1. Data controller
The controller is:
Energy Expertise SRL, trading as Makeset
Rue de l'Abbaye 7
4880 Aubel, Belgium
Company and VAT number: BE 0898.341.645
Email: contact@makeset.be
In this policy, "Makeset" means Energy Expertise SRL.
2. Data collected and purposes
Contact form
When you fill the form we collect: your name, email, company (optional), topic, message, plus technical metadata (IP address, user-agent, referer, language) for traceability and spam prevention.
Purpose : answering your request and keeping a record of the exchange.
Legal basis : performance of pre-contractual measures at your request (article 6.1.b GDPR) and legitimate interest in securing our forms (article 6.1.f).
Anti-bot protection
The contact form, the MakeTrust tool and the administration login page are protected by Cloudflare Turnstile. This service checks that a submission comes from a human, using technical data (IP address, browser, connection characteristics) processed by Cloudflare. It does not read the content of your messages and is used neither for advertising nor for profiling.
Purpose : blocking automated submissions and login attempts by bots.
Legal basis : legitimate interest in securing our forms (article 6.1.f GDPR).
Client account
When an account is created and used, Makeset processes the name, email address, company if any, role, authentication data, sessions and security logs.
Purposes : create and manage the account, provide access to the services, secure the client area and keep evidence of transactions.
Legal bases : performance of the contract and legitimate interest in securing accounts and services.
Subscription and billing
Makeset processes the Client's contact details, billing address, VAT number if any, the plan subscribed to, invoices, amounts, due dates, payment status and transaction references.
Purposes : manage the subscription, issue and keep invoices, receive payments, handle unpaid amounts and comply with accounting and tax obligations.
Legal bases : performance of the contract and legal obligations.
Stripe payments
When you pay, payment information is sent directly to Stripe. Makeset neither receives nor stores the full card number or its security code.
Makeset only receives the information needed to manage the payment, such as the payer's identity, amount, currency, transaction reference, payment status and, where applicable, the last four digits and card type.
Purposes : process payments, manage subscriptions, prevent fraud, make refunds and reconcile transactions.
Legal bases : performance of the contract, legal obligations and legitimate interest in preventing fraud.
Stripe's roles
Depending on the processing concerned, Stripe (Stripe Payments Europe, Ltd., Ireland) may act as Makeset's processor or as a separate controller, in particular when it determines the means and purposes needed for payment processing, fraud prevention, security and compliance with its own legal and regulatory obligations.
Processing carried out by Stripe as a separate controller is governed by Stripe's privacy policy.
Makeset as processor
When Makeset hosts or processes data collected by its clients from their own users, for example bookings, forms, names, email addresses or messages, Makeset in principle acts as a processor.
The client concerned determines the purposes and legal bases of the processing and acts as controller. These operations are governed by a Data Processing Agreement under Article 28 GDPR.
Makeset does not use this data for its own marketing, for advertising, for resale or to build commercial profiles.
Cookies
The website only uses cookies that are strictly necessary for it to work. No analytics or marketing cookies are set. See the cookie policy for details.
3. Recipients and service providers
The data is accessible to authorised Makeset staff and, depending on the service used, to the following providers:
- Hostinger, for the VPS infrastructure located in France;
- Cloudflare, for DNS, content delivery, security and abuse prevention;
- Stripe, for payments, subscriptions, invoices and fraud checks;
- one.com, for email services;
- authorised accounting, legal and technical service providers;
- the competent authorities where required by law.
Depending on the processing concerned, these providers act as processors or as separate controllers.
No personal data is sold to third parties.
4. Transfers outside the European Economic Area
Makeset's main infrastructure is hosted in France. Some providers, in particular Cloudflare and Stripe and, depending on their configuration, other suppliers, may nevertheless process data or allow access from countries outside the European Economic Area.
Where an international transfer takes place, it relies, depending on the recipient and country concerned, on:
- an adequacy decision of the European Commission;
- the EU-US Data Privacy Framework where the recipient entity is actually certified and the processing is covered by that certification;
- the standard contractual clauses adopted by the European Commission;
- and, where necessary, additional contractual, organisational or technical measures.
The EU-US framework is only relied on for entities with a valid certification. Otherwise, another legally valid mechanism is used.
Further information on the applicable safeguards can be requested at contact@makeset.be, subject to the protection of trade secrets and security measures.
5. Retention periods
- Contact requests and pre-contractual exchanges: three years after the last contact.
- Client account: for the duration of the contractual relationship, then for the time needed for closure, proof of the contract and handling of any dispute.
- Proof of acceptance of the terms and contractual consents: for the term of the contract and the applicable limitation periods.
- Invoices and accounting or tax documents: for the period required by applicable Belgian law.
- Payment references: for the time needed to perform the contract, handle refunds and disputes and comply with legal obligations.
- Support tickets: for the duration of the contractual relationship, then for a period proportionate to their usefulness and to the risk of disputes.
- Technical and security logs: twelve months maximum, except in the event of an incident, a legal obligation or a specific documented need.
Stripe may retain certain data under its own responsibility for the periods required by its financial, regulatory, anti-fraud and litigation obligations.
Data contained in backups is deleted according to the documented backup rotation cycle and is not reused for other purposes.
6. Your rights
Under articles 15 to 22 of GDPR you have the following rights:
- Access : obtain confirmation that data about you is being processed and a copy of it.
- Rectification : have inaccurate data corrected.
- Erasure : request deletion of your data in the cases provided by law.
- Restriction : request that processing be temporarily suspended.
- Portability : retrieve your data in a structured, machine-readable format.
- Objection : object to processing based on legitimate interest.
To exercise these rights, write to contact@makeset.be. We reply within one month (extendable to 3 months for complex requests).
7. Complaint
If you believe your rights are not being respected, you may lodge a complaint with the Belgian Data Protection Authority (APD/GBA), 35 rue de la Presse, 1000 Brussels, www.autoriteprotectiondonnees.be. You may also contact the supervisory authority of your country of residence.
8. Security
We apply technical and organisational measures proportionate to the risk: HTTPS encryption everywhere, security headers (CSP, HSTS), form rate limiting, encrypted backups, regular updates and restricted access to data. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, Makeset informs you without undue delay where such notification is required by Article 34 GDPR.
Where Makeset acts as processor, it informs the controller concerned without undue delay in accordance with the Data Processing Agreement. It is then for the controller to determine the notifications required to individuals and authorities.
Depending on the processing, security measures include access control, least privilege, strong authentication for privileged access, encryption of communications, backups, vulnerability management, logging, incident management, continuity and supplier monitoring.
These measures draw on recognised security practices. They do not constitute a claim of ISO/IEC 27001 certification or SOC 2 attestation in the absence of a corresponding certificate or report.
9. Changes
This policy may change. The date of the last update is shown at the top. For any major change, you will be informed by a notice on the website.