Privacy Policy

Last updated: 28 August 2026

Nide Works attaches great importance to protecting your privacy. This policy explains which data we collect, why we collect them and what your rights are, in accordance with the General Data Protection Regulation (GDPR — EU 2016/679).

1. Data controller

2. Data we collect

Requests submitted voluntarily

The private Nide Works register in Supabase, hosted in the European Union and protected by access rules (RLS), is the source of truth for requests received. Depending on the form used, Nide Works receives only the information you choose to submit:

• for a contact or quotation request: name, email address, telephone number, profile (private individual, contractor, architect/engineering office, property developer/property manager or other business), company, job title and VAT number where relevant, project type and location, budget range, deadline, preferred contact method and message;
• for an invitation to tender: company, VAT number, company size, the contact person's role and contact details, site location and characteristics, work packages, method of execution, schedule, preferred contact method, any secure link and further details;
• for a job application: contact details, municipality, position, availability, experience range, driving licence, safety training, further details and confirmation of the right to work legally in Belgium.

The professional contact and tender forms allow up to five PDF, XLSX, DWG or ZIP files to be attached, with a total limit of 50 MB. Submitted drawings, bills of quantities and specifications are linked to your request in a private space accessible only to authorised management. File names, types and sizes are retained with the file. The recruitment form does not accept attachments. Avoid identity documents, medical data and other personal information unrelated to pricing the work.

The submission may also include a random conversion identifier, the entry page, the time of first contact, the referring website's origin reduced to its domain and, where present and recognised, the campaign parameters utm_source, utm_medium and utm_campaign. These elements are used to attribute a request actually received, not to identify a visitor who does not make contact.

Public website audience measurement, only after consent

PostHog Cloud EU loads only after your explicit consent to audience measurement. If you refuse or make no choice, no PostHog event is sent. After consent, statistics may contain the page viewed without parameters or a fragment, the language, content type, referring domain, campaign codes from a closed list, the browser, operating system and device type, approximate country and limited events: page views, clicks on a call to action or contact method, starting, attempting, validating, successfully submitting or technically failing to submit a form, a language change and voluntarily displaying the map.

Form events may include standardised categories useful for the business (for example, lead or project type, budget, schedule, company-size or experience ranges, preferred contact method and whether a company or VAT number is present). No name, email address, telephone number, company name, VAT number, message, free text, file name, link or document is sent to PostHog. Autocapture, person profiles, heatmaps and session recording are disabled.

When a form is received, a random conversion identifier may be included in the Supabase submission and the aggregated PostHog event. It contains no contact details; only authorised staff may use it to check the origin of a request. Similarly, an email or WhatsApp link may receive a short opaque reference NW-…. A click indicates only an intention to make contact; it does not prove identity, actual contact or confirmed commercial interest. If the person keeps this reference in their message, Nide Works can then link that voluntary contact to its original channel.

To protect forms from automated submissions, the IP address transmitted with the request is immediately converted on the server into an irreversible cryptographic code. This technical code is kept separately from requests for no more than two days and is used only to limit the number of submissions. The raw IP address, browser and device fingerprint are not recorded in the lead's or applicant's file.

The IP address is also required to route a request to PostHog after consent. The project is configured to discard it at ingestion after limited technical processing, in particular approximate country determination and automated-traffic detection; the raw IP address is not retained as an event property. Nide Works uses neither the IP address, nor a device fingerprint, nor a reverse-enrichment service to look up the name of a person or company that has not made contact.

3. Purposes & legal basis

These data are used only to respond to your request, prepare a quotation, price your tender, process your application and follow up on your project. Documents requested subsequently are used exclusively to assess the relevant file. Quotation requests, tenders and job applications fall within pre-contractual measures taken at your request. Responding to a general professional enquiry and managing recruitment are based on the legitimate interest of Nide Works. Separate consent is requested only to retain an application in a candidate pool beyond the normal period stated below. Nide Works does not use contact details from a form to send a newsletter or automated prospecting without a separate legal basis and information.

Audience measurement is based on your consent (Article 6(1)(a) of the GDPR). You may refuse without any consequence for access to the website or submission of a form, and withdraw your consent at any time. Elements strictly necessary for operation, security and remembering your choice are not used for audience measurement.

4. Recipients

Your data are processed by Nide Works and our technical service providers: Vercel, Inc. and Netlify, Inc., which host the website and relay the request without constituting the register of requests; Supabase, Inc., whose European project stores requests and attachments with restricted access; and, only if you accept audience measurement, PostHog Cloud EU, the audience-measurement processor hosted in the European Union. Your data are never sold or transferred to third parties for commercial purposes.

Transfers outside the European Economic Area

Supabase requests and PostHog events are hosted in the European Union. However, Vercel, Netlify, Supabase and PostHog are service providers established in the United States; some support access or subprocessors may therefore involve a transfer outside the European Economic Area. Where such a transfer takes place, it must be based on an applicable adequacy decision, notably the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's standard contractual clauses and the additional measures required. A copy of the applicable safeguards may be requested from info@nideworks.be. Please also consult the information from Netlify, from Supabase and from PostHog.

5. Retention period

Commercial requests are kept for the time needed to process them, then for a maximum of 3 years after our last contact, unless a longer legal obligation applies. Unsuccessful applications are deleted no later than 6 months after the last contact, unless the applicant explicitly agrees to longer retention. If the person is hired, the necessary data become part of the worker's file and are retained in accordance with applicable social and legal obligations. Audience-measurement events are retained for a maximum of 12 months; internal reports derived from them are aggregated and contain no visitor identity. The choice to accept or refuse audience measurement is stored on your device for a maximum of 6 months, after which the website asks you to choose again.

6. Your rights

Under the GDPR, you have the following rights:

• the right of access to your data;
• the right to rectification;
• the right to erasure (« right to be forgotten »);
• the right to restriction and to object to processing;
• the right to portability of your data;
• the right to withdraw your consent at any time.

To exercise these rights, write to us at info@nideworks.be. You also have the right to lodge a complaint with the Data Protection Authority (APD, Belgium) — autoriteprotectiondonnees.be.

The « Manage my preferences » button available on the website allows you to withdraw or give consent as easily as when you first made your choice. Withdrawal blocks all new PostHog events. Global Privacy Control and « Do Not Track » signals are also respected: when active, the PostHog module is not loaded.

7. Cookies

The use of cookies is described in our Cookie Policy.

8. Security

The website is served over a secure connection (HTTPS). We implement reasonable measures to protect your data against unauthorised access: restricted access to submissions and attachments, private storage, format and volume checks, opaque references without contact details and temporary download links issued after checking management's access rights.

9. Pro Portal

Depending on the user's role, the Pro Portal processes identity and contact data, professional accounts, hours and site assignments, absences and leave, site photographs and, for the persons concerned, remuneration, fuel and machine-use data. These processing operations serve the performance of employment or contractual relationships, operational site monitoring and compliance with applicable social, accounting and safety obligations.

The portal uses Supabase as its technical service provider. The project is hosted in the European Union (AWS region eu-west-1). Access is authenticated and restricted by role: each user may consult only the information necessary for their function. Retention follows the duration of the relevant relationship and then the statutory periods applicable to each category of document. The detailed notice, including the procedure for deleting an account, is available on the page Pro Portal Privacy.

10. Changes

This policy may be updated. The date of the last update appears at the top of this page.