PRIVACY POLICY

Winger Academy BV
Version 1.0 — Date: 27 April 2026

1. Who are we?
Winger Academy BV (hereinafter: “Winger Academy”, “we”, “us” or “our”) is a marketing agency and training organisation with its registered office at Jan Boedtsstraat 33, 3120 Tremelo, Belgium, registered in the Crossroads Bank for Enterprises under number BE 0683.768.638.
We provide services across three domains: strategy, marketing agency and training (Academy). In the course of these activities, we process personal data of clients, prospects, training participants, website visitors and other data subjects.
Winger Academy acts as controller within the meaning of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). For any questions about this privacy policy or about the processing of your personal data, you may contact us at:
Email: info@wingeracademy.be
Phone: +32 490 57 95 75
Post: Jan Boedtsstraat 33, 3120 Tremelo, Belgium

Winger Academy has not appointed a Data Protection Officer (DPO), as this is not a legal requirement for our activities. The contact details above are your point of contact for all privacy-related enquiries.

2. What personal data do we process?
Depending on your relationship with Winger Academy, we process the following categories of personal data:
2.1 Clients and prospects (B2B)
Identification data: name, job title, company name, VAT number
Contact data: email address, telephone number, postal address
Invoicing and payment data
Communication history (emails, quotations, order forms)
CRM-related information: notes, engagements, project history
LinkedIn® profile information insofar as publicly available and relevant to the engagement
2.2 Training and workshop participants
Name and contact details
Registration data and attendance records
Payment data
Progress and evaluation data in the context of learning programmes
2.3 Website visitors
IP address and derived location data
Browser type, device and operating system
Pages visited, session duration and click behaviour
Company identification based on IP address (via Leadinfo, see section 5)
Cookie data (see section 6)
2.4 Newsletter subscribers
Email address
Name (if provided)
Subscription date and source
Open and click behaviour within email campaigns
2.5 Data we never process
Winger Academy does not process special categories of personal data (such as health data, political opinions or biometric data), unless the data subject has voluntarily provided such data in the context of a specific training request.

3. Purposes and legal bases for processing
We process personal data exclusively for specified purposes and on the basis of a valid legal ground in accordance with Article 6 GDPR.
3.1 Performance of a contract (Art. 6(1)(b) GDPR)
We process data of clients and participants for the performance of our services: preparing quotations and invoices, planning and delivering engagements, organising training sessions and workshops, and the related client communication.
3.2 Legal obligation (Art. 6(1)(c) GDPR)
For accounting and tax purposes, we are legally required to retain invoice data and transaction information for a period of 7 years.
3.3 Legitimate interests (Art. 6(1)(f) GDPR)
On the basis of our legitimate interests, we process personal data for the following purposes:
Direct marketing to existing clients and business contacts (B2B communications about our services)
Website analytics via Google Analytics to improve the user experience
Company identification of website visitors via Leadinfo for prospect management
Follow-up of quotations and commercial contacts
Portfolio use and display of references, in accordance with article 11 of our general terms and conditions

We have carried out a balancing test and are satisfied that our legitimate interests do not, in any of these cases, override your interests or fundamental rights and freedoms in an unreasonable manner. You always have the right to object (see section 8).
3.4 Consent (Art. 6(1)(a) GDPR)
For the placement of non-essential cookies and the sending of newsletters to individuals with whom we have no existing client relationship, we request your explicit consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

4. How long do we retain your data?
We do not retain personal data for longer than is necessary for the purpose for which it was collected, and in any event no longer than the legally permitted periods. Our retention periods are as follows:
Invoice and accounting data: 7 years (statutory obligation under Belgian accounting law)
Client data and project files: 3 years after the end of the last engagement or last contact
Prospect data (no client relationship): 2 years after last contact, unless you object at an earlier stage
Newsletter subscribers: for as long as you remain subscribed + 1 year after unsubscription (suppression list)
Website analytics (Google Analytics): 14 months
Leadinfo company data: maximum 90 days
Communication history (emails, quotations): 3 years after closure of the file

Upon expiry of the applicable retention period, data shall be securely deleted or anonymised.

5. With whom do we share your data?
5.1 Processors
Winger Academy engages external service providers that process personal data on our behalf. With each of these parties, we have entered into a data processing agreement or are bound by their processor terms in accordance with the GDPR:
Teamleader: CRM and invoice management (processor established in Belgium)
Billit: accounting software and integration with external accountant
Mailchimp (Intuit Inc.): email marketing and newsletter management (US — see section 5.3)
Google Workspace en Google Drive: cloud storage and collaboration (US — see section 5.3)
Leadinfo: company identification based on IP addresses of website visitors (the Netherlands)
Google Analytics: website analytics (US — see section 5.3)
Google Ads: advertising management and conversion tracking (US — see section 5.3)
Meta Ads (Meta Platforms Inc.): advertising management on Facebook and Instagram (US — see section 5.3)
LinkedIn® Ads (LinkedIn® Ireland Unlimited Company): advertising management on LinkedIn® (IE/US — see section 5.3)
5.2 Other recipients
In the following circumstances, we may also share personal data with third parties who do not act as processors on our behalf:
Your external accountant, to the extent necessary for the processing of invoices
Competent authorities or courts, where we are legally required to do so
Acquiring parties in the event of a merger, acquisition or transfer of business activities, subject to adequate protection of your rights

We never sell your personal data to third parties.
5.3 Transfers outside the European Economic Area (EEA)
Some of our processors are established in or process data in the United States. This concerns Mailchimp, Google (Analytics, Ads, Workspace) and Meta. The following safeguards apply to these transfers:
Google and Meta rely on the Standard Contractual Clauses (SCCs) approved by the European Commission
Mailchimp (Intuit) also relies on SCCs and is certified under the EU-US Data Privacy Framework
LinkedIn® is primarily established in Ireland (within the EEA) and additionally relies on SCCs for any onward transfers to the US

You may consult the privacy policies of these parties on their respective websites for further information about their processing practices.
5.4 Leadinfo — specific notice
Winger Academy uses Leadinfo, a tool that attempts to identify, on the basis of the IP address of your visit to our website, which company you represent. No personal data of individual persons is processed in this context — only company-level data. If you wish to prevent your IP address from being used for company identification, you may opt out at www.leadinfo.com/en/opt-out.

6. Cookies and tracking technologies
6.1 What are cookies?
Cookies are small text files that are stored on your device when you visit our website. We distinguish between essential cookies (necessary for the operation of the website) and non-essential cookies (for which your consent is required).
6.2 Which cookies do we use?
Essential cookies (no consent required)
Session cookies for the operation of the website
Cookie consent cookie (storing your cookie preferences)
Analytical cookies (consent required)
Google Analytics: measurement of website visits, user behaviour and traffic sources. We have configured Google Analytics with IP anonymisation and limited data retention (14 months).
Marketing and tracking cookies (consent required)
Google Ads conversietracking: measurement of conversions following a click on a Google advertisement
Meta Pixel: remarketing and advertising measurement on Facebook and Instagram
LinkedIn® Insight Tag: remarketing and advertising measurement on LinkedIn®, as well as demographic reporting on website visitors
Leadinfo tracking script: company identification based on IP address (see section 5.4)
6.3 Managing your cookie preferences
On your first visit to our website, we request your consent for non-essential cookies via our cookie banner. You may adjust your preferences at any time via the cookie settings at the bottom of our website.
You may also refuse or delete cookies via your browser settings. Please note that disabling certain cookies may affect the functionality of the website.

7. Winger Academy acting as processor for your clients
Where Winger Academy, in the context of agency engagements, gains access to or works with personal data of the end clients of our principals (e.g. via email lists, CRM systems or advertising platforms), Winger Academy acts as processor within the meaning of Article 4(8) GDPR, and the principal acts as controller.
In such cases, we enter into a separate Data Processing Agreement with the principal, in accordance with Article 28 GDPR. We refer in this regard to article 16 of our general terms and conditions.
Winger Academy processes such data exclusively on behalf of and in accordance with the instructions of the principal, and not for its own purposes.

8. Your rights as a data subject
Under the GDPR, you have the following rights with respect to your personal data:
Right of access (Art. 15 GDPR): you may request a copy of the personal data we process about you.
Right to rectification (Art. 16 GDPR): you may have inaccurate or incomplete data corrected.
Right to erasure (Art. 17 GDPR): you may request the deletion of your data, provided no statutory retention obligation applies.
Right to restriction of processing (Art. 18 GDPR): you may request that processing be temporarily restricted, e.g. while an objection is being assessed.
Right to data portability (Art. 20 GDPR): you may request your data in a structured, commonly used format for transfer to another party (applicable to processing based on consent or contract).
Right to object (Art. 21 GDPR): you may at any time object to processing based on legitimate interests, including direct marketing. Upon objection to direct marketing, we shall immediately cease such processing.
Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time, without stating reasons and without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at info@wingeracademy.be. We will respond to your request within 30 days. In the event of a complex or repeated request, we may extend this period by a further 60 days, provided we inform you in a timely manner.
We may verify your identity before processing your request, in order to prevent misuse.

9. Lodging a complaint with the supervisory authority
If you believe that we are processing your personal data in a manner that is not compliant with the GDPR, you have the right to lodge a complaint with the competent supervisory authority. In Belgium, this is the Data Protection Authority (Autoriteit Persoonsgegevens / Gegevensbeschermingsautoriteit):
Website: www.dataprotectionauthority.be
Address: Rue de la Presse 35, 1000 Brussels, Belgium
Email: contact@apd-gba.be
Phone: +32 2 274 48 00

We do however encourage you to raise any questions or concerns with us first at info@wingeracademy.be, so that we have the opportunity to address your concerns.

10. Security of your data
Winger Academy implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or disclosure. These measures include, among others:
Use of encrypted connections (HTTPS/TLS) for data transmission
Restriction of access to personal data on a need-to-know basis
Use of platforms and tools with demonstrable security certification
Regular review of our security practices

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority within the statutory 72-hour reporting period, and will notify you personally where the breach is likely to result in a high risk to your rights and freedoms.

11. Changes to this privacy policy
Winger Academy reserves the right to amend this privacy policy at any time, for example as a result of changes to our services, amended legislation or guidance from the Belgian Data Protection Authority. The most current version is always available at www.wingeracademy.be.
In the event of material changes, we will inform you by email or via our website, where we hold your contact details.
The date of the most recent update is indicated at the top of this document.

12. Contact details
For all questions, requests or comments regarding this privacy policy or the processing of your personal data, you may contact us at:

Winger Academy BV
Jan Boedtsstraat 33, 3120 Tremelo, Belgium
VAT: BE 0683.768.638
Email: info@wingeracademy.be
Phone: +32 490 57 95 75
Website: www.wingeracademy.be

Winger Academy BV — Privacy Policy v1.0 — 27 April 2026