Privacy policy

Controller and contact

The controller is Soufyan Najjar, trading as Solideno, Sole proprietorship (natural person), registered office: [TO COMPLETE: street and number], Brussels, Belgium. Data-protection contact: hello@solideno.com.

Scope

This policy covers visitors, prospects and clients’ business contacts. When processing data on a client’s behalf within a project, we act as processor under their instructions and a separate data processing agreement (DPA).

Data collected

We process form fields (name, email, company, country, phone, interest, description, budget, timing, language), inquiry source, emails and WhatsApp messages; professional contact data from public or professional sources; contract and billing data; technical logs and IP addresses; and admin accounts (identity, email, authentication). Do not send unnecessary sensitive data.

Purposes and legal bases

Under GDPR Article 6: answering requests is pre-contractual action (6.1.b); service delivery is contract performance (6.1.b); security and relevant B2B prospecting rely on legitimate interests (6.1.f), subject to a rights-balancing assessment and easy opt-out in every message; accounting relies on legal obligations (6.1.c); optional trackers require prior consent (6.1.a). Under Law 09-08 we verify the applicable permitted basis, including consent, contractual necessity, legal obligation or legitimate interest under that law’s conditions; GDPR does not replace CNDP formalities. Prospecting also follows local electronic-communications rules; consent is obtained where required.

Recipients and subprocessors

Access is limited to authorised staff, hosting/database providers, the email-delivery provider, our accountant and authorities where legally required. WhatsApp/Meta processes messages if you contact us there under its own terms. Fonts are hosted locally: no Google Fonts request is needed. AI providers such as Anthropic (Claude) or Microsoft (Copilot/Azure) are used for project data only when needed, under contract and agreed instructions and safeguards. The project-specific subprocessors are listed in the DPA. We never sell data.

International transfers

GDPR-covered transfers outside the EEA require an adequacy decision or appropriate safeguards, notably EU Standard Contractual Clauses, with transfer assessment and supplementary measures where needed. Transfers from Morocco abroad follow Law 09-08 and CNDP authorisation where required. No authorisation or transfer compliance is presumed: these matters must be verified before a relevant transfer.

Retention periods

These are retention limits to implement and verify in our systems, not a claim that automatic deletion is already deployed. Records needed for a dispute may be restricted and retained until resolution, as permitted by law.

• Prospects: 3 years after last contact.
• Clients: contract duration; accounting records: 10 years under applicable obligations.
• Unfollowed contact requests: 3 years. Technical logs: maximum 12 months. Cookie choices: 6 months.

Security

We restrict access by role, use encrypted connections and separate administrative access. Backup, restoration, incident-handling commitments and project-specific measures are defined contractually and must be verified with providers. No system is completely invulnerable.

Your rights and requests

Subject to GDPR conditions: access, rectification, erasure, restriction, objection (including prospecting), portability and withdrawal of consent without retroactive effect. Law 09-08 notably provides access, rectification and opposition. Email hello@solideno.com; proportionate identity verification may be necessary. We respond within one month; any legally permitted extension is explained and notified within that period. Prospecting objections are honoured; minimal suppression-list data may be kept to avoid contacting you again.

Complaints to a supervisory authority

Our lead supervisory authority is the Belgian Data Protection Authority (APD/GBA, www.dataprotectionauthority.be). You may also lodge a complaint with the data protection authority of your own EU country, for example the Autoriteit Persoonsgegevens (Netherlands) or the CNIL (France). For persons in Morocco, Law 09-08 applies to processing carried out in Morocco; you may contact the CNDP (www.cndp.ma).

Automated decisions and minors

We do not make solely automated decisions producing legal or similarly significant effects on you. Our services are B2B and not aimed at children. Any different project use must be assessed and governed separately.

Changes

The date above indicates the latest update. Material changes are communicated appropriately; new consent is requested where necessary.