Privacy Policy

Effective Date: January 1, 2026 | Last Revised: February 2026

1. Data Controller Identification

The legal entity responsible for the collection and processing of personal data via this website is:

2. Personal Data We Collect

We collect personal information directly when you communicate with us through our contact form or via electronic mail. Specifically, we collect:

• Identification and Contact Details: Full name, organizational affiliation (e.g. municipal council, architecture practice, or trust), and email address;
• Inquiry Specifics: Information regarding the public monument or sculpture, context categories (civic plaza, park, memorial), and specific service inquiries;
• Technical Telemetry: Anonymized or pseudonymized IP address, browser user-agent, access timestamps, and page request logs gathered automatically to ensure server stability and cybersecurity.

3. Legal Bases and Purposes of Processing

Under Article 6 of the General Data Protection Regulation (GDPR), we process your data based upon:

• Legitimate Interests (Art. 6(1)(f) GDPR): Responding to client inquiries, maintaining the security and performance of our web infrastructure, and presenting informational articles on sculpture care.
• Performance of a Contract or Pre-contractual Steps (Art. 6(1)(b) GDPR): Preparing preliminary condition assessment proposals or responding to municipal tenders requested by you.
• Consent (Art. 6(1)(a) GDPR): Storing non-essential analytical cookies on your device where you have affirmatively granted permission via our cookie preference banner.

4. Cookies and Local Storage

This website utilizes local storage tokens and standard HTTP cookies to remember your consent preferences and, where accepted, analyze general visitor navigation patterns. We do not engage in behavioral cross-site tracking or third-party ad profiling. For an exhaustive inventory of individual storage tokens, please review our comprehensive Cookie Policy.

5. Third-Party Service Providers and Data Processors

We may share limited personal data with technical infrastructure providers bound by rigorous Data Processing Agreements (DPAs) in compliance with GDPR Article 28. These include:

• Web hosting infrastructure and content delivery network providers located within the European Economic Area (EEA);
• Enterprise email and communication servers;
• Specialist technical consultants engaged under confidentiality agreements where required for conservation planning.

We do not sell, rent, or trade your personal information to marketing brokers under any circumstances.

6. International Data Transfers

Our core server infrastructure is hosted within the European Union. Should any auxiliary technical service provider transfer personal data outside the EEA, such transfers are safeguarded through standard contractual clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection equivalent to GDPR standards.

7. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the operational purposes for which it was originally collected:

• Contact Inquiries: Stored for up to twenty-four (24) months after the last active communication to facilitate ongoing project dialogues, unless a formal contractual relationship is established.
• Contractual & Conservation Records: Project documentation and associated administrative correspondence are maintained for ten (10) years in adherence with Belgian commercial accounting obligations.
• Server Logs: Technical server access logs are automatically rotated and purged after ninety (90) calendar days.

8. Your Rights Under the GDPR

If you reside within the European Economic Area or United Kingdom, you are entitled to exercise the following statutory rights regarding your personal information:

• Right of Access (Art. 15 GDPR): Request a copy of the personal records we hold concerning you.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate, out-of-date, or incomplete records.
• Right to Erasure (Art. 17 GDPR): Request the permanent deletion of personal data where retention is no longer legally justified.
• Right to Restriction of Processing (Art. 18 GDPR): Request temporary freezing of processing while data accuracy is contested.
• Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests at any time.

To exercise any of these statutory rights, please submit your request to [email protected]. We respond to all verified requests within thirty (30) calendar days without charge. You also maintain the right to lodge a formal complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) or your local supervisory authority.

9. Notice Regarding Fictional Website Demonstrator

Please note that wonderbuddyshuffl.surf is an illustrative digital showcase website for an independent European sculpture conservation concept. While the legal clauses herein reflect real GDPR standards, the corporate entity named is fictional for demonstration purposes.