Privacy Policy

Last updated: 22 September 2026

Who controls your data

This website is operated by Social Runners BV, trading as The Composer, Rijksweg 449/1, 3650 Dilsen-Stokkem, Belgium. Enterprise number BE 0781.302.534.

You can reach us at hello@thecomposer.eu.

There is a second registration also trading as "The Composer," with VAT number BE 0645.738.797. Both are real, separate legal entities. Social Runners BV operates this website. If you sign up for a paid engagement, the contract is with whichever entity is named on your proposal or invoice — that document, not this one, tells you who you're contracting with.

If that entity turns out to be the second registration, it is the controller for the personal data handled within that engagement — your contact details, project communications, invoicing data — and its own privacy notice, provided as part of your proposal or contract, governs that data. This page only covers data collected through the website itself, as described below.

What this policy covers

This policy covers thecomposer.eu and its language versions (`/nl`, `/fr`, `/de`, `/es`) — the website itself, and nothing else. It doesn't cover the substance of a signed engagement. If you've hired us for a project, the terms of that engagement (and any data handling it involves — email threads, shared files, project tools) are covered by your proposal or contract, not by this page.

The short version

We use one analytics tool, Google Analytics, and only if you agree to it in the cookie banner. Until you do, it doesn't load and nothing about your visit goes to Google. We don't use advertising cookies, tracking pixels or remarketing. We don't embed third-party widgets, maps, or video players that could set their own cookies. Our fonts are hosted on our own server, not pulled from a third party that could log your visit. Apart from analytics you've agreed to, nothing about your visit is sent anywhere unless you actively send it — by writing an email, or filling in the newsletter field.

Two small things sit on your device without a banner: your own form draft (see "Form drafts saved in your browser" below) and your answer to the cookie question, so we don't ask on every page. Both are local storage, not cookies, and both are exempt from consent rules for the same reason a shopping basket is: they only ever serve you. Separately, Cloudflare's security layer can occasionally set its own short-lived cookie if it needs to run a bot check on a suspicious visit — that's Cloudflare protecting the site, not us tracking you, and it falls under the same "strictly necessary" exemption.

How the website itself works

The site is static HTML, hosted on Cloudflare. There's no database, no login system, no server-side code processing your input. Visiting the site inevitably creates the same technical trace any website visit does: your infrastructure provider (Cloudflare) processes connection information — like your IP address and the pages you request — to route the page to your browser and keep the service running securely. This is a byproduct of how the internet works, not something we set out to collect. We don't have access to these logs for marketing or tracking purposes; they exist for hosting and security, at Cloudflare's level.

Legal basis: our legitimate interest in running a secure, reliable service (GDPR Art. 6(1)(f)).

Analytics (only with your consent)

If you say yes in the cookie banner, we use Google Analytics 4 to see how the site is used: which pages are viewed, how visitors arrive (for example from a search engine or a link), approximate location (country and city, derived from your IP address), device and browser type, and simple interactions like scrolling, outbound links and downloads. Google Analytics doesn't log or store IP addresses. We don't switch on Google signals, advertising features or remarketing, we don't send names, email addresses or anything else that identifies you, and we only look at the results in aggregate.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as our processor under Google's data processing terms.
Purpose: seeing which pages help and which don't, so we can improve the site.
Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time on the cookies page; that removes the Analytics cookies and stops the measurement straight away, without affecting what was measured before.
Cookies: _ga and _ga_LVRCYYG8HB, both expiring after 13 months. Details on the cookies page.
Retention: in our Analytics settings, detailed event data is kept for 2 months and user-level data for 14 months. After that, only aggregated reports remain.

If you say no, or don't answer, Google Analytics never loads.

Contact form and booking form

The contact and booking forms on this site don't submit to a server. When you fill one in and hit send, your browser opens an email in your own email client (the one already configured on your device), pre-filled with what you typed. You then decide whether to actually send it. Until you do, nothing has left your device.

If you do send it, the email goes to hello@thecomposer.eu like any other email, and we process the information you've chosen to share (your name, contact details, and message) to respond to your enquiry.

Purpose: answering your question, scoping a possible engagement.
Legal basis: our legitimate interest in responding to enquiries addressed to us (GDPR Art. 6(1)(f)), or steps taken at your request before entering a contract (Art. 6(1)(b)).
Retention: we keep enquiry emails as long as they're relevant to an ongoing conversation or engagement, then delete them. See "How long we keep it" below.

If you sign up for our newsletter, we collect your email address only, for the single purpose of sending you the newsletter you asked for.

Legal basis: your consent (GDPR Art. 6(1)(a)).
Unsubscribing works on the first click, every time — no extra steps, no "are you sure," no re-entering your email.
We don't use your newsletter address for anything else, and we don't share it with anyone.
Delivery: this policy covers the website. Once you're subscribed, sending the newsletter itself runs through our email provider (see "Who else sees your data"). We're confirming whether that provider's standard open/click tracking is switched on for our sends, and will state the exact position here once confirmed.

Form drafts saved in your browser

While you're typing into the contact, booking, or newsletter forms, your draft is autosaved to your own browser's local storage (localStorage) so you don't lose your text if you navigate away by accident.

This draft never leaves your device. It isn't transmitted to us, to Cloudflare, or to anyone else — it just sits in your browser until you clear it (by clearing your browser data, or by successfully sending the form, which clears the saved draft). We have no access to it and no way to read it.

Who else sees your data

We use a small number of processors to run this website and respond to enquiries:

Cloudflare — hosts the website and provides the underlying infrastructure (including the connection-level logs described above).
Google (Google Ireland Limited) — provides Google Analytics, only if you've agreed to it (see "Analytics" above).
Our email provider — handles the hello@thecomposer.eu mailbox. We're finalising which provider this is and will name it here once confirmed. Until then, treat this as: an email provider processes messages sent to hello@thecomposer.eu, in line with their own data protection obligations.
The contracting entity — if your enquiry turns into a signed engagement, we share what you've told us (your name, contact details, and message) with whichever entity is named on your proposal, so they can issue it, invoice you, and deliver the work.

We don't sell your data. We don't share it with advertisers. There's no advertising on this site to share it with.

International transfers

Cloudflare operates a global network, which can mean data is processed outside the European Economic Area as part of routing and security operations. Where that happens, it relies on a safeguard recognised under GDPR Art. 46 — most likely the EU Standard Contractual Clauses that Cloudflare offers its customers. We're confirming exactly which safeguard applies to our account, and will name it here, with a way to request a copy, once confirmed. We don't ourselves transfer your data outside the EEA beyond what our processors do to deliver the service.

Google Analytics data can be processed by Google LLC in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, which the European Commission recognises as providing adequate protection, and Google's data processing terms also include the EU Standard Contractual Clauses. This only applies if you've agreed to analytics.

How long we keep it

Enquiry and booking emails: kept for as long as needed to handle your enquiry or engagement, and for a reasonable period after in case of follow-up — then deleted. We haven't fixed an exact number of months here; if you'd like your emails deleted sooner, just ask.
Newsletter addresses: kept until you unsubscribe, or until we archive an inactive list.
Hosting/connection logs: retained by Cloudflare on its standard operational schedule. We'll confirm and state the exact retention period here once we have it in writing from Cloudflare; treat any specific number as to-be-confirmed until then.
Analytics data (only if you agreed): detailed event data for 2 months and user-level data for 14 months, as set in our Google Analytics account; after that, only aggregated reports.

Your rights

Under the GDPR, you have the right to:

Access the personal data we hold about you
Rectify it if it's inaccurate
Erase it ("right to be forgotten")
Restrict how we process it
Object to processing based on our legitimate interest
Port your data to another provider
Withdraw consent at any time, where processing relies on consent (such as the newsletter or analytics) — without affecting anything done before you withdrew it

To use any of these rights, email hello@thecomposer.eu. We'll respond within the timeframes GDPR requires.

Complaints

If you think we've mishandled your data, tell us first — we'd rather fix it directly. You also have the right to lodge a complaint with the Belgian Data Protection Authority:

Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA)

Rue de la Presse – Drukpersstraat 35, 1000 Brussels, Belgium

contact@apd-gba.be

You can also bring a data protection claim before a court, including the courts of your own country of habitual residence — that's a right the GDPR gives you regardless of what any jurisdiction clause on this site says. Our Terms of Use point disputes about *using this website* to the courts of Belgium; that doesn't touch your GDPR rights.

Automated decision-making

We don't use automated decision-making or profiling on this website.

Children

This site is built for businesses, not children. It isn't directed at anyone under 16, and we don't knowingly collect data from children.

Changes to this policy

If we change how the site handles your data, we'll update this page and change the date at the top. If a change is significant, we'll make that clear here rather than quietly editing the fine print.

Contact

Questions about this policy, or about your data: hello@thecomposer.eu.

---

Social Runners BV, trading as The Composer — Rijksweg 449/1, 3650 Dilsen-Stokkem, Belgium — BE 0781.302.534