Privacy notice
Text block
Privacy Notice
Version 2.0 · September 2026. This Privacy Notice replaces the version of 20 April 2018.
1. Scope and controller
This Privacy Notice governs the processing of personal data by the LEAP FORWARD GROUP and its companies: Leap Forward NV (including Once Studio), Knight Moves NV, Little Miss Robot NV, Anvil NV and Fluo NV (hereinafter jointly: “Leap Forward”, “we”), on their respective websites and in the course of their services.
The controller within the meaning of Article 4(7) GDPR is Leap Forward NV, with registered office at Sint-Salvatorstraat 18/303, 9000 Gent, Belgium, registered with the Crossroads Bank of Enterprises under number BE 0678.735.823.
All personal data are processed in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, hereinafter “GDPR”) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
For any question or request concerning the processing of your personal data, you may contact us at gdpr@leapforward.be.
2. Categories of personal data, purposes and legal bases
We process personal data only for specified, explicit and legitimate purposes, and only where a legal basis under Article 6(1) GDPR applies:
Processing activity | Categories of data | Purpose | Legal basis |
|---|---|---|---|
Handling enquiries (contact form, e-mail, telephone) | Identification and contact data, content of your message | Responding to your enquiry | Legitimate interest (Art. 6(1)(f) GDPR) or steps prior to entering into a contract (Art. 6(1)(b) GDPR) |
Client and prospect management | Identification and contact data, contractual history | Performance and administration of our services | Performance of a contract (Art. 6(1)(b) GDPR); legitimate interest in maintaining business relations (Art. 6(1)(f) GDPR) |
Recruitment | Data contained in your application | Assessment of your application | Steps prior to entering into a contract (Art. 6(1)(b) GDPR) |
Newsletters and events | Name and e-mail address | Direct marketing and event communication | Consent (Art. 6(1)(a) GDPR); you may withdraw your consent at any time, and every mailing contains an unsubscribe link |
Website operation | Technical data such as IP address, browser information, pages visited | Operation, security and improvement of our websites | Legitimate interest (Art. 6(1)(f) GDPR); for cookies and similar technologies, consent where required – see our Cookie Policy |
User research | See section 4 | See section 4 | Explicit consent (Art. 6(1)(a) GDPR) |
We generally obtain personal data directly from you. Where, in the context of client and prospect management or recruitment, we exceptionally obtain personal data from other sources (such as publicly available professional information or referrals), we inform you thereof in accordance with Article 14 GDPR at the latest at the time of our first contact with you.
We do not engage in automated individual decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).
3. Special categories of personal data
We do not process special categories of personal data within the meaning of Article 9(1) GDPR (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning sex life or sexual orientation) through our websites. Where the processing of such data would exceptionally be required in the context of user research, this shall only take place subject to the appropriate safeguards of Article 9(2) GDPR, and participants shall be informed thereof in advance.
4. User research
Where you participate in user research organised by one of our companies, the following applies.
We organise research (including interviews, focus groups, observations, ideation and co-creation sessions, and user tests) in order to enable the organisations we work for to deliver more useful and user-friendly services and products. We only collect personal data after participants have been informed about the study and the purpose of the data collection in an accessible manner, and after explicit consent to participate has been obtained.
The collection of personal data is limited to what is strictly necessary:
- to recruit participants: name, telephone number, e-mail address, age, gender and/or occupational status;
- to answer the research questions: your responses regarding your knowledge, use and experience of a given service, website or application;
- to transfer insights to the client for whom the research is conducted: photographs, audio and/or video recordings, subject to separate consent.
Consent is granular: participants give separate consent per category of data and may, for instance, answer the research questions while declining to be photographed or filmed.
Research data are retained for the duration of the project and for a maximum of one year. Where photographs, video material or the participant’s name are to be used for marketing purposes, separate consent is requested in the consent form and such material is retained for a maximum of three years.
5. Retention periods
In accordance with the storage limitation principle (Article 5(1)(e) GDPR), personal data are not retained longer than necessary for the purposes for which they were collected. The applicable retention period is determined by the purpose of the processing, our legal and contractual obligations, and the duration of our relationship with you; where processing is based on consent, data are retained until you withdraw that consent. The specific periods per category of data are laid down in our internal retention policy. Upon request via gdpr@leapforward.be, we will inform you of the retention period applicable to your data.
6. Recipients of personal data
We do not sell personal data. Personal data are only disclosed to:
- Processors acting on our behalf (such as hosting and mailing providers), exclusively on the basis of our documented instructions and under a data processing agreement in accordance with Article 28 GDPR, and subject to our supplier assessment process;
- The companies of the Leap Forward group, insofar as necessary for the performance of our services;
- Competent authorities, where we are under a legal obligation to do so.
Where you make use of social media buttons on our websites, the social media provider concerned may collect personal data; the privacy notice of that provider then applies.
7. Transfers outside the European Economic Area
Personal data are processed within the European Economic Area wherever possible. Where a processor processes personal data outside the EEA, such transfer shall only take place subject to the appropriate safeguards of Chapter V GDPR, in particular an adequacy decision of the European Commission (Article 45 GDPR) or the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).
8. Security of processing
We take appropriate technical and organisational measures within the meaning of Article 32 GDPR to protect personal data against loss, misuse, unauthorised access and alteration. These measures are laid down in our group-wide information security policy, which is available upon request via gdpr@leapforward.be.
9. Your rights as a data subject
You have the right, free of charge, to:
- access your personal data and obtain a copy thereof (Article 15 GDPR);
- rectification of inaccurate or incomplete personal data (Article 16 GDPR);
- erasure of your personal data (Article 17 GDPR);
- restriction of processing (Article 18 GDPR);
- data portability: receiving the personal data you provided in a structured, commonly used and machine-readable format (Article 20 GDPR);
- object to processing based on legitimate interest, on grounds relating to your particular situation (Article 21(1) GDPR);
- object to processing for direct marketing purposes at any time and without stating reasons (Article 21(2) and (3) GDPR);
- withdraw a consent previously given, at any time, without affecting the lawfulness of processing prior to such withdrawal (Article 7(3) GDPR).
Requests may be addressed to gdpr@leapforward.be. In order to prevent unauthorised disclosure, we verify the identity of the requester before processing a request. We respond without undue delay and in any event within one month of receipt of the request; where necessary, taking into account the complexity and the number of requests, this period may be extended by two further months, in which case we will inform you of the extension and the reasons for it within one month of receipt (Article 12(3) GDPR). Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act on the request (Article 12(5) GDPR).
If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be) or with the supervisory authority of your habitual residence.
10. Amendments to this Privacy Notice
We review this Privacy Notice whenever our operations or the applicable legislation so require, together with our internal privacy policy. The most recent version, including its version number and date, is at all times available on this page.
Leap Forward NV · Sint-Salvatorstraat 18/303, 9000 Gent · BE 0678.735.823 · gdpr@leapforward.be