Privacy statement

1. Data controller

Elevate BV (BE 0746.793.793) is responsible for the processing of personal data via the Paperbox website. Get in touch via the contact form.

2. What data do we process?

The website is aimed at organisations. Data relating to business contacts is also personal data.

• Identification data: name and organisation.
• Contact details: email address and any information you share in your message.
• Communication data: subject, message, service area, estimated number of PaperBoxes and preferred timing.
• Technical data: language preference and data that may be processed in server logs during website traffic, such as IP address, browser type, pages visited and times.

3. Why, and on what legal basis?

We use contact details to answer questions and discuss a possible business collaboration.

• Legitimate interest: handling business enquiries, maintaining contact with the organisation that approaches us and keeping the website secure.
• Performance of a contract or pre-contractual steps: when a request leads to agreements with your organisation.
• Legal obligation: insofar as processing is necessary to comply with a legal obligation.
• Consent: where required for specific processing; consent can be withdrawn.

4. Retention periods

We do not keep personal data longer than necessary for the purpose for which it was collected.

• Contact enquiries: up to 24 months after they have been handled.
• Business customer data: up to 7 years after the last transaction, in line with the existing retention period for customer records.
• Technical data and logs: up to 12 months.
• Language preference: until you clear the website data in your browser.
• Google Analytics data (only with consent): 14 months.

5. Who do we share data with?

We never sell personal data. Contact requests are stored in Lovable Cloud. We may share data with processors that support hosting, storage and business services. Where required, we make arrangements on confidentiality and security. Transfers outside the European Economic Area require appropriate safeguards.

Only if you accept analytics cookies does Google Ireland Ltd., as processor, process usage data for Google Analytics 4 (website statistics, legal basis: consent). IP addresses are not stored, advertising features are disabled and data is retained for 14 months. Transfers to the US rely on the EU-US Data Privacy Framework and standard contractual clauses. You can withdraw consent via ‘Cookie settings’ in the footer.

6. Security

We take appropriate technical and organisational measures against loss, misuse and unauthorised access. Contact data storage is not publicly accessible and website connections are encrypted.

7. Your rights

Under the General Data Protection Regulation (GDPR), you may exercise the following rights, subject to the applicable conditions.

• Access to your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of data where the conditions apply.
• Restriction of processing.
• Data portability where applicable.
• Objection to processing based on legitimate interest or direct marketing.
• Withdrawal of consent where processing relies on it.

8. Requests and complaints

Send any request about your personal data via the contact form. If necessary, we will ask for information to verify your identity. You can also lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, via www.dataprotectionauthority.be.

9. Changes

This privacy statement may be updated. The most recent version and its date are shown on this page.

10. Contact

Elevate BV (BE 0746.793.793).