Privacy policy

1. Who is responsible?

This website is run by Harmony Consult BV, Kolonel Dusartplein 28B, 3500 Hasselt, Belgium, company number 0453.361.667 (VAT BE 0453.361.667, RPR Antwerp, Hasselt division). Harmony Consult BV is responsible for the personal data you share through this website.

Harmony consists of several companies in Belgium, the Netherlands and Bosnia and Herzegovina. We pass an enquiry or application on to the Harmony company that follows it up.

For any question about your privacy, contact privacy@harmonygroup.eu.

2. When you fill in the contact form or request a whitepaper

What we receive: your name, your organisation, your email address, the size of your organisation, when it's best to call you and, on some pages, your message. Along with that come the page you filled in the form on, the language of the site, and how you found us: the campaign (such as LinkedIn or Google Ads), the first page you visited and the website that referred you. Our form service also records your IP address, your browser and your approximate location (country and city), to keep out abuse and spam.

What for: to answer and follow up your question, and to see through which channels people find us.

On what basis: steps you ask for yourself with a view to working together (Article 6(1)(b) GDPR) and our legitimate interest in following up enquiries, keeping out spam and improving our channels (Article 6(1)(f) GDPR).

For how long: up to 1 year after our last contact, unless we need to keep it longer because we work together or because the law requires it.

If you request a whitepaper, we receive your name, your organisation, your email address, which whitepaper you asked for and whether you'd like new whitepapers and invitations, along with the same details of how you found us. We use them to give you the whitepaper and follow up your request, on the basis of our legitimate interest (Article 6(1)(f) GDPR), and keep them for up to 1 year after our last contact.

3. Statistics and ads, only with your consent

On your first visit we ask whether we may use cookies. Without consent, we load no statistics or advertising tags. With consent, we use:

• Statistics: Google Analytics, to see how many people visit the site and which pages they read.
• Advertising: Google Ads, LinkedIn and Meta (Facebook, Instagram), to measure what our ads deliver and to show ads to people who visited the site before. We also measure whether someone sends an enquiry or clicks through to a vacancy after an ad.

These services process online identifiers (through cookies), the pages you view, your device and browser, and your approximate location.

On what basis: your consent (Article 6(1)(a) GDPR). You can withdraw or change it at any time, without affecting the processing before that. Which cookies exactly, and how long they are kept, is in our cookie policy.

4. Invitations and news

If you tick the box for new whitepapers and invitations when you request a whitepaper, we send them based on your consent (Article 6(1)(a) GDPR). You can withdraw it at any time.

If you'd rather not receive these, every email has a one-click unsubscribe link, or you can object at privacy@harmonygroup.eu. After that, we send you no more invitations or news.

5. Applying for a job

If you apply through a vacancy page on this website, we receive your name, email address, phone number, place of residence, the links to your profile, your CV if you send one, and your answers to the questions in the form (experience, availability, motivation and how you found us). Along with that come the vacancy, and how you found us: the campaign, the first page you visited and the website that referred you. Our form service also records your IP address, your browser and your approximate location.

What for: to assess your application and contact you. On what basis: steps with a view to a possible employment contract (Article 6(1)(b) GDPR).

For how long: 365 days after we receive your application. After that, our form service deletes it automatically.

If you indicated in the form that we may contact you about another vacancy, we do so within those 365 days, based on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

Some vacancies are still on jobs.harmonygroup.eu, a platform run by Jobtoolz. If you apply there, the privacy terms of that platform apply.

6. On every visit

Our website runs on Cloudflare. To serve and protect the site, Cloudflare processes technical data such as your IP address, your browser and the page you request, based on our legitimate interest in a secure, working website (Article 6(1)(f) GDPR). The website itself sets no cookies without consent; your cookie choice is stored in your own browser.

A video on our vacancy pages only loads when you press play, through YouTube (Google) in its no-cookie mode. The maps on those pages are images on our own server.

The Instagram posts on our vacancy pages are served from our own server. Instagram (Meta) only receives data when you click through to a post.

7. Who do we share your data with?

We don't sell your data. These service providers process it on our behalf, each for their own part:

• Forminit (UXPLUS Ltd, United Kingdom): receives and stores the contact form, whitepaper requests and applications, on servers in Ireland.
• Microsoft (Outlook, Microsoft 365): the mailbox where we receive and answer your enquiry.
• Cloudflare: hosting and security of the website.
• Google, LinkedIn and Meta: statistics and advertising, only with your consent.

Where needed, we have data processing agreements in place. Within Harmony, we only share your data with the company and the people who follow up your enquiry.

8. Transfers outside the European Economic Area

Forminit is based in the United Kingdom, for which the European Commission has adopted an adequacy decision; the forms themselves are stored on servers in Ireland. Google, LinkedIn, Meta, Microsoft and Cloudflare may process data in the United States. Those transfers are covered by the EU-US Data Privacy Framework, or by the European Commission's standard contractual clauses.

9. How long do we keep your data?

• Enquiries through the contact form and whitepaper requests: up to 1 year after our last contact.
• Applications: 365 days after we receive them, then deleted automatically.
• Vulnerability reports (via security@harmonygroup.eu): up to one month after the problem has been fixed, as in our responsible disclosure policy.
• Your cookie choice: 12 months in your browser, after which we ask again.
• Statistics and advertising cookies: as listed in our cookie policy.

10. Your rights

The GDPR sets out the following rights, which you can invoke:

• Article 15: right of access by the data subject
• Article 16: right to rectification
• Article 17: right to erasure (‘right to be forgotten’)
• Article 18: right to restriction of processing
• Article 20: right to data portability
• Article 21: right to object

You have the right to access your data, have it corrected or erased, restrict its processing, object, and take your data to another party. If you gave consent, you can withdraw it at any time. Send your request to privacy@harmonygroup.eu; we reply within a month.

If you feel we don't handle your data with care, you can lodge a complaint with the Data Protection Authority (opens in a new tab) in Belgium or the Dutch Data Protection Authority (opens in a new tab) in the Netherlands.

11. Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, and ask the same of the service providers we use.

12. What we don't do

We don't ask for special categories of personal data, such as health data, through this website, and we don't make decisions about you that are fully automated.

13. Changes

If anything changes in the way we process data, we update this policy. The date of the latest version is always at the top.