Privacy Policy

Cultura Impact Lab SRL
Last updated: June 2026

1. Who We Are

The data controller for this website is:

Cultura Impact Lab SRL
Rue d’Édimbourg 26
1050 Bruxelles, Belgium
Email: the contact form on www.culturaimpactlab.com
Website: www.culturaimpactlab.com

When we say “we”, “us” or “our” in this policy, we mean Cultura Impact Lab SRL.

2. What Data We Collect and Why

2.1 Contact Form

When you fill out the contact form on our website, we collect:

Your name
Your email address
The subject of your message
The content of your message

Why: We use this information solely to read and respond to your inquiry. We do not use it for marketing purposes unless you explicitly ask us to stay in touch.

Legal basis: Article 6(1)(b) GDPR — processing is necessary to take steps at your request prior to entering into a contract, or Article 6(1)(f) GDPR — our legitimate interest in responding to business inquiries.

Retention: We keep contact form submissions for a maximum of 7 years, in line with Belgian commercial record-keeping requirements.

2.2 Server Logs

When you visit our website, our hosting provider (Infomaniak, Switzerland) automatically records standard server log data, including:

Your IP address (anonymised — only the first two octets are retained, e.g. 192.168.x.x)
Date and time of the request
URL requested
HTTP status code
Browser type and operating system

Why: For the technical operation and security of the website. These logs help detect errors and protect against malicious activity.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in maintaining a secure and functioning website.

Retention: Server logs are retained by Infomaniak in accordance with their own data retention policy.

2.3 Website Analytics (Matomo)

We use Matomo Analytics, an open-source web analytics platform hosted on hosting infrastructure provided by Infomaniak (Switzerland). We have enabled cookieless tracking, which means:

No cookies are placed on your device
No persistent identifier is assigned to you
No personal data is transferred to any third party
All data is anonymised and aggregated

The analytics data we collect includes: approximate country/city of origin, pages visited, time spent on pages, referral source (e.g. a search engine or social network), device type, browser, and operating system.

Why: To understand how our website is used and improve the user experience.

Legal basis: Because Matomo operates in cookieless mode and processes only anonymised, aggregated data, no personal data as defined under GDPR is involved in this processing. No consent is required.

3. Who We Share Data With

We do not sell, rent or trade your personal data to any third party.

Your data may be processed by the following service providers acting as data processors on our behalf:

Infomaniak Network SA (Switzerland) — our hosting provider. Infomaniak is a Swiss company operating under a Data Processing Agreement with us, in compliance with GDPR Article 28.

We may also disclose your data if required by law or by a competent authority.

4. Data Transfers Outside the EU/EEA

All data is stored on infrastructure located in Switzerland, which the European Commission has recognised as providing an adequate level of data protection (adequacy decision under Article 45 GDPR). We do not transfer personal data to countries that lack an equivalent level of protection.

5. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Access — you can request a copy of the data we hold about you.
Rectification — you can ask us to correct inaccurate or incomplete data.
Erasure — you can ask us to delete your data (“right to be forgotten”).
Restriction — you can ask us to limit how we use your data.
Portability — you can request your data in a structured, machine-readable format.
Objection — you can object to processing based on legitimate interest.
Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at: the contact form on www.culturaimpactlab.com

We will respond within 30 days of receipt of your request. For complex or multiple requests, this period may be extended by a further two months; in such cases we will notify you within the first 30 days. We may ask you to verify your identity before processing your request.

6. Complaints

If you believe we are not handling your data correctly, you have the right to lodge a complaint with the Belgian data protection authority:

Autorité de Protection des Données (APD)
Rue de la Presse 35, 1000 Bruxelles, Belgium
Website: www.dataprotectionauthority.be
Email: contact@apd-gba.be

7. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect any changes. We encourage you to review this page periodically.

8. Contact

For any questions about this Privacy Policy, contact us at:
the contact form on www.culturaimpactlab.com