Privacy statement

Zenjoy BV processes personal data to answer enquiries, prepare quotations and carry out projects, secure our website and systems, and meet legal obligations. This privacy statement explains which data we process, why we do so, with whom we share it, how long we keep it and which rights you have.

This statement applies where Zenjoy itself determines the purposes and means of processing. Where we process personal data solely on a client’s behalf, that client is the controller. In that case, the client’s privacy statement and instructions and the data processing agreement with Zenjoy also apply.

Key information

• Zenjoy BV is established at Blijde Inkomststraat 22, 3000 Leuven, Belgium, and has company number BE 0838.367.436.
• For privacy questions and requests, contact [email protected].
• We retain enquiries and communications from people who do not become clients for no more than two years after the last meaningful contact.
• We retain project and client records during the active relationship and for no more than ten years after the client relationship ends or the last meaningful support contact.
• For cloud-based AI, we use only approved paid accounts whose input is not used to train models. We limit personal data entered to what is needed for the task.

Who is responsible

The controller for the processing described in this statement is:

• Zenjoy BV
• Blijde Inkomststraat 22, 3000 Leuven, Belgium
• Company number BE 0838.367.436
• Telephone +32 16 43 93 81
• General contact [email protected]
• Privacy contact [email protected]

Who this statement covers

This statement applies, among others, to:

• visitors to our website and people who set cookie preferences;
• people who contact us by email, telephone, form or social media;
• prospective clients and business contacts at clients, suppliers and partners;
• applicants for jobs or internships;
• people whose data appears in a project or support record; and
• domain-name holders and administrative or technical contacts for domain management.

What data we process

Depending on your relationship with Zenjoy, we may process:

• identification and contact details, such as your name, organisation, position, email address and telephone number;
• the content of enquiries, requests, quotations, appointments and other correspondence;
• project information, functional requirements, decisions, planning, support history and business documents;
• invoicing and payment details and data needed for our accounts;
• job and internship application information, such as a CV, motivation letter, portfolio, education, career history and assessment notes;
• technical data, such as IP address, device and browser information, timestamps, security and application logs, and cookie preferences. Users of Nimbu can read a separate privacy statement at www.nimbu.io/legal/privacy;
• account, role and access data for systems in which we collaborate with clients or suppliers; and
• other data that you provide or that is needed for a specific engagement.

We do not ask for sensitive data or data relating to criminal offences unless it is necessary for a specific processing activity and permitted by law. If such data is sent to us without being requested, we assess case by case whether it should be deleted, restricted or processed further.

Where the data comes from

We usually receive personal data directly from you, for example when you contact us, complete a form, request a quotation, apply for a position or take part in a project. We may also receive data from a client or project partner, a supplier involved in delivering services, or publicly available professional sources. Where a client provides data for a project, Zenjoy processes it according to the agreed roles and arrangements with that client.

Why we process data

Enquiries and general communication

We process your contact details and the content of your message to answer, route internally and follow up your enquiry. For enquiries about a possible or ongoing engagement, our legal basis is taking steps before entering into a contract or performing a contract. For other business enquiries, we rely on our legitimate interest in being reachable and organising our activities. If you do not become a client, we retain this communication for no more than two years after the last meaningful contact.

Quotations and requests

We use identification, contact, organisation, request and quotation data to assess your needs, prepare a quotation and communicate before entering into a contract. The legal basis is taking steps before entering into a contract. We retain unaccepted quotations, prospect records and related form submissions for no more than two years after submission, the last meaningful contact or the formal close of the quotation process. Accepted quotations become part of the client and contract record.

Client projects and support

We process business contact details, project communication, agreements, requirements, documentation, code-related information and support history to carry out projects and provide long-term support. For individuals who are parties to the contract, the legal basis is performance of that contract. For contact persons at organisations, we rely on our legitimate interest in carrying out and managing the contract with their organisation. We retain the project and client record during the active relationship and for no more than ten years after the client relationship ends or the last meaningful support contact.

Invoicing and administration

We process contact, contract, invoicing and payment data to issue and follow up invoices, maintain our accounts and comply with tax and other legal obligations. The legal bases are performance of a contract and compliance with our legal obligations. We retain these data for the applicable Belgian accounting and tax periods and, where needed, for as long as they remain relevant to establish, exercise or defend a legal claim.

Job and internship applications

We process the information you provide in a job or internship application to assess your application and manage the selection process. The legal basis is taking steps before entering into a contract. We retain the data until the selection process has ended. We add an applicant to a recruitment reserve only on a separate legal basis and after clearly informing them of the purpose and duration of further retention.

Website and security

We process technical data to keep the website available and secure, investigate faults, prevent abuse and improve our services. For necessary technical processing, we rely on our legitimate interest in a secure and reliable website. Technical data is deleted or anonymised once it is no longer needed within our documented security and backup cycles, unless a specific security incident or legal obligation requires longer retention. Nimbu users can find more information about the platform at www.nimbu.io/legal/privacy.

Cookies and analytics

Essential cookies may be used to make the website and your cookie preferences work properly. For non-essential analytics or advertising cookies, we ask for consent where the law requires it. You can change your choice later through the cookie preferences on the website. The current list of cookies, providers, purposes and retention periods is set out in the separate cookie policy.

Social media

If you contact Zenjoy through Facebook, Instagram or LinkedIn, we process your profile details and message to reply and follow up your enquiry. Relevant information may be transferred to our internally used work tools & software. The same legal bases and retention periods apply as for other enquiries. The social media platforms also process data for their own purposes under their own terms and privacy statements.

Domain registration

When Zenjoy acts as an intermediary to register a domain name for a client, the client remains the domain owner. We use the client’s identification and contact details for registration, configuration and management, and share the necessary data with Realtime Register and the relevant parties in the registration chain. This processing follows the contract and the client’s instructions.

Use of artificial intelligence

Zenjoy may use approved AI tools to support analysis, summarising, writing, coding and project tasks. Using AI does not create a new purpose: the legal basis and retention period follow the underlying task. For cloud-based AI, we use paid, restricted accounts whose input is not used to train models. We enter as little personal or client data as possible. Sensitive data is processed only in exceptional cases following a prior assessment, preferably locally on Zenjoy hardware. Where Zenjoy uses AI as a processor for a client, this takes place under that client’s instructions and the agreements with the client.

Retention periods

We do not retain personal data longer than necessary for the purpose for which it was collected. The main periods and criteria are:

Processing activity	Period or criterion
General enquiries and communication with people who do not become clients	No more than 2 years after the last meaningful contact
Unaccepted quotations and related form submissions	No more than 2 years after submission, the last contact or formal close of the quotation process
Client and project records	During the active relationship and then no more than 10 years after the client relationship ends or the last meaningful support contact
Invoicing and legally required administration	For the applicable Belgian accounting, tax and other statutory periods
Job and internship applications	Until selection is complete; longer retention only on a separate legal basis and after advance notice
Cookies and similar technologies	As described in the current cookie policy and according to the cookie preferences set
Technical logs and backups	According to documented security and backup cycles; longer only if required by an incident, legal duty or legal claim

Who we share data with

We share personal data only where needed for the purposes described, to perform a contract, to comply with a legal obligation or with your consent. Depending on the processing activity, recipients may include:

• Zenjoy employees and independent collaborators who need the data for their role;
• suppliers of email, collaboration, project management, file storage, forms, invoicing and security services;
• technical suppliers of hosting, code, infrastructure, domain management and content delivery where they are involved in the specific service;
• social media platforms when you choose to use those channels;
• approved AI providers where their tools are used for an authorised task; and
• professional advisers, public authorities, courts or regulators where required by law or necessary to protect our rights.

Where required, we enter into data processing agreements and limit suppliers to the data and instructions needed for their task.

Transfers outside the European Economic Area

Some suppliers may process personal data in countries outside the European Economic Area. In that case, we use a valid transfer mechanism, such as a European Commission adequacy decision, participation in the EU–US Data Privacy Framework where valid and applicable, or European Commission-approved standard contractual clauses with supplementary measures where needed. You can ask [email protected] for more information about the safeguards that apply to a specific transfer.

How we secure data

We take technical and organisational measures appropriate to the nature and risks of the processing. Examples include access management based on role and need, individual user accounts, multi-factor authentication on key systems, secure connections, logging where appropriate, backups, contractual arrangements with suppliers and periodic access reviews. Team members receive guidance on handling personal data during onboarding and annually thereafter.

Your rights

Subject to the conditions of the GDPR, you have the right to:

• find out whether we process personal data about you and obtain access to it;
• have inaccurate or incomplete data corrected;
• have data erased where there is no longer a valid reason to keep it;
• have processing temporarily restricted;
• object to processing based on a legitimate interest;
• receive data you provided in a structured, commonly used and machine-readable format where the right to data portability applies;
• withdraw your consent at any time for future processing based on consent; and
• lodge a complaint with a supervisory authority.

For the processing covered by this statement, Zenjoy does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

How to exercise your rights

Send your request to [email protected] and include enough information for us to assess your request and the processing concerned. We normally respond within one month. If we cannot reasonably verify your identity, we may ask for additional information. We do not routinely ask for a copy of your identity card and limit any identity checks to what is necessary and proportionate.

Complaints

We encourage you to contact Zenjoy first so we can investigate your question or complaint. You can also lodge a complaint with the Belgian Data Protection Authority:

• Belgian Data Protection Authority (Gegevensbeschermingsautoriteit)
• Drukpersstraat 35, 1000 Brussels, Belgium
• Telephone +32 (0)2 274 48 00
• Email [email protected]

More information is available at www.gegevensbeschermingsautoriteit.be.

Information we need from you

You are not legally required to give us data for a general enquiry. Without sufficient contact or project information, we may be unable to answer your question or provide a quotation or service. Certain data is needed to enter into a contract, issue invoices and register some domain names, either to perform the contract or meet legal obligations.

Changes to this statement

We update this privacy statement when our processing activities, suppliers or legal obligations change. The most recent version is available at www.zenjoy.be/en/privacy. Where necessary, we inform those affected of significant changes through an appropriate channel.

Contact

Questions about this statement or how we process your personal data? Email [email protected] or write to Zenjoy BV, Blijde Inkomststraat 22, 3000 Leuven, Belgium.