YOUR DATA.
YOUR RIGHTS.

Last updated: 1 October 2026

1. Who is responsible?

School of Work vzw is the controller for personal data processed through this public website. Registered office: Veldkant 33A, 2550 Kontich, Belgium. Enterprise number: 1042.402.481.

For privacy questions or to exercise your rights, contact Izzy and Koen using the contact form or write to our registered office.

2. What this notice covers

This notice covers schoolofwork.be, www.schoolofwork.be and the public School of Work website hosted on chatgpt.site. It covers browsing, contact requests and the people featured on these pages.

The website does not provide a student account or collect learning journals, ECTS records, assessment files or payments. Roomi and participation in School of Work involve separate processing arrangements and are outside the scope of this website notice.

3. Data, purposes and legal grounds

Contact requests: your name, email address, optional organisation, message, optional desired outcome and the language of the form. We use these to respond and follow up. Our legal ground is our legitimate interest in answering enquiries and organising our activities (Article 6(1)(f) GDPR). Where you personally request steps towards a contract with us, Article 6(1)(b) may apply.

Your name, email and message are required to send the form; without them we cannot process the request through the form. The organisation and desired outcome are optional. Sending a message does not subscribe you to a newsletter or marketing list.

Security and delivery: our hosting and email providers process technical information such as IP address, requested URL, time, browser information and delivery status. The form uses a random request identifier to prevent duplicate emails and temporarily counts requests per IP address to limit abuse. Our legal ground is our legitimate interest in keeping the website secure and delivering messages reliably (Article 6(1)(f)).

Public website content: names, professional roles and event photographs help explain our organisation and work. We rely on our legitimate interest in communicating our activities, subject to the rights and reasonable expectations of the people concerned. You can contact us to request a correction or object to publication.

Please do not send health information, diagnostic reports, identity documents, student assessment files or other sensitive information through this general contact form. If it is needed later, we will agree an appropriate channel and explain the applicable processing first.

4. Who receives the data?

Contact messages are sent to izzy@schoolofwork.be and koen@schoolofwork.be. Resend (Plus Five Five, Inc.) handles email delivery. OpenAI Sites hosts the website, with Cloudflare providing delivery and security infrastructure. Technical providers and their authorised subprocessors may process data needed for these services.

Our partners do not automatically receive your contact message. We do not sell contact data. If following up your request requires involving another organisation, we explain that before sharing additional information, unless disclosure is legally required.

Microsoft 365 provides our mailbox environment: received contact emails and replies are stored there. Authorised people within School of Work can access correspondence when necessary to handle your request.

5. Processing outside the EEA

These services may process data outside the European Economic Area, including in the United States. Resend states that customer and email data is stored in the United States, regardless of the sending region, and provides Standard Contractual Clauses in its Data Processing Addendum. Its EU-US Data Privacy Framework certification provides an additional transfer mechanism.

The applicable provider agreements describe the processing locations, subprocessors and transfer safeguards. You can ask us for information about the safeguards applicable to your data.

Resend: GDPR · Resend: DPA · Cloudflare: Privacy · OpenAI: Privacy · Microsoft: DPA

6. How long are data kept?

The website application does not keep a database of form submissions. Messages are sent by email. We retain correspondence for the time needed to answer and follow up your question. The criteria are whether your request is still open, whether a collaboration follows, and whether a legal duty or the establishment, exercise or defence of legal claims requires retention. Information no longer needed for those purposes should be deleted.

The form’s local abuse counter expires after 10 minutes and is held only in temporary server memory. Resend publishes a 30-day retention period for email and log data on its standard Free, Pro and Scale plans; this does not delete the copies received in our mailboxes. Hosting security logs and backups have separate provider retention rules. Contact us for details relevant to your request.

7. Your rights

Depending on the processing and the legal conditions, you can request access, correction, deletion, restriction or portability of your data. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

Send your request using our contact form or by post. We normally respond within one month. If the law permits an extension for a complex or numerous request, we inform you within that first month. We may ask for proportionate information to verify your identity; do not send an identity document unless we specifically request an appropriate verification method.

You can complain to the Belgian Data Protection Authority or the competent supervisory authority where you live or work.

8. Security, cookies and changes

The site uses HTTPS, server-side email credentials, input validation and limited access to contact recipients. No automated decisions with legal or similarly significant effects are made through this website, and it does not perform advertising profiling.

Fonts, images and logos are served locally. External websites are reached only when you follow a link; their privacy rules then apply. We update this notice when website processing changes and show the revision date above.