Data Protection Notice

Last updated: 27 September 2026

Tymans Group BV processes personal information in compliance with this privacy statement. For further information, questions or comments on our privacy policy, please contact Gert Taeymans at https://tymansgroup.com/gdpr-contact.

Who we are

Tymans Group BV (formerly Gert Taeymans BVBA)
Koning Albertstraat 136, 2070 Burcht, Belgium
Company number: BE 0685.974.694
Email: dataprivacy@tymansgroup.com

Purposes and legal basis of the processing

Tymans Group BV processes personal data for the following purposes:

Client and engagement management: contact details of client representatives, engagement correspondence, invoicing and bookkeeping. Legal basis: performance of a contract or steps taken at your request before entering into one (Article 6(1)(b) GDPR), and compliance with our legal obligations for bookkeeping and invoicing (Article 6(1)(c) GDPR).
Responding to enquiries: the information you send us through our contact forms or by email, to answer your question. Legal basis: Article 6(1)(b) GDPR where your enquiry relates to a possible engagement, otherwise our legitimate interest in responding to people who contact us (Article 6(1)(f) GDPR).
Creditworthiness check of new clients: before accepting a new client, we manually consult publicly available company and credit information from business information providers such as Companyweb, OpenTheBox and Dun & Bradstreet. This may include personal data of company directors or of sole traders. Legal basis: our legitimate interest in assessing the financial reliability of prospective clients (Article 6(1)(f) GDPR).
Occasional email updates: see "Direct marketing" below.
Security of our website: see "Hosting and website operation" and "Contact forms" below.

We do not use your personal data for profiling, automated decision-making or personalised advertising.

Recipients of personal data

We share personal data only where this is necessary for the purposes above, with the following categories of recipients:

our external accountant, for bookkeeping and tax compliance;
legal and tax advisors, where their advice is required;
subcontracted consultants who work with us on a client engagement, bound by confidentiality obligations;
our IT service providers: our website hosting provider, Microsoft (email, document storage and collaboration through Microsoft 365) and Cloudflare (see below).

Service providers that process data on our behalf do so under a data processing agreement and are required to take appropriate technical and organisational measures to protect it. We do not sell personal data.

Hosting and website operation

This website is hosted on servers located within the European Union. Fonts are served from our own server. We do not use analytics, advertising or social media tracking tools on this website.

When you visit the site, your browser loads an icon library (Font Awesome) from cdnjs, a content delivery network operated by Cloudflare, Inc. To deliver these files, Cloudflare necessarily receives your IP address and technical information about your browser. We rely on our legitimate interest in the reliable and efficient delivery of this website (Article 6(1)(f) GDPR).

Contact forms

When you submit a form on this website, we process the information you enter in order to respond to your request (Article 6(1)(b) GDPR where your request relates to a possible contract, otherwise Article 6(1)(f) GDPR). To protect our forms against spam and automated abuse, we use Cloudflare Turnstile, a service of Cloudflare, Inc. Turnstile processes your IP address and technical information about your browser and device to distinguish human visitors from automated traffic. We rely on our legitimate interest in keeping our website and communication channels secure (Article 6(1)(f) GDPR).

Transfers of personal data outside the EU

We use Microsoft 365, contracted through Microsoft Ireland Operations Limited, for email, document storage and collaboration. Microsoft stores this data in the EU under its EU Data Boundary commitments. In limited cases, however, such as support or security operations, data may be accessed by or transferred to Microsoft Corporation in the United States. We also use the services of Cloudflare, Inc., a US company, as described above.

Both Microsoft Corporation and Cloudflare, Inc. are certified under the EU-US Data Privacy Framework (DPF). The European Commission adopted this framework as an adequacy decision on 10 July 2023, after the Court of Justice of the European Union invalidated the earlier EU-US Privacy Shield in July 2020 (Schrems II, C-311/18). In September 2025 the EU General Court upheld the DPF (Latombe v Commission, T-553/23). That judgment is under appeal before the Court of Justice, so the framework's long-term validity is not yet settled. Our contracts with Microsoft and Cloudflare also include the European Commission's Standard Contractual Clauses as an additional safeguard.

Apart from these providers, we do not transfer personal data outside the European Economic Area.

We follow developments in case law and the guidance of the European Data Protection Board and the Belgian Data Protection Authority. We will adapt our practices and this policy if the legal situation changes.

Retention period

Client and invoicing data are kept for as long as required by Belgian accounting and tax law, currently 10 years after the end of the financial year concerned.
Engagement correspondence and documents are kept for the duration of the engagement and as long afterwards as needed to deal with possible claims.
Enquiries that do not lead to an engagement, including form submissions and the related creditworthiness check, are deleted within 12 months.
Contact details used for occasional email updates are kept until you object, and in any case no longer than 3 years after our last contact with you.

Your rights

You have the right at all times to access your personal data, to have it corrected if it is incorrect or incomplete, to have it erased, and to restrict its processing. You have the right to object to processing based on our legitimate interest (Article 6(1)(f) GDPR). You are also entitled to receive a copy of the personal data you provided to us and to have it transmitted to another organisation.

Personal data that we are legally required to keep, such as invoicing and bookkeeping records, cannot be erased before the end of the legal retention period.

To exercise these rights, please send an email to dataprivacy@tymansgroup.com.

Direct marketing

We occasionally email clients and business contacts about services similar to those we have provided or discussed with them. Legal basis: our legitimate interest (Article 6(1)(f) GDPR). Every such email includes a simple way to unsubscribe, and you can object at any time, free of charge, by writing to dataprivacy@tymansgroup.com.

Complaint

You have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, +32 2 274 48 00, www.dataprotectionauthority.be.