1. Data Controller
BXLOVE NEWS PRESSE IA ASBL — BCE 0747.549.997 — Rue des Pierres 31/04, 1000 Brussels (Grand-Place).
Personal data contact: bernardfrisque@hotmail.com — Tel. 0460 95 15 50.
2. Principles
We apply the GDPR principles: lawfulness, minimisation, transparency, purpose limitation, accuracy, integrity and limited storage period. No data is sold, rented or shared for advertising purposes.
3. Data Processed, Purposes, Legal Basis and Retention Period
3.1 Anonymised Internal Audience Measurement (all pages)
- Data: page visited, referring page (referrer), browser language, country/region/city derived from the IP address at the time of the request, user-agent. The IP address itself is not stored.
- Purpose: aggregated audience statistics, measurement of editorial reach. No individual profiling, no advertising cookies, no third-party tracking cookies.
- Legal basis: legitimate interest (Art. 6.1.f GDPR) — processing is strictly necessary, proportionate and anonymised.
- Hosting: internal infrastructure located in the European Union (Frankfurt).
- Retention period: 13 months maximum, then automatic deletion.
3.2 Newsletter (feature currently being implemented)
- Data: email address, preferred language, subscription date.
- Purpose: sending an editorial newsletter with a target frequency of once a week.
- Legal basis: explicit consent (Art. 6.1.a GDPR), with double opt-in confirmation and one-click unsubscription from every email.
- Retention period: until unsubscription, then deletion within 30 days.
3.3 'Suggest an Idea' Form
- Data: name (optional), email (optional), message content, possible municipality.
- Purpose: to process your editorial suggestion and, where applicable, to respond.
- Legal basis: consent (Art. 6.1.a GDPR) at the time of form submission.
- Retention period: 2 years after the last exchange, then deletion.
3.4 Oracle Conversations (AI assistant)
- Data: textual content of your question and the generated answer. No name or email is required to use the Oracle.
- Purpose: to answer your question and improve the quality of the assistant.
- Legal basis: legitimate interest (Art. 6.1.f GDPR) and consent by submitting the question.
- Transfer to AI models: the text of your question is sent to the inference provider (Lovable AI Gateway → Google Gemini or OpenAI) to generate the answer. Do not enter sensitive or directly identifying information.
- Provider commitment: no model training on your data, ephemeral processing.
- Retention period: 12 months, then deletion. You can request erasure at any time.
3.5 Administrator / Editor Accounts
- Data: email, hashed password, display name.
- Legal basis: legitimate interest in securing the editorial back-office.
- Retention period: for the duration of the assignment, then deletion within 6 months.
4. Processors and Transfers
- Supabase (EU — Frankfurt): hosting of the database, image storage and authentication service (EU instance).
- Lovable Technologies (Cloudflare Workers, edge infrastructure): site execution. Data in transit is encrypted (TLS 1.2+).
- Lovable AI Gateway (Google Gemini, OpenAI): generation of text and illustrations for editorial purposes, and Oracle's responses (see §3.4). Editorial prompts do not contain user personal data. The providers are contractually committed not to reuse data for training.
In the event of a transfer outside the EU by these processors, it is governed by the standard contractual clauses of the European Commission (Implementing Decision 2021/914).
5. Your Rights
You have the following rights at any time, upon simple request to bernardfrisque@hotmail.com: access, rectification, erasure ('right to be forgotten'), restriction of processing, objection, data portability, withdrawal of consent, and the right to define directives concerning the fate of your data after your death.
Response time (GDPR, Art. 12(3)): one month from the request, extendable by two further months given the complexity or number of requests, with the person informed within the first month. No automatic erasure: Article 17 and its exceptions apply. Proof of identity may be requested in the event of reasonable doubt.
6. Right to Lodge a Complaint
You can lodge a complaint with the Data Protection Authority (DPA), Rue de la Presse 35, 1000 Brussels — autoriteprotectiondonnees.be.
7. Security
Passwords are stored in hashed form via the Supabase authentication service, TLS is used for all communications, RLS (Row-Level Security) is applied to the database, back-office access is restricted to authorised accounts, and editorial changes are logged.
8. Minors
The site is not intended for minors under the age of 16 and does not carry out any profiling of minors.
9. Cookies
The site does not use any advertising or third-party tracking cookies. For details, please see our cookies page.
10. Changes
This policy may be updated. Any substantial changes will be announced on the homepage for 30 days.