[Legal]
Privacy Policy
This site is a portfolio. It keeps no accounts, sends no newsletters and sets no tracking cookies. Here is what it does process, and why.
Last updated 28 October 2026 · gaetanbols.be · Questions: talk@gaetanbols.be
1. Who is responsible
This website, gaetanbols.be, is run by Gaetan Bols, an independent digital creative based in Antwerp, Belgium. For everything in this policy I am the data controller: the person who decides what happens with your data.
You can reach me at talk@gaetanbols.be or through the contact page.
2. What this covers
It covers what happens when you visit gaetanbols.be, when you get in touch with me through it, and when you open one of the locked case studies with an access code. It does not cover the websites this site links to, such as LinkedIn or the studios I have worked with. Those have their own policies.
3. Visiting the site
The site is hosted by Vercel. Like any web server, Vercel processes technical data to deliver the pages to your browser and keep the site secure: your IP address, the pages you request, the time of the request, and basic details about your browser and device. Vercel keeps these request logs for a short period. I do not use them to identify you. See Vercel's privacy policy.
Legal basis: my legitimate interest in running a working, secure website (article 6(1)(f) GDPR).
4. Visitor statistics
I use Vercel Web Analytics to see how the site is used: which pages are viewed, where visitors come from (the referring site and the country), and which type of browser and device they use. It works without cookies. Each visit is counted through a hash derived from your IP address and browser that cannot be turned back into either, and that hash is discarded within a day. The figures I see are aggregated: I cannot follow an individual visitor around the site, let alone across other sites. See how Vercel handles analytics data.
Legal basis: my legitimate interest in understanding how the site performs (article 6(1)(f) GDPR).
5. The weather in the footer
The footer and the menu show the current time and weather in Antwerp. The weather comes from Open-Meteo, a free weather service, and your browser requests it directly. That means Open-Meteo sees your IP address for that request, the same way any website you open does. The request contains nothing else: no page, no name, no identifier. See Open-Meteo's terms.
Legal basis: my legitimate interest (article 6(1)(f) GDPR). The weather is a small piece of the site's personality, and the request carries no more than a normal page load.
6. Getting in touch
When you use the contact form, your name, your email address, the topics you tick and your message are sent to my mailbox through Google, my email provider, and you get a short confirmation at the address you entered. The site itself stores none of it. To keep spam out, the form remembers your IP address in memory for ten minutes, to limit how many messages one connection can send; it is not written down anywhere. When you email or call me, I process what you share, usually your name, email address or phone number and your message, for one purpose: to reply and to follow up on what you asked. I keep that correspondence for as long as the conversation, and any work that comes out of it, needs it.
Legal basis: the steps needed before entering into an agreement with you (article 6(1)(b) GDPR) and my legitimate interest in answering the people who contact me (article 6(1)(f) GDPR).
7. Access to locked case studies
Some case studies are locked because they concern client work that is not public. To open them you enter an access code I have given you personally, or you follow a link that carries that code. When the code checks out, the site sets a cookie so you do not have to enter it again for thirty days. The cookie holds a scrambled version of the code, not the code itself, and nothing about you. The site keeps no record of who uses which code or when. The cookie policy has the details.
Legal basis: my legitimate interest in keeping non-public work restricted to the people it was shared with (article 6(1)(f) GDPR).
8. What the site does not do
- No accounts, no logins, no newsletter, no payments.
- No advertising, no tracking cookies, no retargeting pixels.
- No profiling and no automated decisions about you.
- Your data is never sold or passed on for marketing.
- Fonts, images and video are served from this site itself, not loaded from third parties.
- The site is not aimed at children.
9. Who else sees your data
Two companies process data on my behalf, and only for the purposes above:
- Vercel Inc.
- Hosting and visitor statistics.
- My email provider, so it stores the emails we exchange.
Open-Meteo receives your weather request directly from your browser, as described above. Beyond these, I share data only when the law requires it.
Vercel and Google are American companies. Where data leaves the European Economic Area, it is covered by the European Commission's standard contractual clauses that are part of their data processing terms.
10. How long I keep things
- Server logs
- A short period, set by Vercel, for security and troubleshooting.
- Statistics
- Aggregated figures only. The daily visitor hash is discarded within a day.
- Correspondence
- As long as our conversation, and any work that follows from it, needs it.
- Access cookie
- Thirty days from the moment it is set, or until you delete it.
11. Your rights
Under the GDPR you can ask me to:
- Tell you what data I hold about you, and give you a copy.
- Correct it if it is wrong.
- Delete it.
- Restrict or object to how I use it.
- Hand it over in a portable format.
Email me at talk@gaetanbols.be and I will get back to you within a month. There is no fee. If you are not happy with how I handle it, you can complain to the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels.
12. Security
The site is served over HTTPS only. The access cookie is marked HttpOnly, so scripts on the page cannot read it, and Secure, so it only travels over encrypted connections. Access codes are checked in a way that gives away nothing about them when a guess is wrong.
13. Changes
If the site starts doing something new with your data, this policy changes with it, and so does the date at the top of the page. Last updated 28 October 2026.
See also the Cookie Policy.