Who we are
This privacy policy applies to the processing of personal data by Fourfront BV, a Belgian performance marketing agency with offices in Lochristi (near Ghent) and registered office in Elsene. We are the controller within the meaning of the General Data Protection Regulation (GDPR).
- Company name
- Fourfront BV
- Office address
- Oudeburgse Sluis 9, 9185 Lochristi, Belgium
- Registered office
- Louizalaan 367, 1050 Elsene, Belgium
- Company number
- BE 0781.631.146
- Contact
- hello@fourfront.be
Do you have a question about your personal data or want to exercise a right? Feel free to email us at the address above. We reply within 30 days.
What data we process
We only process what we really need. Depending on how you get in touch with us, this includes:
Visitors to our website
- Technical data: IP address (pseudonymized), browser, device, language, referrer
- Behavioral data: pages visited, clicks, scroll depth, session duration (via analytics)
- Cookies and similar technologies (see section 5)
When you use the contact form or email us
- Name and email address
- Company name (if provided)
- The content of your message
- Any attachments or follow-up correspondence
When you subscribe to our newsletter
- Email address and first name
- Sign-up date, IP and source (as opt-in proof)
- Engagement data: opens, clicks, unsubscribes
When you become a client
- Identification and contact details of the contact persons at your organization
- Company details: company number, VAT number, billing address
- Financial data: bank account, invoices, payment history
- Access to advertising, analytics or CRM platforms we manage for you
Why we process it
Every processing activity has a clear purpose:
- Service delivery. To run campaigns, tracking, automation and strategy for you.
- Communication. To answer your questions, prepare quotes and follow up on the partnership.
- Invoicing and administration. To invoice engagements and meet our accounting obligations.
- Marketing. To send you our newsletter or share relevant case studies, only if you have given consent or as an existing client.
- Improving our site. To understand, in aggregate, which content works and where visitors drop off.
- Legal obligations. Including tax and accounting, and to respond to legitimate requests from government authorities.
On what basis we process
The GDPR requires every processing activity to rest on one of six legal grounds. For us, these are:
- Performance of the contract: for everything needed to deliver our services to clients.
- Consent: for non-essential cookies, marketing tracking and the newsletter. You can always withdraw consent.
- Legitimate interest: for securing our systems, improving our site, and business communication to existing clients about similar services.
- Legal obligation: including retaining invoices and accounting records.
Who we share data with
We never sell your data. We only share it with parties that help us deliver our services or where we are legally required to. We sign a data processing agreement with all our processors in accordance with Article 28 of the GDPR.
Our main processors
- Google: Workspace (mail, documents), Analytics 4, Tag Manager, Ads. For productivity, analytics and ad platforms.
- Meta Platforms: Facebook/Instagram Ads and Meta Pixel. For campaigns and remarketing.
- LinkedIn: LinkedIn Ads and Insight Tag. For B2B campaigns.
- HubSpot: CRM, marketing automation and website tracking.
- Klaviyo: Email & marketing automation for our clients and our own newsletter.
- Hosting and infrastructure partners within the European Economic Area.
- Accounting firm and accountant for legally required administration.
We may also share data when legally required, for example at the request of a supervisory authority or the judiciary.
Transfers outside the EU
Some of our processors (such as Google, Meta, LinkedIn and HubSpot) are based in the United States. When personal data is transferred to countries outside the European Economic Area, we ensure appropriate safeguards, typically via the EU-US Data Privacy Framework, the European Commission's Standard Contractual Clauses, or a combination of both.
How long we keep data
We keep your data no longer than necessary for the purposes for which we process it. Specifically:
- Contact requests that do not lead to an engagement: 12 months after last contact.
- Client data and engagement files: up to 7 years after the end of the partnership (legal retention period for accounting and tax).
- Invoices and accounting records: 10 years (legal obligation).
- Newsletter subscriptions: until you unsubscribe or after 24 months of inactivity, whichever comes first.
- Analytics: 14 months, then aggregated.
- Job applications: up to 2 years with your consent, otherwise a maximum of 6 months.
How we secure data
We take appropriate technical and organizational measures to protect your personal data against loss, unauthorized access or misuse. Including: encryption in transit (TLS) and at rest, two-factor authentication on all work accounts, strict role-based access control, structured backups, a confidentiality obligation for all employees, and regular internal reviews of our processes.
Should a data breach occur despite all precautions that poses a risk to your rights and freedoms, we report it within 72 hours to the Belgian Data Protection Authority and, if required, to you.
What rights you have
Under the GDPR you have a number of rights regarding your personal data:
- Access: know which of your data we process.
- Rectification: have incorrect or incomplete data corrected.
- Erasure: have data deleted, insofar as we are not legally required to keep it.
- Restriction: have processing restricted pending a decision.
- Objection: object to processing based on legitimate interest or for direct marketing.
- Portability: receive your data in a structured format or have it transferred.
- Withdraw consent: when processing is based on your consent, you can withdraw it at any time without affecting processing carried out before the withdrawal.
Exercise a right?
Email your request to hello@fourfront.be. We reply within 30 days. To avoid sending data to someone other than you, we may ask to verify your identity.
File a complaint
Not happy with how we handle your data? Let us know first. We prefer to resolve everything through dialogue. If we can't work it out together, you can file a complaint with the Belgian Data Protection Authority:
- Address
- Drukpersstraat 35, 1000 Brussels
- Phone
- +32 (0)2 274 48 00
- contact@apd-gba.be
Changes to this policy
This privacy policy may be updated from time to time, for example when we start using a new tool or when legislation changes. The most recent version is always on this page, with the date of the last change at the top. In case of material changes, we actively inform existing clients and subscribers.
Any questions?
Do you have questions, comments or feedback about this privacy policy? We'd love to hear from you.
A question about your data?
Email us directly. You'll get an answer from a real person, not a ticketing system.