Privacy Policy

We make every effort to comply with applicable data protection legislation, particularly the General Data Protection Regulation (GDPR) and related Belgian legislation. We strive to always process your personal data with due care and confidentiality.

This privacy statement informs you about how and why we process your personal data, to whom we may disclose it, what your rights are, and who to contact for more information.

This website may contain links to external websites. Although we try to link only to safe sites, we are not responsible for the content or data protection practices of those external sites.

Personal Data We Process

Numa processes personal data because you use our services and/or because you provide it to us directly. Below is an overview of the personal data we may process:

• First and last name
• Email address
• Phone number (if provided)
• Company name and job role (if provided)
• Other personal data you actively provide, for example by filling in details on this website, in correspondence, or by phone

Special and/or Sensitive Personal Data

Our website and services do not intend to collect data about visitors under 16 years old unless they have consent from a parent or guardian. We cannot verify a visitor's age. We therefore recommend that parents be involved in their children's online activities. If you believe we have collected personal data about a minor without such consent, please contact us at Sven.deconinck@numachange.org and we will delete this information.

Purpose and Legal Basis for Processing

Numa processes your personal data for the following purposes:

• Managing your waitlist registration and communicating your place in the queue
• Providing, improving, and operating the Numa service
• Sending product updates, newsletters, and announcements (based on your consent)
• Responding to inquiries and providing customer support
• Complying with legal obligations

The legal bases for processing are: performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), your consent (Art. 6(1)(a) GDPR), and our legitimate interests in operating and improving the service (Art. 6(1)(f) GDPR).

How Long We Keep Personal Data

Numa will not retain your personal data longer than strictly necessary for the purposes for which it was collected. As a general rule, we retain account and waitlist data for 3 years after your last interaction with us, unless a longer retention period is required by law or you request earlier deletion.

Data Infrastructure and Storage

Numa is built on Google Firebase for authentication and real-time data functionality, and Google Cloud Platform (GCP) for backend infrastructure and data storage. All data is stored within Google Cloud regions located in the European Economic Area (EEA) to ensure GDPR-compliant data residency.

Google acts as a data processor on our behalf and is bound by a Data Processing Agreement with Google LLC. For more information, see Google Cloud Privacy.

Sharing Personal Data with Third Parties

Numa only shares personal data with third parties where necessary to deliver our services or to comply with a legal obligation. We do not sell your personal data. Current third-party processors include:

• Google LLC — Firebase authentication, Cloud Firestore database, and Cloud Storage (GCP), processed under standard contractual clauses
• Email delivery providers — for transactional and newsletter communications

When transferring data outside the EEA (e.g., to Google in the US), we rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission.

Cookies and Similar Technologies

Numa uses functional and analytical cookies. A cookie is a small text file stored in your browser when you first visit this website.

• Functional cookies — necessary for the website to work correctly and to remember your preferences (e.g., cookie consent).
• Analytical cookies — help us understand how visitors use the site so we can improve it. These are used only with your consent.

On your first visit, we inform you about these cookies and ask for your consent before placing non-essential ones. You can withdraw consent or manage cookies at any time through your browser settings.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, send a request to Sven.deconinck@numachange.org. We may ask you to verify your identity before processing the request. We will respond within 4 weeks.

You also have the right to lodge a complaint with the Belgian Data Protection Authority: dataprotectionauthority.be.

How We Secure Personal Data

Ethercentrum vzw takes data security seriously and implements appropriate technical and organisational measures to prevent misuse, loss, unauthorised access, unwanted disclosure, and unauthorised modification. These measures include encrypted connections (HTTPS/TLS), access controls, and security features provided by Google Firebase and GCP.

If you believe your data is not properly secured or you suspect misuse, please contact us immediately at Sven.deconinck@numachange.org.

Changes to This Privacy Policy

We may update this privacy statement from time to time. We will update the revision date at the top of this page with each modification. We encourage you to review this page periodically to stay informed of any changes.