Privacy policy

Cortex Facility SRL, which carries out its cleaning activities under the Cortex Clean brand, attaches particular importance to the protection of your personal data. This policy describes what data we collect via the cortexclean.be website and in the course of our services, why we collect it, how long we keep it, and what rights you may exercise. It is drawn up in accordance with the General Data Protection Regulation (GDPR, Regulation EU 2016/679) and the Belgian Act of 30 July 2018.

1. Data controller

The data controller is Cortex Facility SRL, company number BE 1004.289.005, with registered office at Chaussée Romaine 464/2, 1853 Strombeek-Bever, Belgium.

Cortex Clean is a trading name of Cortex Facility SRL: both names refer to the same legal entity and the same data controller.

For any question relating to your data: contact@cortexfacility.com or +32 470 95 42 03.

Cortex Facility SRL has not appointed a data protection officer, as this appointment is not mandatory given the nature and volume of its processing activities.

2. Data subjects

This policy applies to any natural person whose data is processed by Cortex Facility SRL: website visitors, prospects, contact persons at our clients and suppliers, job applicants, and staff of the sites where we operate.

3. Data collected and purposes

We only collect the data necessary for the purposes described below. Each purpose rests on a specific legal basis.

Contact form and quotation request

Data: name, e-mail address, telephone number, VAT number (optional), content of your message, page language, date and time of submission.
Purpose: to answer your request, prepare a quotation, and provide commercial follow-up.
Legal basis: pre-contractual measures taken at your request (art. 6.1.b GDPR).
This data is stored in a database hosted on our server and sent by e-mail to our sales team.
Retention: 24 months from the last contact if no contract is concluded. If a contract is concluded, it becomes part of the client file.

Service delivery and client relationship management

Data: professional contact details, site addresses, contact persons, intervention history, invoicing data.
Purpose: to perform the contract, schedule interventions, invoice, and handle complaints.
Legal basis: performance of the contract (art. 6.1.b GDPR) and legal accounting and tax obligations (art. 6.1.c GDPR).
Retention: 10 years after the end of the contractual relationship, in accordance with Belgian accounting obligations.

Commercial prospecting

Data: name, position, company, professional contact details — obtained from public sources (Crossroads Bank for Enterprises, professional directories, online professional networks) or provided by you.
Purpose: to present our cleaning services to you.
Legal basis: legitimate interest (art. 6.1.f GDPR), strictly within business-to-business prospecting relating to services connected to your role.
Retention: 24 months from the last meaningful contact, or immediately upon your objection.
You may object to this prospecting at any time, without justification, by writing to contact@cortexfacility.com. We then cease all further contact.

Audience measurement and online advertising

Data: pages viewed, traffic source, device type, pseudonymised browsing data, truncated IP address.
Purpose: to understand how the site is used in order to improve it, and to measure the effectiveness of our advertising campaigns.
Legal basis: your consent (art. 6.1.a GDPR), obtained via the cookie banner.
Retention: 14 months for Google Analytics data; up to 13 months for advertising cookies.
None of this data is collected if you refuse the corresponding cookies.

4. Cookies

The site uses cookies strictly necessary for its operation and — subject to your consent — audience measurement cookies (Google Analytics 4) and advertising conversion measurement cookies (Google Ads), loaded via Google Tag Manager.

No non-essential cookie is placed before your consent. You may accept, refuse, or choose category by category, and change your choice at any time via the “Cookie preferences” link at the bottom of every page.

Details of the cookies, their durations and their issuers are set out in our cookie policy.

5. Sensitive data

We do not collect data falling within the special categories referred to in Article 9 GDPR — origin, political opinions, religious beliefs, trade union membership, health data, biometric data, sex life.

Should a service exceptionally require the processing of such data, for instance in a medical environment, your explicit consent would be obtained beforehand and the purpose clearly explained to you.

6. Recipients and processors

Your data is neither sold, rented nor exchanged.

It may be communicated to the following categories of recipients, and only to the extent necessary:

Our staff and intervention teams, within the limits of their duties.
Our hosting provider, which stores the website and database data.
Our e-mail service provider, which delivers contact notifications.
Google Ireland Limited, for audience measurement and advertising, if you have consented.
Our accountant and auditor, in the framework of our legal obligations.
Public authorities, where the law requires it.

Each processor is bound by a contract compliant with Article 28 GDPR, which prohibits any use of the data for its own purposes.

7. Transfers outside the European Union

Audience measurement and advertising data may be transferred to the United States within the framework of Google services. These transfers are framed by the EU-US Data Privacy Framework, to which Google LLC is certified, as well as by the European Commission's standard contractual clauses.

If you refuse audience measurement and advertising cookies, no such transfer takes place.

No other data is transferred outside the European Economic Area.

8. Security

We implement appropriate technical and organisational measures: encryption of exchanges via HTTPS, protection of the form against cross-site request forgery, data access restricted to those who need it, strong passwords, regular backups, and updating of software components.

In the event of a data breach likely to result in a high risk to your rights, we will inform you and notify the Data Protection Authority within 72 hours, in accordance with Articles 33 and 34 GDPR.

9. Your rights

You have the following rights, which you may exercise free of charge:

Right of access — obtain confirmation that your data is being processed and receive a copy of it.
Right to rectification — have inaccurate or incomplete data corrected.
Right to erasure — obtain the deletion of your data, except where its retention is required by law.
Right to restriction — request the temporary freezing of processing you contest.
Right to object — object to processing based on our legitimate interest, in particular commercial prospecting.
Right to portability — receive your data in a structured, machine-readable format.
Right to withdraw your consent — at any time, without affecting the lawfulness of processing already carried out.

To exercise these rights, write to contact@cortexfacility.com. We respond within one month, extendable by two months for complex requests. Proof of identity may be requested in the event of reasonable doubt as to the identity of the applicant.

10. Complaints

If you consider that the processing of your data is not compliant, you may lodge a complaint with the Belgian Data Protection Authority:

Data Protection Authority — Rue de la Presse 35, 1000 Brussels — +32 (0)2 274 48 00 — contact@apd-gba.be — www.dataprotectionauthority.be

We nevertheless invite you to contact us first: most situations are resolved directly.

This policy may be updated to reflect legal developments or new processing activities. The date of the last update appears below. In the event of a substantial change, we will inform the data subjects concerned by appropriate means.

Last updated: July 2026.