What we do with your data, and what we do not.

Data controller

The controller of the data collected through this site is the publisher of WorkflowArmor, identified in the legal notice, who can be reached at contact@workflowarmor.com.

Our services are for businesses, self-employed people, associations and private individuals. This page applies to all of them.

Contact and quote requests

• Data processed: what you send us through the site’s contact form, by WhatsApp, phone, email, or through the site’s bot when you ask to be called back. Through the form: your name, your email address, the type of request you choose, your message, the language of the page and the time it was sent; your phone number and your company name only if you give them, these two fields are optional.
• Purpose: to answer your request and, where relevant, to draw up a proposal. The form sends you no email: we answer you ourselves, from the agency’s mailbox.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Retention period: 3 years from the last contact. If a contract is signed, the contract and billing documents are kept for as long as the law requires.
• Where: an internal tool (n8n) installed on our servers, hosted in France by OVH; the agency’s mailbox; an alert on the publisher’s phone through Telegram when the request comes from the form or the bot (see “Telegram” below). When the form works normally, n8n passes your request on without keeping it: the lasting record is the email received in the agency’s mailbox. If a technical error occurs while sending, the request is kept for at most 14 days in n8n to understand the fault, then erased.
• Against abusive sending: to limit the number of requests sent from the same email address (three per rolling 23 hours), the form keeps a fingerprint calculated from your address, never the address itself, with the time of each sending. It is erased automatically at the latest 24 hours after your request. This fingerprint serves that purpose only. Legal basis: our legitimate interest in protecting the form and our mailbox against bulk sending (Art. 6(1)(f) GDPR).

Free website audit

• Data processed: the address of the site you submit, your email address, and a copy of that site’s publicly accessible home page. If you arrive through an advertisement, we also keep with the request Google’s click identifier (“gclid”) and the name of the source and campaign that brought you, to know which advertising works.
• Purpose: to produce the audit report and send it to you.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for the click identifier and the campaign, our legitimate interest in measuring our advertising (Art. 6(1)(f)).
• What we do not do: no access to your site is requested or used. We only read the home page, as a visitor sees it. We do not send the click identifier back to Google today; if that changes, this page will be updated beforehand.
• Retention period: 3 years from the request, as for a contact.
• Where: n8n on our servers at OVH; the report is sent by email from the agency’s mailbox, with a copy kept in that mailbox; an alert goes out through Telegram (see below).

The site’s bot

The bot that answers on this site is an artificial intelligence, and it says so in its very first sentence. It only opens if you click on it.

• What is processed: the messages you write and the bot’s answers.
• Purpose: to answer your questions about our services and prices and, if you ask, to take your contact details so that we can call you back.
• Legal basis: our legitimate interest in answering a question you put to us (Art. 6(1)(f) GDPR); when you ask to be called back, steps taken before entering into a contract (Art. 6(1)(b)).
• Who runs the model: your messages are sent to Anthropic Ireland, Limited, which provides the artificial intelligence model through its application programming interface (API) and has it run by its parent company Anthropic, PBC, in the United States. This processing takes place outside the European Union, mainly in the United States. The transfer relies on the European Commission’s standard contractual clauses, provided for in Anthropic’s data processing addendum.
• How long at Anthropic: Anthropic deletes the messages it receives through the API within 30 days. If a message is flagged as breaching its usage policies, it may be kept for up to two years, and the safety classification scores drawn from it for up to seven years. Anthropic does not use your messages to train its models.
• In your browser: after your first message, the conversation is kept in your browser’s session storage (“sessionStorage”), so that the thread follows you from page to page. It is erased when you close the tab. This storage only serves to display the conversation you asked for: it does not follow you and nobody else reads it. It needs no consent, because it is strictly necessary for the service you ask for.
• On our side: we do not keep the conversation, except in two cases. If a technical error occurs during the exchange, the conversation is kept for at most 14 days to understand the fault, then erased. If you ask to be called back, your name, your number, your email address, your need and the conversation are sent to us by email and through Telegram, and kept as a contact request (3 years).
• What not to share with it: no sensitive information (health, opinions, bank details, passwords).
• What its answers are worth: information. Only the written quote counts. The bot takes no decision about you.

If you do not want your contact details to go through the bot, Anthropic or Telegram, write to us directly at contact@workflowarmor.com or call us: neither channel goes through them.

Telegram, the alert on the publisher’s phone

When a request comes in through the bot, the free audit or the contact form, an alert is sent to the publisher’s phone through the Telegram messaging service, so that he can answer you quickly.

• What the alert contains: for a call-back request through the bot, your name, your number, your email address, your need, the page you are writing from and the conversation with the bot. For an audit, the site address, its score, your email address and, if you came from an advertisement, the source and campaign. For the contact form, your name, your email address, your number and your company if you gave them, the type of request, the language of the page, the time it was sent and your message.
• Legal basis: our legitimate interest in handling your request without delay (Art. 6(1)(f) GDPR). You can object to it: simply write to us directly by email or call us, instead of using the bot, the audit or the form. Neither channel goes through Telegram.
• What you should know, plainly: we have not signed any contract with Telegram governing this processing on our behalf; Telegram does not offer one to users of its bot service. Telegram processes these messages under its own privacy policy. According to that policy (version of 29 September 2024, read on 14 October 2026): the company responsible is Telegram Messenger Inc.; its representative in the European Union is the European Data Protection Office (EDPO), in Brussels; data of accounts opened from the European Economic Area is stored in data centres in the Netherlands; Telegram says it relies on the Commission’s standard contractual clauses for its transfers to its companies in the British Virgin Islands and Dubai; ordinary messages are not end-to-end encrypted. We cannot check these statements ourselves.
• Retention: the publisher deletes the alert from Telegram at the latest 30 days after receiving it. The lasting record of your request is the email, kept for 3 years.

WhatsApp contact

If you write to us on WhatsApp, your number and your messages are also processed by WhatsApp Ireland Ltd. (Meta group) under its own privacy policy, including possible transfers outside the European Economic Area. You choose this channel yourself.

Business-to-business prospecting (B2B)

We occasionally contact businesses using public business contact details, on the basis of legitimate interest (Art. 6(1)(f) and Recital 47 GDPR), within the limits of Article XII.13 of the Belgian Code of Economic Law and the Royal Decree of 4 April 2003 (generic business addresses). Every message includes a free and immediate way to opt out; any objection is respected for good through an internal suppression list.

Cookies, trackers and audience measurement

Nothing is stored in or read from your browser to measure audience until you have accepted. On your first visit, a banner asks for your choice. “Decline” is as visible and as simple as “Accept cookies”. You can change your mind at any time through the “Manage cookies” link at the bottom of every page.

• What waits for your consent: Umami, a statistics tool installed on our own servers (stats.workflowarmor.com, at OVH in France), and the counting of clicks on our contact buttons. Umami stores no cookie, but it reads information your browser sends (IP address, browser and device type, language, page visited, page you came from) to count visits. That is why we ask for your consent: Belgian law covers any access to information on your device, not only cookies. No Umami data is passed to any third party.
• Why: to know which pages are useful and which nobody reads, to improve the site. No advertising is shown or targeted with these measurements, and they are never sold or resold.
• How long: your choice is kept for 6 months (see below), then you are asked again. You can change it before then, at any time, through “Manage cookies” at the bottom of every page.
• Legal basis: your consent (Art. 6(1)(a) GDPR and Article 10/2 of the Belgian Act of 30 July 2018). Withdrawing it is as easy as giving it, and does not affect what was measured before.
• Your choice itself is kept in a small cookie named “wa-consentement”, for 6 months, so that you are not asked again on every page. It holds only your answer and its date. It needs no consent: its only purpose is to respect your choice.
• The bot’s thread in session storage is not a tracker; it is described above.

If, one day, the site measures the effect of its Google advertising, the related trackers will be added to the same banner, and this page will be updated beforehand.

Fonts

The site’s fonts are hosted on our own servers. No request is sent to Google Fonts, and your IP address is passed to no third party to display text.

Recipients and processors

No data is sold, or passed on for advertising purposes.

• OVH SAS: hosting of the site, n8n and Umami; receiving mail sent to contact@workflowarmor.com, forwarded to the agency’s Gmail mailbox. France. Processor, data processing agreement included in OVH’s contract.
• Anthropic Ireland, Limited, and Anthropic, PBC: the bot’s model. Mainly United States. Processor, data processing addendum included in Anthropic’s commercial terms, standard contractual clauses.
• Google Ireland Limited: the agency’s mailbox and sending emails. See below.
• Telegram Messenger Inc.: the alert on the publisher’s phone. The Netherlands, according to Telegram. No contract on our side, see the “Telegram” section.
• WhatsApp Ireland Ltd.: if you write to us on WhatsApp. European Union and beyond. Its own policy, a channel you choose.

Emails received at contact@workflowarmor.com arrive in a Gmail mailbox of the agency, and our replies, audit reports and alerts are sent from that mailbox. It is an ordinary Google account: Google Ireland Limited processes the messages under its own privacy policy, not as our processor under contract. Google may process this data outside the European Union.

To obtain a copy of the standard contractual clauses governing a transfer, write to us.

Your rights

You may ask for access to your data, its rectification, its erasure, the restriction of its processing, and its portability. You may object to processing based on our legitimate interest, and withdraw at any time any consent you have given. To exercise these rights: contact@workflowarmor.com. We answer within one month.

You can also lodge a complaint with the Belgian Data Protection Authority: dataprotectionauthority.be.