commission or by an adequacy decision.

6. Your rights

Under Articles 15 to 22 GDPR, you have the following rights:

• Access — obtain a copy of the data concerning you
• Rectification — correct inaccurate or incomplete data
• Erasure — request the deletion of your data
• Restriction — request the temporary suspension of processing
• Portability — receive your data in a structured format
• Objection — object to processing based on legitimate interest
• Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out beforehand

To exercise these rights, write to privacy@arduastra.be. We reply within one month, extendable by two months for complex requests. Proof of identity may be requested in the event of reasonable doubt.

7. Security

We implement appropriate technical and organisational measures: encryption of communications (HTTPS/TLS), two-factor authentication on administration accounts, access limited to authorised persons only, and regular backups.

8. Complaints

If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the Belgian supervisory authority:

9. Changes

This policy may be updated to reflect changes in our services or in the applicable regulations. The date of the last update appears at the top of this page.