Privacy Policy

1. Who we are

This privacy policy applies to the website parallel28.eu and all tools and pages hosted on it, operated by:

Parallel 28 acts as the data controller for personal data processed through this website.

2. What data we collect

We collect data in the following situations:

• Analytics data — with your consent, we collect anonymised data about how you use the website (pages visited, time on page, device type, country). We do not collect IP addresses in identifiable form.
• Contact form — when you submit our contact form, we collect your name, email address, company name, and the content of your message.
• Client portal registration — if you create an account, we collect your first name, last name, company name, email address, and your chosen plan.
• Tool usage — our free tools (EUDR Risk Checker, Wood Species Register, GeoJSON Tool, DoP Creator) process data you enter locally in your browser. We do not store or transmit the data you enter into these tools to our servers.
• Newsletter — if you subscribe to our newsletter via the blog page, we collect your email address.

3. Cookies and analytics

We use Google Analytics 4 (GA4) to understand how visitors use our website. GA4 is only activated after you give explicit consent via the cookie banner.

When you accept analytics, Google Analytics may set the following cookies:

• _ga — distinguishes unique users (expires after 2 years)
• _ga_XXXXXXXX — maintains session state (expires after 2 years)

Google Analytics data is processed by Google LLC (USA). Google is certified under the EU-US Data Privacy Framework. For more information, see Google's privacy policy.

We do not use advertising cookies, tracking pixels, social media plugins, or any third-party marketing tools.

Change your cookie preference:

4. Data processed through our tools

All tools on parallel28.eu — including the EUDR Risk Checker, Wood Species Register, GeoJSON Parcel Tool, and DoP Creator — run entirely in your browser. Data you enter (coordinates, product information, company details) is processed locally and is never sent to Parallel 28 servers.

The only exception is the DoP Creator: when you click "Download", a request is sent to our server to generate the Word document. The data submitted for document generation is not stored after the file is returned to you.

5. Contact form

When you submit the contact form, your message is processed through Formspree (Formspree Inc., USA), which forwards it to our email address. Formspree is GDPR-compliant and processes data under standard contractual clauses.

We use the data you submit solely to respond to your enquiry. We do not add you to any mailing list without your explicit consent.

Contact form submissions are retained for up to 2 years in our email archive, after which they are deleted.

6. Client portal

The client portal (login/signup at /portal/) is currently under development. When active, it will use a third-party authentication provider (such as Supabase or Auth0) to manage account creation, login, and session management securely.

This privacy policy will be updated before the portal goes live with full details of the data processing involved.

7. Legal basis for processing

• Analytics cookies — consent (Art. 6(1)(a) GDPR)
• Contact form — legitimate interest / pre-contractual steps (Art. 6(1)(b) and (f) GDPR)
• Client portal — performance of a contract (Art. 6(1)(b) GDPR)
• Newsletter — consent (Art. 6(1)(a) GDPR)

8. Data retention

• Analytics data — retained for 14 months in Google Analytics (GA4 default), then automatically deleted
• Contact form messages — retained for up to 2 years in our email system
• Client portal accounts — retained for the duration of the account plus 1 year after deletion request
• Cookie preference — stored in your browser's localStorage until you reset it or clear your browser data

9. Third parties and sub-processors

• Google Analytics 4 (Google LLC, USA) — website analytics, only with consent
• Formspree (Formspree Inc., USA) — contact form processing
• Google Fonts (Google LLC, USA) — typography (font files loaded from Google servers)
• Combell NV (Belgium) — website hosting
• Leaflet / OpenStreetMap — map tiles in the GeoJSON tool (no personal data transmitted)

We do not sell, rent, or share your personal data with third parties for marketing purposes.

10. Your rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access — you can request a copy of the data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure — you can ask us to delete your personal data
• Right to restriction — you can ask us to restrict processing
• Right to data portability — you can ask for your data in a machine-readable format
• Right to object — you can object to processing based on legitimate interest
• Right to withdraw consent — you can withdraw analytics consent at any time using the button in section 3 above

To exercise any of these rights, contact us at info@parallel28.eu. We will respond within 30 days.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

11. Security

Parallel 28 takes appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. Our website is served over HTTPS. Access to personal data is restricted to Parallel 28 personnel only.

12. Changes to this policy

We may update this privacy policy from time to time. The date at the top of this page indicates when it was last revised. Material changes will be communicated via a notice on the website.

13. Contact

For any questions about this privacy policy or about how we handle your personal data: