Privacy Policy
Last updated: 7 August 2026
1. Who We Are
NILUS TRAINING & CONSULTING SPRL is an enterprise architecture consulting and training company based in Brussels, Belgium. Our website address is https://www.nilus.be.
NILUS TRAINING & CONSULTING SPRL is the data controller for the processing described here. For any privacy-related enquiry, including a request to exercise the rights in section 5, contact us at info@nilus.be. We have not appointed a Data Protection Officer, as we are not required to.
2. What We Process, and on What Basis
Every processing operation below is listed with its purpose and its legal basis under Article 6 of the GDPR.
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Your cookie choice | Remembering whether you accepted or declined, so we stop asking | Art. 6(1)(f) — our legitimate interest in honouring your answer | Until you clear site data |
| Pages visited, browser and approximate location (Google Analytics) | Understanding which articles are read | Art. 6(1)(a) — your consent, given on the banner and withdrawable | As set on our Google Analytics property; 14 months is the maximum GA4 permits |
| Advertising identifiers (Google AdSense) | Serving and measuring advertisements that fund the site | Art. 6(1)(a) — your consent, given on the banner and withdrawable | Set by Google, up to 13 months |
| Name, email and message you send us | Answering your enquiry | Art. 6(1)(b) — steps taken at your request before a contract | 2 years from last contact |
| Name, email, company and answers in the Sparx EA maturity assessment | Producing your maturity score and sending you the result | Art. 6(1)(b) — you asked us for the assessment | 2 years from submission |
| Bot-check signal on the contact form (Cloudflare Turnstile) | Keeping automated submissions out of the inbox | Art. 6(1)(f) — our legitimate interest in a usable contact channel | Not retained by us |
We do not process special categories of personal data, we do not sell personal data, and we do not use it for automated decision-making or profiling beyond the advertising measurement described above.
3. Cookies and Consent
Google Analytics and Google AdSense do not load until you press Accept. Before that, Google Consent Mode is set to deny analytics and advertising storage, and no analytics or advertising cookie is written. Declining leaves the site fully usable.
To withdraw consent, clear this site's data in your browser; the banner reappears on your next visit and your previous answer is discarded. The Cookie Policy lists each cookie, its purpose and its lifetime.
4. Who Else Sees the Data
Two processors are involved:
- Cloudflare, Inc. — hosting and content delivery. Cloudflare processes connection data, including your IP address, in order to serve pages at all, so this does not depend on consent. Its Turnstile service also runs on the contact page to tell people from bots.
- Formspree, Inc. — delivery of contact form submissions. Your name, email address and message pass through Formspree on the way to us.
- MailChannels — delivery of the email generated when you complete the Sparx EA maturity assessment, which contains the name, email, company and answers you entered.
- Google Ireland Limited — Google Analytics and Google AdSense, loaded only with your consent.
All of these may transfer personal data outside the European Economic Area, including to the United States. Those transfers rely on the EU–US Data Privacy Framework and on the European Commission's Standard Contractual Clauses. You may opt out of personalised advertising independently at Google Ads Settings.
5. Your Rights
Under the GDPR you may ask us to give you access to your personal data, correct it, erase it, restrict how we use it, or provide it in a portable format. You may object to processing based on our legitimate interest, and you may withdraw a consent at any time without affecting what was lawful before you withdrew it.
Write to info@nilus.be. We answer within one month.
If our answer does not satisfy you, you may lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be.
6. Changes to This Policy
We may update this policy. The revision date is shown at the top of the page, and a change that affects a processing you consented to means we ask for that consent again rather than treating continued use as agreement.
Questions? Contact us · Privacy Policy · Terms