Privacy policy concerning the processing of customer and website user personal data
Indao (SA) (hereinafter “we”, “us” and “our”) understands the importance of respecting your privacy and protecting the personal data of its customers and website visitors. This policy explains how we collect, use and protect your personal data.
Scope
This website is managed by Indao (SA), whose registered office is located at Rue de l’Académie 53, 4000 Liège, Belgique and whose CBE number is 0478.472.789. We act as the data controller when we process the personal data of our customers and website users.
We believe it is important to create and maintain an environment in which our customers and website users can be confident that their information will not be misused. We comply with applicable data protection regulations, including Regulation (EU) 2016/679, also known as the General Data Protection Regulation (GDPR), and Belgian data protection legislation. These rules protect your personal data and grant you rights in relation to it.
The purpose of this policy is to explain what personal data we collect, how we use it after you visit our website and the safeguards that apply to its processing.
This policy and the terms of use apply when you visit our website. The application of any terms other than those set out here is expressly excluded unless we have agreed otherwise in writing in advance. In that case, this policy continues to apply alongside the specific agreement.
Use of the website and its content is only permitted in full compliance with these provisions. If you do not accept or comply with them, you must stop using the website and its content.
What personal data do we collect?
Most of our website can be accessed without providing personal data.
When you use our forms, request information or a quotation, or otherwise contact us, including by telephone, email or at a trade fair or event, we may collect:
- your first name, surname and form of address;
- your contact details, including your email address, telephone number and address;
- your company, position and professional contact details;
- the content of your request and any information you choose to provide.
We may also process technical data obtained through the website or your device:
- your IP address, the approximate location that may be inferred from it, browser type, operating system, access date and time and pages viewed;
- data collected using cookies, web beacons or similar technologies, including the website visited before or after our website and how you navigate between its pages;
- data from third-party services when you choose to interact with them or ask us to share information with them.
Further information about these technologies is available in our cookie policy.
We may also consult publicly available information to verify data already collected, manage the commercial relationship or develop our activities.
Why do we collect this information and on what legal basis?
We only process your data where a legal basis under the GDPR permits us to do so. The main purposes, categories of data, legal bases and retention periods are detailed below.
| Purpose | Personal data | Legal basis | Retention period |
|---|---|---|---|
| Responding to requests for information, contact or quotations | Name, contact details, company, position and content of the request | Pre-contractual measures and legitimate interest in responding to requests | For the time required to process the request, followed by archiving in accordance with applicable statutory periods |
| Customer relationship management and provision of services | Name, contact details, position, business address and contractual data | Performance of a contract and legitimate interest | 10 years after the end of the commercial relationship |
| Compliance with accounting, tax and legal obligations | Identification, contractual and invoicing data | Legal obligation | For the period required by applicable legislation |
| Verification of information required for payments for our products or services | Identification, contractual, financial and invoicing data | Performance of a contract and legal obligation | 10 years after the end of the commercial relationship, subject to applicable statutory periods |
| Improvement of our products and services and handling of complaints | Contact details, contractual data, communications and the content of the complaint | Performance of a contract and legitimate interest in improving our services and defending our rights | For the time required to process the matter, followed by retention in accordance with applicable limitation periods |
| Prevention, detection and reporting of fraud, security incidents or unlawful activity | Identification data, technical data, security logs and incident-related information | Legitimate interest in securing our activities and legal obligation, where applicable | For the time required to analyse the incident, followed by retention in accordance with applicable statutory periods |
| Direct marketing to customers | Name and contact details, including email address | Legitimate interest | 1 year after the end of the commercial relationship |
| Direct marketing to prospects | Name and contact details, including email address | Consent | 1 year or until consent is withdrawn |
| Market research and surveys concerning our products or services | Name, contact details, company, position and responses provided | Consent or legitimate interest where you are already a customer | 1 year or until consent is withdrawn or the right to object is exercised |
| Specific purposes stated in a website form, written communication or email | Data identified in the relevant form or communication | Legal basis stated when the data is collected | Period stated when the data is collected or strictly necessary for the announced purpose |
| Audience measurement, website security and improvement | IP address, technical data, browsing data and cookies | Consent for non-essential cookies; legitimate interest or legal obligation for security | According to the periods stated in the cookie policy and applicable security logs |
How do we use and share your data?
We use your data to respond to requests, provide and improve our services, verify information required for payments, handle complaints, manage commercial relationships, secure the website, prevent fraud and incidents, comply with legal obligations and, where permitted, inform you about our activities or contact you for market research.
We may share strictly necessary data with:
- our service providers, including hosting, maintenance, data analysis, marketing support and customer service providers;
- our professional advisers, insurers and auditors;
- third parties with whom you have asked us to share your data or with whom you have chosen to interact;
- public authorities, courts or supervisory bodies where required by law;
- a potential buyer or adviser in the event of a reorganisation, merger or sale of our business.
These recipients may only access data to the extent necessary to perform their duties and may not use it for other purposes. Your personal data will not be sold or leased to third parties.
We may also disclose your data to enforce this policy, comply with our legal obligations, respond to a request from a public, regulatory or judicial authority, protect security or act in the public interest. Disclosure may also take place in connection with current or potential legal proceedings or to protect our property, safety, personnel and other rights and interests.
If all or part of Indao (SA)’s business is sold, merged, reorganised or transferred, your data may be disclosed to the advisers of a potential buyer and subsequently transferred to the new owners. We will take appropriate measures to preserve the integrity and confidentiality of your data. Its use will remain subject to this policy.
Transfer of your personal data outside the European Economic Area
Some service providers, including Google or Microsoft, may process data in countries outside the European Economic Area, including the United States, when their audience measurement, analysis, advertising, security or collaboration services are activated.
A transfer to a country outside the EEA is carried out in accordance with applicable data protection rules. It may in particular be based on an adequacy decision by the European Commission confirming that the country concerned provides an adequate level of protection.
Where the recipient country does not provide an equivalent level of protection, we put appropriate safeguards in place, such as the European Commission’s standard contractual clauses, accompanied by additional measures where necessary. In specific circumstances permitted by law, we may also ask for your prior consent.
You may contact us using the procedure described under “Rights of the data subject” for further information about these transfers and the safeguards applied.
Rights of the data subject
Data protection legislation grants you various rights so that you can retain sufficient control over the processing of your personal data.
Right of access
You may obtain confirmation as to whether we process your data and, where applicable, request access to it.
Where this information is not already included in this policy, we will inform you in particular about:
- the purposes of the processing and the categories of personal data concerned;
- the recipients or categories of recipients to whom the data has been or will be disclosed;
- transfers to third countries or international organisations;
- the intended retention period or the criteria used to determine it;
- the rights available to you in relation to your personal data;
- the source of the data where it was not collected directly from you;
- the existence of automated decision-making, including profiling, and meaningful information about the logic involved and the intended consequences.
We will provide a copy of the personal data we hold about you. If you make repeated or disproportionate requests for additional copies, we may charge a reasonable fee based on the administrative costs involved.
Right to rectification
You may ask us to correct or complete any inaccurate or incomplete personal data.
Right to erasure
You may request the deletion of your data where the conditions laid down by law are met, in particular where the processing is no longer necessary or does not comply with data protection legislation.
Right to restriction of processing
You may request that processing be restricted where:
- you dispute the accuracy of the data, for the period required to verify it;
- the processing is unlawful and you oppose erasure of the data;
- we no longer need the data, but you require it for the establishment, exercise or defence of legal claims;
- you have objected to the processing, pending verification of whether our legitimate grounds override yours.
Right to data portability
Where processing is based on your consent or a contract and is carried out by automated means, you may receive the data you provided in a structured, commonly used and machine-readable format or request its transfer to another data controller.
Right to object
You may object at any time to the processing of your personal data for direct marketing purposes, including profiling related to such marketing.
You may also object to processing based on our legitimate interests for reasons relating to your particular situation. We will then cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless processing is required for the establishment, exercise or defence of legal claims.
Automated individual decision-making
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.
This right does not apply where the decision is authorised by law, is necessary for entering into or performing a contract between you and us, or is based on your explicit consent. In the latter two cases, you may request human intervention, express your point of view and contest the decision.
Right to withdraw consent
Where processing is based on your consent, you may withdraw it at any time by contacting us by email, without affecting the lawfulness of processing carried out before withdrawal. Each marketing communication also provides a way to unsubscribe.
Procedure for exercising your rights
To exercise your rights or obtain further information, contact Indao (SA) at info@indao.ai or by telephone at +32 4 225 58 10. We may ask you to verify your identity where necessary to protect your data.
In certain circumstances provided for by data protection legislation, we may refuse access to particular information or may be unable to grant all or part of a request. We will inform you of that decision and the reasons for it to the extent permitted by law.
You may lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, at contact@apd-gba.be.
Security
We implement reasonable technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss or alteration and against unauthorised disclosure of or access to data that is transmitted, stored or otherwise processed.
As the internet is an open network, we cannot guarantee that unauthorised third parties will never be able to circumvent these measures or use your personal data for inappropriate purposes.
Our website may contain links to third-party websites. We are not responsible for their content or their privacy standards and practices. We recommend that you read their own policies before accepting their cookies, visiting their websites or providing them with personal data.
Terms of use and liability
Rights to the website and content – permitted use
The website and the content available on it, including texts, images, videos, data, software, brands and trade names, are protected by intellectual property rights belonging to Indao (SA) or its licensors.
You are granted a personal, non-exclusive and non-transferable right to consult the website and its content for your own use. We may revoke this right at any time. Any other use, including reproduction, modification, publication or distribution, is prohibited without our prior written permission or that of the relevant rights holder.
Prohibited use
You undertake not to use the website or its content:
- unlawfully or for unlawful purposes;
- in a way that damages, modifies, interrupts, stops or impairs its operation;
- to distribute viruses, malicious software or content that is offensive, obscene, threatening or inconsistent with the intended use of the website;
- in a way that infringes our rights or those of third parties, including privacy, data protection or intellectual property rights;
- to display or send promotional or advertising messages without our prior approval and without the consent required from the recipient.
Liability
We take reasonable steps to keep the information we publish as complete, correct and current as possible, but cannot guarantee that it is entirely free from errors. The information is not directed at a specific person or organisation and may therefore not be complete, relevant or suitable for a particular situation.
The published information does not constitute professional or legal advice. You should consult an expert where necessary. You are responsible for your use of the website and its information. To the extent permitted by law, we accept no liability for damage resulting from incorrect or incomplete information.
We endeavour to limit technical malfunctions, but errors or interruptions affecting the website’s availability or operation may occur. The website and its content are provided “as is” and we do not guarantee permanent availability.
External links lead to websites over which we have no control. We accept no responsibility for their availability or content, or for damage resulting from their use.
Applicable law and competent courts
Belgian law applies to our website, this policy and any related disputes. Subject to applicable mandatory rules, the courts of the judicial district of Liège shall have jurisdiction.
Changes to this policy
Indao (SA) may change and update this policy so that it continues to reflect how personal data is processed. The updated version will be published on this page and will take effect immediately upon publication.
We recommend that you consult this page regularly to remain informed about the data we collect and process, how and under what circumstances it is used and when it is shared with third parties.
Version: August 2026