Privacy Policy

Nivoraworks, sole proprietorship of Kamiel Niville, Julius en Maurits Sabbestraat 15, 8000 Brugge, Belgium. Company and VAT number BE 1041.516.417. Email kamiel@nivoraworks.com, phone +32 489 00 77 37. We are the controller for the personal data described here.

This policy covers this website, our direct contact with you, and the business emails we send. Personal data we process inside a client project, on your behalf, is governed by the engagement agreement and a separate data processing agreement, where we act as processor and not as controller. Box and the Nivora platform have their own privacy policies.

When you contact us or fill in a form: your name, company, email address, phone number, the page you were on, and whatever you write to us. This lands in our own CRM.

When you subscribe to our newsletter: your email address, and your name and phone number if you give them. We use double opt-in, so nothing is sent until you confirm through a link in an email.

When you use the assistant on this site: the messages you type and the answers it gives. Those messages are sent to Anthropic, which runs the model, and are not used to train it.

When you visit the site: measurement data, described in the next section.

When you become a client: the contract, correspondence and invoicing data we need to do the work and keep our books.

We do not ask for special categories of data, and we ask you not to send sensitive personal data through general contact channels.

We run our own measurement instead of an external analytics platform. Nothing here is shared with an advertising network. Per visit we record:

• the pages you view, and the moment you view them;
• how long a page was actively open, and how far down you scrolled;
• which site or search engine you arrived from;
• your browser type and approximate country;
• a salted hash of your IP address. The raw IP address is never stored.

From that IP address, before it is hashed, we try to recognise the organisation a visit comes from, so we can see which companies read our pages. This is company-level information, not an attempt to identify you as a person. We do not combine it with your name unless you contact us yourself.

This aggregate measurement runs without cookies and without an identifier on your device. Only if you accept cookies do we also store a random visitor id in your browser, so repeat visits can be counted as one reader. Decline, and that identifier is never created.

You can object to this measurement at any time by emailing us. Our cookie policy lists exactly what is stored in your browser.

This is the complete list. It is short, because we run no advertising trackers and no external analytics platform.

Necessary, no consent needed. These stay whatever you choose:

• nivora.lang, one year. Remembers whether you read the site in Dutch or English.
• nivora.consent, until you clear it. Remembers your answer to the cookie question, so we stop asking.
• nivora.launchBanner.dismissed, until you clear it. Remembers that you closed the announcement bar.

Only if you accept:

• nv_vid, until you clear it. A random number with no meaning outside this site, so repeat visits count as one reader instead of several.

If you decline, that number is never created, and any earlier copy is removed the moment you decline. Everything on the site keeps working.

What we never do. No advertising cookies. No Google Analytics, no Meta pixel, no TikTok or LinkedIn tag. No profiles built about you, no data sold to anyone.

Changing your mind. Use the “Cookie settings” link at the bottom of any page to bring the question back and answer again. Withdrawing is as easy as giving. Clearing your browser data for this site removes everything in the lists above.

We contact businesses that we think our work could help. When we do, we did not get your details from you, so the law requires us to tell you where they came from and why we hold them.

• Where from: public sources, such as the company website, the Belgian Companies Register, and professional networks such as LinkedIn.
• What we hold: your name, role, business email address, company, and public information about what the company does.
• Why: to reach a business that we believe has a concrete use for what we build. Our legal basis is legitimate interest, article 6.1.f GDPR.
• How to stop it: reply to any message, or email us, and we remove you and keep a note of your address so it is never approached again.

We only approach professional addresses about professional matters, never private ones.

• To answer your questions and prepare or carry out an engagement: taking steps at your request, and performance of our contract.
• To measure and secure our website and reach businesses that could use our work: our legitimate interest, balanced against your rights, and you can object.
• To send you the newsletter: your consent, which you can withdraw at any time through the link in every message.
• To store or read anything on your device that is not strictly necessary: your consent.
• To meet legal, accounting and tax obligations: compliance with the law.

We do not make decisions about you by automated means that produce legal effects for you.

We do not sell your data. We use these providers, each only as far as needed, and each bound to protect your data:

• Vercel, for hosting this website.
• Supabase, for our database. Our projects run in Ireland and Germany.
• Hostinger, for the server that runs our backend. That server sits in a data centre in Paris, France.
• Anthropic, for the model behind the assistant on this site.
• Resend, for sending email such as the newsletter confirmation.
• Instantly, for our business outreach email.
• Google Workspace, for our own mailbox and calendar.
• Stripe, for payments.

We may also disclose data where the law requires it.

We prefer providers that keep data within the European Economic Area. Our databases run in Ireland and Germany, and our own server runs in Paris.

The assistant on this site is an exception: your messages go to Anthropic in the United States. That transfer runs on the European Commission’s standard contractual clauses, together with the supplementary measures that go with them. If you would like to see a copy of those clauses, ask for them at kamiel@nivoraworks.com and we will send them to you. If you would rather not have a conversation leave the EU, email or call us instead of using the assistant.

• Enquiries that do not lead to work: 12 months.
• Client files: 10 years after the engagement ends, which matches how long a claim can run.
• Invoices and accounting records: 7 years, as Belgian law requires.
• Newsletter: until you unsubscribe, plus a record of the unsubscribe so we do not mail you again.
• Assistant conversations: 30 days.
• Website measurement: aggregated and kept without an identifier.

Nothing on this site requires you to hand anything over to read what you are reading. If you want something from us, we do need the minimum to answer:

• A question or a quote: an email address, and enough about your situation to give a sensible answer. Without an address we cannot get back to you.
• Booking a call: a name and an email address, so the invitation lands somewhere.
• The newsletter: an email address. We ask for nothing else.
• An engagement and an invoice: the details Belgian accounting and VAT law require. Those we cannot leave out, not even on request.

Apart from that last point, none of this is a legal obligation. Leave something out and we simply cannot do that one thing; nothing else follows from it.

We take no decisions about you based solely on automated processing that produce legal effects or significantly affect you. There is no score, no profile deciding what you get to see, and no system that accepts or rejects you.

The company recognition described above is the only place where something happens automatically, and it says something about an organisation, not about you. Whether we contact someone, and what we write in that email, is decided by a person.

This site and our services are aimed at businesses and at adults. We do not knowingly collect personal data from minors. If you notice that it happened anyway, tell us and we will delete it.

Our pages and our emails sometimes link to other people’s sites. Their policy applies there, not ours. We choose carefully where we link, but we have no control over what they do with your data. Read their policy before you leave anything behind.

What you write to the assistant on this site is not used to train AI models. The same holds for client data in the systems we build; the terms put that in writing.

Access is limited to the people who need it, traffic runs over TLS, our databases sit behind row-level security, and secrets never reach the browser. No system is perfectly secure, but we take this seriously and design for it. If a breach ever puts your rights at real risk, we tell the supervisory authority within 72 hours and we tell you.

Under the GDPR you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Delete your data, where there is no overriding reason to keep it.
• Restrict how we use it.
• Object to use based on our legitimate interest, including the measurement and our outreach.
• Receive your data in a portable format, where that right applies.
• Withdraw consent at any time, without affecting use before you withdrew it.

Email kamiel@nivoraworks.com and we answer within one month. If you think we handled your data badly, you can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussel, contact@apd-gba.be, +32 2 274 48 00.

One right on its own, because the law wants us to say it explicitly: you can object at any time to your data being used for direct marketing, including our newsletter and our cold emails. You do not need a reason and there is nothing to weigh up. Say so and it stops, and all we keep is the fact that you do not want to be approached again. A reply to any message, or an email to kamiel@nivoraworks.com, is enough.

We may update this policy as our practices change. The current version, with the date it was last updated, is always the one on this page.

For anything about your privacy or this policy, email kamiel@nivoraworks.com or call +32 489 00 77 37.