Privacy policy
How Weby Design handles personal data under the GDPR.
Last updated: 20 October 2026
Data controller
Public Management Advisors S.R.L., operating as Weby Design, is the controller for the activities described here. Contact details appear in the legal notice and footer.
- Trading name
- Weby Design
- Legal entity
- Public Management Advisors S.R.L.
- Registered office
- Venelle Mozart 10, 1083 Ganshoren, Belgique
- Register
- RPM Bruxelles
- Company / VAT number
- BE 0607.959.970
- Phone
- +32 499 25 97 98
Data processed
Depending on how the service is used: name, email, phone, professional status, company name, registration/VAT number, billing address, project files and messages, quotes, signatures and audit trail, invoices, session identifiers and technical logs. Full card details are processed by the payment provider, not stored by Weby Design.
Purposes and legal grounds
- Pre-contractual steps and contract: enquiries, quotations, accounts and project delivery.
- Legal obligations: invoicing, accounting records and tax compliance.
- Legitimate interests: account security, abuse prevention and support, subject to balancing of rights.
- Consent: optional audience measurement and marketing communications.
Service providers and third parties
The current code and configuration identify Supabase/Lovable Cloud (database, authentication and application hosting), Resend (email), Odoo (invoicing), Stripe (payments currently in TEST mode), and Google, Apple or Microsoft if you choose their sign-in option. The Weby assistant may use Lovable AI to process requests you send it. Google Analytics is configured but audience measurement requires your consent.
Depending on their role, these services may act as processors or independent controllers. The data they access depends on the features you use. Their precise retention periods, processing locations and contractual safeguards must be checked with each supplier; a technical connection alone does not establish those facts.
Some visual resources are currently loaded directly from third-party sites: fonts from Google Fonts and an Earth photograph from Wikimedia Commons. These requests may disclose connection data, such as the IP address, to those operators. They are not equivalent to consent to marketing cookies. The providers' processing terms must be checked before launch.
Recipients and international transfers
Access is limited to authorized team members and providers for their tasks. Transfers outside the EEA must rely on GDPR safeguards (adequacy decisions, standard contractual clauses and supplementary measures where needed). We do not sell personal data to advertisers.
Retention and security
Account and project data are kept during the relationship and as needed for obligations or potential claims. Accounting and tax records follow statutory periods. Inactive enquiries are erased or anonymised once no longer needed. Access controls and technical safeguards are applied, but zero risk cannot be promised.
Your rights
Under the GDPR, you may request access, rectification, erasure, restriction and portability and object to certain processing. You may withdraw consent at any time without retroactive effect. Contact us using the details shown. You may also lodge a complaint with the Belgian Data Protection Authority.
Estimates and human review
Configurator results are non-binding estimates. No final quote is issued without human review. We do not describe fully automated decisions producing comparable legal effects in this process.