1. Who we are

CaptureTech Belgium BV, Nijverheidsstraat 72 Unit 1A, 2160 Wommelgem, Belgium, is the controller for the personal data described here: on this website, in CaptureTech's sign-in and in our business applications (customer portal, RMA Portal, Order Portal, Service Desk, Field Service, License Manager and our CRM). Questions and requests: privacy@capturetech.com.

2. What we process, why, and on which basis

• Contact, quote and demo forms: name, organisation, e-mail, phone, your message, the page and campaign you came from. To answer you and take the steps you ask for before a contract (GDPR art. 6(1)(b)), and to follow up as a business (legitimate interest, art. 6(1)(f)). A score orders the requests for our sales team; it never decides anything about you on its own.
• Our own visitor statistics: only with your consent for statistics (art. 6(1)(a)); without it your browser sends us nothing and nothing is counted. With it: the page viewed, device type, country, the referring site, a visitor id in the ct_vid cookie, reading time, scrolling, video, downloads and loading speed (Core Web Vitals). A choice counts for 180 days and for the version of the cookie banner you answered; then we ask again. Your choice itself is kept as evidence, with the banner text you saw.
• Company recognition: only with your consent for statistics or marketing (art. 6(1)(a)) we look up which company the network address of your visit belongs to (for business connections only). We keep the company, never the address or you as a person. A company we do not know yet that fits our customer profile is passed on, as a company, to our sales team. With consent for marketing we show content that fits your sector.
• Google Analytics, Microsoft Clarity and advertising cookies: only with your consent (art. 6(1)(a)), per purpose, which you can withdraw at any time through “Cookie settings” at the bottom of each page.
• Marketing e-mail: name, address, company, language, your consent (text, version, date, source) and what you did with our mails (delivered, opened, clicked). If you did not sign up yourself, your business address comes from our customer and contact records (Business Central and our CRM), from a trade fair or event where you gave it, or from a public company source; every such mail says so and links here. With your consent (always confirmed by double opt-in), or, if you ordered from us yourself, about similar products for 36 months after your last order (soft opt-in, art. 6(1)(f)); for functional company addresses on legitimate interest where the law allows it. Every mail has a one-click unsubscribe and a preference page; an unsubscribe is kept on our suppression list so we never mail you again. Whether you opened a mail and which links you clicked is measured only while you have given your consent to our mails, and no longer once you withdraw it; only then do the links carry a code, which ties a later visit to you only when you also accepted marketing cookies. Otherwise the links in our mails are plain links. Service messages for customers (maintenance, security, end of life) are sent on the basis of the contract. We also take contact details from our customer administration (Business Central) and our earlier newsletter list (Mailchimp), with the consent or unsubscribe recorded there. Every sign-up for our marketing mail, also on the preference page, is confirmed through a link we mail you first (double opt-in); that link works for 30 days.
• Events, webinars and the chat assistant: your registration and, for a webinar in Microsoft Teams, your attendance from Teams, your badge when you let us scan it at a fair with the note of our conversation, and your conversation with our site assistant; to follow up what you asked (art. 6(1)(b) and (f)). The assistant only answers from our published pages; if you leave your details, the conversation goes to our sales team. The assistant is an AI language model (Microsoft Azure OpenAI, in the EU); please don't share personal or confidential details with it. The same service helps our editors rewrite, translate and transcribe texts; what it writes is approved by a colleague.
• Site search: what you search for and how many results it gave, only with your consent for statistics (art. 6(1)(a)); e-mail addresses and phone numbers are removed first. To improve the site.
• Advertising conversions: only with your consent for marketing (art. 6(1)(a)) we load the LinkedIn Insight Tag and report a form you sent to Google Ads and LinkedIn as a conversion; to LinkedIn with your e-mail address as a hash and LinkedIn's click id, so that LinkedIn can match it to a member. For that measurement LinkedIn and we are joint controllers.
• Customer cases and references: when your company agrees to be a reference or to a customer case: your name and e-mail address, what you agreed to (name, logo, quote) with the evidence of your consent, the interview (typed notes, or the transcript of a recording, made with Microsoft Azure OpenAI in the EU when we use it), your decision and comment, and a personal approval link. We publish your name, logo and quote only with your consent (art. 6(1)(a)); preparing the case is legitimate interest (art. 6(1)(f)).
• Downloads by e-mail: when you ask for a document, we mail you a personal download link and keep your address, the document and how often it was downloaded; to do what you asked (art. 6(1)(b)).
• Documents from your account manager: a customer case or presentation sent to you through a personal link records when it was opened, so your account manager can follow up (legitimate interest, art. 6(1)(f)). An open reaches our CRM only for contacts we may approach, never after an objection or an unsubscribe.
• Our colleagues on LinkedIn: colleagues who take part get posts of our company page suggested to share on their own LinkedIn profile; we keep the suggestion, a proposed text and whether they shared it (legitimate interest, art. 6(1)(f)). Sharing is their own choice, through LinkedIn as themselves.
• Sign-in and our business applications: your account, company, sign-in codes, the second factors you set up (a passkey, an authenticator app, recovery codes; never a private key), the browsers you chose to trust, and what you do in our applications: repairs and devices, order requests, support tickets and their mails, work orders and delivery notes you sign, licences. To provide the service agreed with your employer (art. 6(1)(b) and (f)).
• Security logs: sign-ins, failed attempts, changes to access, errors, with the network address and the type of browser. To protect our services and detect incidents (art. 6(1)(f), and our security duties under the NIS2 law).

3. Who receives it

Only processors working for us under a data processing agreement: Microsoft (Azure hosting, Microsoft 365, Dynamics 365 Business Central, Clarity), Microsoft Azure (Communication Services for all our mail and OpenAI for the assistant, both in the EU), Microsoft Teams (webinars), LinkedIn (our company page, and with consent the Insight Tag and conversions, for which LinkedIn and we are joint controllers: we give you the essence of that arrangement on request), Google (Tag Manager, Analytics, Ads, with consent), our company-recognition provider and our CRM. We do not sell personal data.

4. Outside the EU

Some of these providers are American companies. Transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

5. How long we keep it

• Form submissions and chat conversations: 12 months (spam: 30 days).
• Raw visitor statistics and the visitor id: 24 months; company look-ups: 30 days; loading speed: 13 months.
• What you searched for on the site: 24 months, with the statistics. An advertising conversion still to be sent: at most 35 days.
• Event and webinar registrations, scanned badges and the note of our conversation: 24 months after the event.
• In our CRM: leads and what the website passed on about you, 12 months after your last reaction; contacts who left their company 12 months; your visits to the website as a known contact and events from our applications 24 months; usage data 13 months; prospects without any interaction 36 months; the CRM's audit trail 7 years (never less than 2 years).
• Customer cases: 24 months after the case closed or stalled; a declined case then keeps nothing of you, a published one keeps your name and the evidence of your consent while it is online, but no longer the interview, your comment or the approval link. A reference agreement: until the date agreed. Download links: valid 30 days, deleted 90 days later. Documents sent by an account manager: your address 24 months. Posts suggested to colleagues: 24 months.
• Service Desk: closed tickets 36 months, then the person on them is anonymised; the support mail log, satisfaction surveys and absences 24 months; time records 7 years (accounting law); support mails we ignore 30 days.
• Field Service: signatures on delivery notes, with the signer's name, 10 years; time entries 7 years.
• Order Portal: shopping carts 90 days; requests from the public order pages 24 months; the person on a shipped or cancelled order request is anonymised after 24 months.
• License Manager: mails 12 months; a trial's contact, survey answers and votes on feature requests 24 months.
• Sign-in: an invited account that was never activated 14 days; invitations 30 days after they expired or were answered.
• Marketing contacts without any interaction: 24 months; mails and what happened to them: 24 months. An unsubscribe stays on the suppression list. The evidence of your consent is kept up to 5 years after the last processing that relies on it; the last withdrawal of an address on the suppression list stays as long as the address does. A sign-up nobody confirms lapses after 30 days.
• Error logs: 90 days. Change history of the website: 24 months. Security logs: 12 months (the sign-in's audit trail: sign-ins, failed attempts, changes to access, with network address and browser). A request for a copy or for erasure covers all our applications together, this website included.
• Sign-in codes: deleted a day after they expire; trusted browsers: 30 days after they expire or are revoked.
• Customer accounts: as long as your organisation is our customer and you are its contact.

6. Your rights

You may ask for access to your data and a copy, correction, erasure, restriction, and transfer to another party, and you may object, in particular to direct marketing, at any time. Consent can be withdrawn at any time. Mail privacy@capturetech.com; we answer within one month. You do not need an account with us: we handle a request by your e-mail address, in all our applications together. You can lodge a complaint with the Belgian Data Protection Authority (Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be).

7. Security

Encrypted connections, two-step sign-in for customers, and for staff and customer administrators a second factor that does not come by e-mail (a passkey or an authenticator app), passwords stored only as salted hashes, access by role, and an information security management system certified to ISO 27001.