Privacy
Last updated: October 2026
Who is responsible
VDHome, sole proprietorship of Mathias Vanderhoeven, Adrien de Gerlachestraat 26, 2650 Edegem, Belgium, company number BE0757674324. Questions about your data: info@vdhome.be.
This website
This website uses no cookies, no analytics, no trackers and loads nothing from third parties: no external scripts, fonts or maps. A strict Content Security Policy enforces this; you can check it yourself in your browser's developer tools (F12). The free scan and the NIS2 check run entirely in your browser: they send nothing and store nothing, no cookies or local storage either.
The contact form
What you fill in (name, email address, organisation, role, sector, size, deadline, language and your question) travels over an encrypted connection to forms.vdhome.be, our own server at Hetzner Online GmbH in Germany. It immediately places your request as a message in our own mailbox (info@vdhome.be) and keeps nothing itself: no content and no IP address in its own logs. Against spam, your browser fetches a small computational puzzle from forms.vdhome.be while you fill in the form and solves it; this needs no cookie and no external service. We use these details only to answer your question and prepare a quote, at your request and before any contract (Art. 6(1)(b) GDPR).
The cookie-consent self-check
When you request the self-check on check.vdhome.be, we process the domain and the email address at that domain that you enter. We send a confirmation link to that address; only after you confirm do we load the public pages of your site in an isolated browser on our own server at Hetzner Online GmbH in Germany, and we send the report as a PDF to the same address after we have reviewed it. We keep the domain, the email address and the state of the request to handle it and to limit abuse (Art. 6(1)(b) and 6(1)(f) GDPR); they are deleted automatically after 30 days. That page sets no cookie and uses no external service; against spam, your browser solves a small computational puzzle. The emails go through our mailbox at Google Workspace. Every report we send gets a register entry so the recipient can check that it is genuine: a hash of the report ID, the PDF's fingerprint (SHA-256), the date and our signature, without the domain or email address. We also record the fingerprint and signature in Rekor, the public register of the Sigstore project (OpenSSF, Linux Foundation); that record is permanent. When you check a report at check.vdhome.be/r, your browser fetches our key from www.vdhome.be and the record from Rekor; Rekor then sees your IP address. The PDF file itself does not leave your computer.
Emails to businesses
We occasionally email Belgian legal persons, public bodies included, at the general address on their website (e.g. info@). We only use public data: the Crossroads Bank for Enterprises (open data), the headcount from the annual accounts at the National Bank, the Flemish government's register of organisations, and OpenStreetMap and Google Maps to find the website (Google gets only the name and municipality). We look at the home page and at most three pages it links to, twice at least 48 hours apart and on the day of sending, without clicking anything (our browser is called VDHome-webcheck), plus the public DNS data of the domain. Legal basis: legitimate interest (art. 6.1.f GDPR); on request we explain that balancing. We keep the name, enterprise number, address, website, findings and the email sent for at most 12 months; your findings page disappears after 60 days or immediately on request. No more email? Reply stop, use the opt-out link at the bottom of the email or write to info@vdhome.be; we then no longer use your data for prospecting and delete it within the 12 months, keeping only your address on our opt-out list so we do not email you again. You can always object (art. 21 GDPR) and lodge a complaint with the Data Protection Authority.
Security logs
When you use the contact form, we record the IP address, time and requested address of each request, to recognise and block abuse (legitimate interest, Art. 6(1)(f) GDPR). These logs are deleted automatically after 7 days. Firebase Hosting (Google), which serves the website itself, keeps its own server logs for the operation and security of its service.
Who processes your data
Only we read your request. We use three processors for it, each under a data processing agreement (Art. 28 GDPR): Hetzner Online GmbH (Germany) for the form's server, Google Cloud EMEA Ltd (Ireland) for our mailbox (Google Workspace) and Google for hosting the website (Firebase Hosting). Google may process data outside the EU; this happens under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. We sell nothing, send no newsletter, build no profiles and take no automated decisions.
Retention
Your request stays in our mailbox as long as we need it to answer and follow up, and at most two years after our last contact if no engagement follows. If you become a client, we keep what the engagement, invoicing and the statutory accounting and tax retention periods require.
Client documents
For an engagement in which we process personal data of your organisation, we sign a data processing agreement beforehand. How we handle confidential documents is described on the Approach page.
Your rights
You can ask for access, correction, erasure or restriction of your data, object to the security logs, and receive your data in a common format. Email info@vdhome.be; you will get an answer within one month. You can also lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels (www.dataprotectionauthority.be).