Privacy and legal notice
This notice explains what personal data we collect through gectiv.com, why we collect it, and what you can ask us to do with it. We collect only what we need to run the site and to answer you, and we never sell your data.
Who we are
This site is published by Jaivin Sham, under the name Gectiv, in Belgium. We are responsible for the personal data described here (the “data controller” under the GDPR). You can reach us at info@gectiv.com. We have not appointed a data protection officer, as the law does not require one for our activities.
A company is being set up to carry the business. Once it is registered, its legal name, registered office, enterprise number and VAT number will appear here, and the company will become the data controller.
Which law applies
We are established in Belgium, so the EU General Data Protection Regulation (GDPR) and the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data apply to everything described on this page.
What we collect and why
When you visit the site
Like any website, gectiv.com receives some technical information every time a page is requested: your IP address, your browser and device type, the page you asked for, and the date and time. This is handled by Cloudflare, which hosts the site and protects it against attacks and abuse. We do not keep a copy of it.
- Why
- To deliver the site and keep it secure.
- Legal basis
- Our legitimate interest in running a secure website (GDPR art. 6(1)(f)).
- How long
- As set by Cloudflare’s log retention.
Visit statistics
We use Cloudflare Web Analytics to see which pages are read and how quickly they load. It records the page, the referring site, browser, operating system, country and loading time. It uses no cookies and builds no profile of you. Your IP address reaches Cloudflare with the request, but it is not used for the statistics, and we only ever see totals.
- Why
- To understand which content is useful and whether the site performs well.
- Legal basis
- Legitimate interest (art. 6(1)(f)).
- How long
- We see aggregated figures only, never an individual visitor.
When you contact us
If you use the contact form, we receive your name, business email, organisation if you give it, the topic you choose and your message. The form also runs a quick bot check, described below, and passes your message to our mailbox through a small Cloudflare function that does not store it. If you email us directly, we receive whatever your email contains.
- Why
- To reply to you and, if you ask, to prepare a scoping call.
- Legal basis
- Steps taken at your request before a possible contract (art. 6(1)(b)) or, for general questions, our legitimate interest in answering you (art. 6(1)(f)).
- How long
- Up to 12 months after our last exchange, unless an engagement follows, in which case the contract’s retention period applies.
You never have to give us personal data. The contact form needs your name and email address so that we can reply. We do not use your data for profiling or automated decision-making.
Cookies
We do not set cookies and we do not use local storage, so there is no cookie banner. There is no advertising on this site, and nothing is loaded from social networks or third-party font services.
Cloudflare may set a strictly necessary security cookie when its protection is triggered, such as __cf_bm (bot detection, expires after 30 minutes of inactivity) or cf_clearance (records that a security check was passed). Cloudflare uses them only to protect the site, not to track you, and they do not require consent.
The LinkedIn link on the About page is a plain link. LinkedIn receives nothing from this site unless you click it, after which LinkedIn’s own privacy policy applies.
Bot check
The contact form uses Cloudflare Turnstile to tell people apart from automated scripts. To do this it may process your IP address and some browser characteristics and produce a one-time token that expires within minutes. It sets no persistent cookie and builds no profile. Cloudflare’s privacy policy applies to this processing.
Who we share it with
We use a small number of service providers to run the site and our email. Each one acts only on our instructions, under a data processing agreement:
- Hosting and security. Cloudflare hosts and protects the site, forwards contact-form messages, and provides the bot check and visit statistics.
- Email delivery. A delivery service passes contact-form messages to our mailbox. It keeps a copy of each message and its delivery logs for a limited period under its own retention policy.
- Email hosting. A mail provider hosts the mailbox where your messages arrive.
You can ask us for the names of these providers at any time.
We do not sell your data, share it for marketing, or use it to train any system. We would only disclose it to others if the law required us to.
Website and email data outside Europe
The companies that host this website and our email are based in the United States, so some of the website and email data described on this page may be processed outside the European Economic Area. Where that happens, transfers are protected by the European Commission’s standard contractual clauses or by the provider’s certification under the EU-U.S. Data Privacy Framework. You can ask us for a copy of these safeguards. This does not cover client engagement data, which is handled separately, as described below.
Client engagements
This notice covers the website and the messages you send us. Information we access during a security assessment is handled separately, under the engagement contract and a data processing agreement agreed with the client. Those documents set out how that information is protected, how long it is kept and how it is deleted.
How we protect it
The site is served over HTTPS only, with strict transport security and a restrictive content security policy. Messages from the contact form travel over encrypted connections to our mailbox, and access to the mailbox is restricted.
Your rights
Under the GDPR you can ask us to:
- Access the personal data we hold about you.
- Correct anything that is inaccurate.
- Delete your data.
- Restrict or object to how we use it.
- Receive a copy in a portable format.
Email info@gectiv.com and we will reply within one month, free of charge. We may ask you to confirm your identity before acting on a request. If you are not satisfied with our answer, you can complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, autoriteprotectiondonnees.be.
Changes to this notice
If we change this notice in a way that matters, we will update the date at the top of the page.