Legal
Privacy policy.
The short version. We collect your email address if you give it to us, and whatever you send us when you write to us or sign up for an event. We photograph our events and publish some of those photographs.
We set no cookies, run no analytics, and track nobody across the internet. We have never sold personal data and will not. You can have anything we hold on you deleted by asking, and we will do it.
The rest of this page is the same thing in the detail the law requires.
Who is responsible for your data
PLUX Forum is an unincorporated association based in Brussels. It is run by three people: Theo M. Piepers Jr., Matej Marinković and Rayane Oualdou. Because PLUX Forum is not yet a registered legal entity, the three of us are jointly the data controller for everything described here, in our own names.
Reach us about anything on this page at [email protected], or by post at Aarlenstraat 20, Brussels, Belgium.
We are not required to appoint a Data Protection Officer and have not appointed one. Questions go to the address above and one of the three of us will answer.
What we collect, why, and on what legal basis
We only collect what we actually use. Here is the whole of it.
1. Newsletter
If you subscribe, we store your email address and the date you subscribed. That is all of it — not which page you came from, not your browser, not your IP address. We use it for one thing: telling you when a new debate is announced.
Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time, and withdrawing is as easy as subscribing was — reply to any email we send, or write to [email protected] and say "unsubscribe". We do not ask why and we do not try to talk you out of it.
2. Emails you send us
If you write to us, we hold your message, your address, and anything you chose to put in it, in our mailbox.
Legal basis: our legitimate interest in answering people who contact us (Article 6(1)(f)).
3. Event registration
Registration for our debates is handled on our own system, not a ticketing platform. When you register we store your name and email address against that specific event, on the same server in Antwerp as everything else described here. We use it to know who is coming, to manage capacity, and to email you about that event.
No third party receives your registration. There is no Eventbrite, no ticketing service, and no attendee list held by anyone but us.
Legal basis: performance of your registration (Article 6(1)(b)), and our legitimate interest in running an orderly event (Article 6(1)(f)).
Registering for an event does not put you on the newsletter. Those are separate and we keep them separate.
4. Photographs and video at events
We photograph and film our debates, and publish some of it on this site and on social media. People in the audience are often identifiable. Our invitations say this in advance so you know before you arrive.
Legal basis: our legitimate interest in documenting our work publicly (Article 6(1)(f)), balanced against the notice given beforehand and your right to object below. For close-up portraits of an individual we ask that person first.
If you are in a photograph and want it gone, email us with a rough description of which one and we will remove it. You do not have to justify the request and we will not ask you to.
5. Server logs
Our web host records standard access logs when you load a page — IP address, time, which page, and your browser's user-agent string. We do not read these routinely; they exist so the site can be kept running and secure.
Legal basis: legitimate interest in the security and availability of the site (Article 6(1)(f)).
6. Web fonts
This site currently loads its typeface from Google Fonts. That means your browser contacts Google's servers when a page loads, and Google receives your IP address. We are moving these files onto our own server so this stops happening. Until then, Google's handling of it is covered by the Google Privacy Policy.
Legal basis: legitimate interest in displaying the site as designed (Article 6(1)(f)) — a basis we consider weak, which is why we are removing the dependency rather than defending it.
What we do not do
This list matters as much as the one above.
- No cookies. This site sets none at all — not for analytics, not for preferences, not for anything. That is also why you have not been shown a cookie banner. There is nothing to consent to.
- No analytics or tracking. No Google Analytics, no Meta pixel, no heatmaps, no session recording, no advertising tags. We do not know how many of you there are and we are at peace with that.
- No profiling and no automated decision-making. Nothing about you is scored, ranked or decided by a machine.
- No artificial intelligence applied to your data. We do not feed your email address, your messages or your photograph into any AI system, and we do not allow our processors to use them for training AI models.
- No selling, renting or sharing for marketing. Not to funders, not to partners, not to anyone. Our funders receive no personal data of any kind.
- No payments. We take no money through this site, so there are no card details, no subscriptions and nothing that auto-renews.
Who else handles your data
We use a small number of outside services to operate. They act on our instructions and may not use your data for their own purposes. These are all of them:
| Service | What it handles | Where |
|---|---|---|
| Google Workspace | Email sent to and from [email protected] | EU and USA |
| Cloudflare | Serving the site, encrypting the connection, and access logs | Global network |
Some of these are based outside the European Economic Area, or store data there. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as set out in each provider's own terms.
We will also disclose personal data if a Belgian court or authority lawfully requires it. Nothing else. We have never received such a request.
How long we keep it
| What | How long |
|---|---|
| Newsletter subscription | Until you unsubscribe, then deleted from the list within 30 days. We keep no record that you were ever on it. |
| Emails you send us | Two years from our last exchange, then deleted. |
| Event attendee lists | Twelve months after the event, then deleted. |
| Photographs and video | Kept as a record of our work, unless you ask us to remove one. |
| Server logs | Whatever our host's default retention is, typically 30 days. |
Deleted means deleted, including from the working copies of the list we keep. It may persist in routine backups for a short period after that, and is overwritten as those backups rotate.
How it is kept
The newsletter list and any message you send us live in our own system, on a server we run ourselves in Antwerp, Belgium — not in a third-party mailing product. That means the list itself is stored inside the European Economic Area. Only the three of us can open it, through individual accounts.
Two qualifications, so this isn't overstated: your submission passes through Cloudflare in transit, and email we send you is delivered through Google Workspace. Both are named in the table above. It is the stored list and stored messages that stay in Belgium.
The website cannot be used to find out who is on the list. When you subscribe, the response is identical whether or not that address was already on it, so nobody can test for a particular person's membership. The form can add an address; it has no way to show one back to you.
No method is perfect. If we ever discover a breach that puts you at risk, we will tell the Belgian Data Protection Authority within 72 hours and tell you directly.
Your rights
Under the GDPR you can ask us to:
- Show you what we hold about you, and give you a copy.
- Correct anything wrong.
- Delete it. If it is the newsletter or a photograph, we will simply do it — no reason required.
- Restrict what we do with it while a dispute is sorted out.
- Hand it over in a portable, machine-readable format.
- Object to anything we do on the basis of legitimate interest, including our use of photographs.
- Withdraw consent for the newsletter, at any time, without affecting anything we did lawfully before you withdrew it.
Email [email protected]. We will answer within one month, and it is free. If your request is genuinely excessive or repetitive we may take longer or charge, but we will explain why first.
If we get it wrong, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels — [email protected], dataprotectionauthority.be. You can also complain to the authority in your own EU country. We would rather you told us first, but that is your call and not a condition.
Children
Our events and this site are aimed at adults and at students of university age. We do not knowingly collect data from anyone under 16. If you believe we hold a child's data, tell us and we will delete it.
Changes to this policy
If we change how we handle personal data we will update this page and change the date at the top. If the change is significant and we have your email address, we will tell you directly rather than expecting you to notice.
Questions
Write to [email protected]. A person reads it.