LEGAL
Privacy notice
How NINAWA collects, uses, protects and retains personal data under the GDPR and Belgian data-protection law, explained in plain words, with the full details for those who want them.
Last updated: 10 October 2026Legal operator and data controller
Controller: Mostafa Mohammed, natural person / sole proprietor, using the trade name NINAWA.
Enterprise number (KBO/BCE): 1.036.764.704.
Registered address: Kerkstraat 16 bus 1, 3940 Hechtel-Eksel, Belgium.
Privacy contact: support@ninawa.net · +32 484 90 12 59.
Current commercial status: commercial activity is currently discontinued. ninawa.net currently operates as an informational, portfolio and pre-launch website and does not presently accept paid production contracts.
2. What data we collect
In short: Only what each step needs: your contact details and request, your booking, your contract and, if you are a client, what you do in Client Studio.
We may process contact and company details, project communications, consultation details, contracts, invoices, security events, language and consent preferences, and limited website analytics. We do not intentionally request special-category data through general inquiry or booking forms. Besides the website forms, we record your name, contact and company details and what you asked for when you contact us by phone, email or in person, or when someone refers you to us. If your details came from someone else, our first message to you (usually the proposal) says so and links to this notice.
| When | Data |
|---|---|
| You visit the website | Your consent choice and language preference; security events with a keyed, non-reversible request fingerprint instead of your raw IP address; optional analytics only after your consent. |
| You request a proposal or send a question | Name, business, email, optional phone number, preferred contact method, the service you need, your description, timing and optional budget. Optionally, how you heard about us, and the page of our website or the campaign link you came from. |
| You book a consultation | Name, email, chosen time slot and your message. Also the page of our website or the campaign link you came from. |
| You confirm your email address | A one-time verification link; only its hashed value is stored. |
| You accept a proposal | Company and contact details on the proposal and the acceptance record: name, email, authority, date and time, and the accepted versions. |
| You use Client Studio | Name, email, a hashed password, sign-in times, your approvals, inputs, files and requests. |
| You become a paying client | Contract, invoicing and payment details, once invoicing is active. |
3. Why we use it and on what legal basis
In short: We use your data to answer you, to work together under a contract, to meet legal duties and to keep the services secure; optional analytics only with your consent.
Data is used to answer requests, take requested pre-contractual steps, perform agreements, meet legal obligations and secure services. Strictly necessary security and genuinely identifier-free server-side measurement may rely on legitimate interests where documented and proportionate. Optional browser interaction and audience analytics is activated only after consent.
| Purpose | Legal basis |
|---|---|
| Answering your question or proposal request | Steps you ask for before a contract (Article 6(1)(b) GDPR) |
| Booking and holding a consultation | Steps you ask for before a contract |
| Proposals, the project and Client Studio | Performance of the contract |
| Invoicing and accounting | Legal obligation |
| Security, abuse prevention and email verification | Legitimate interest in protecting the services and your data |
| Knowing which of our pages and campaigns lead to requests, without following you across pages or devices | Legitimate interest in improving our website and offer (Article 6(1)(f) GDPR) |
| Remembering your language and consent choice | Strictly necessary for the function you request |
| Optional visitor analytics | Your consent, which you can withdraw at any time |
4. Who receives your data
In short: Your data stays with NINAWA and the few providers needed to run the service; we do not sell it or use it for advertising.
Access is limited to NINAWA and providers actually needed for hosting, email, security, accounting, invoicing, backup or specialist delivery. Providers receive only data needed for their role and are subject to applicable confidentiality and data-processing duties.
- NINAWA's servers are hosted in the EU by Hetzner and by a Belgian hosting company; encrypted backups are stored at Hetzner.
- Email is sent from NINAWA's own mail servers, and visitor statistics run on NINAWA's own server (self-hosted Umami).
- Where anti-abuse protection is enabled, forms may use Cloudflare Turnstile as a security service.
- Accounting and invoicing providers receive invoicing data once invoicing is active.
- NINAWA does not sell personal data and does not share it with advertising networks.
Provider identities, regions and transfer safeguards are verified against the current production configuration before they are relied on in the final launch notice.
5. International transfers
In short: Your data is stored in the EU; if a provider ever processes it outside the EEA, a legal safeguard applies.
Where a provider processes personal data outside the European Economic Area, NINAWA must identify the transfer and use an applicable lawful mechanism such as an adequacy decision, Standard Contractual Clauses or another valid safeguard. The production provider register is the evidence source for this assessment.
6. How long we keep data
In short: Unconfirmed requests disappear after two days. If you do not become a client, we erase your personal details one month after closing your request; only anonymous statistics remain. Other confirmed requests are kept 730 days, analytics and security events 90 days; contracts and invoices as long as Belgian law requires.
Unverified public submissions are removed after the configured short retention period, currently two days by default, including linked cancelled or pending booking records. Verified application booking/request records and the application's related email-outbox records are cleaned after 730 days. Analytics and security event stores use a 90-day default retention. Contract, accounting and invoicing records are retained for the periods required by Belgian law or proportionate legal-claims needs. Copies held in business mailboxes or external providers remain subject to their separately verified retention rules. If a prospective client does not become a client and we close the request (not a fit, or no agreement), their name, contact details, messages, proposal content and notes are erased one month after closing, together with the related application emails. An anonymous record (source, service of interest, dates, amounts and reason codes) remains for statistics. A request that is still open stays until it is closed.
| Data | Kept for |
|---|---|
| Requests and bookings that were never confirmed | 2 days |
| Requests and proposals of people who did not become clients | 1 month after the request is closed; then only anonymous statistics |
| Other confirmed requests, bookings and the related application emails | 730 days |
| Analytics and security events | 90 days |
| Consent choice cookie | 180 days |
| Language preference cookie | Up to 30 days after its last use |
| Client Studio access | Until 30 days after the end of the last service; the account record stays as contract evidence |
| Project files | Until deleted by the client or the team, or under the return and deletion instructions at the end of the service |
| Backups | 30 days |
| Contracts, accounting and invoices | As long as Belgian law requires |
7. Security
In short: We protect your data with encryption, access controls and careful logging; full measures are listed in the Data Processing Agreement.
We use encrypted transport, access controls, secure session handling, CSRF/request protection, attempt limits, private audit files, backups and updates appropriate to the risk. The admin security audit uses a keyed non-reversible request fingerprint instead of storing the raw visitor address. Typed form content is not copied into analytics events. The full list of technical and organisational measures is in Annex II of the Data Processing Agreement.
8. Your rights
In short: You can ask to see, correct, delete or take your data, object, or withdraw consent; write to support@ninawa.net and we answer within one month.
Subject to the GDPR, you may request access, correction, deletion, restriction, portability or objection and may withdraw consent at any time. We may need to verify your identity proportionately. Requests under Articles 15 to 22 are handled without undue delay and normally within one month, subject to the GDPR rules on permitted extensions.
- Send your request to support@ninawa.net; clients can also use Requests in Client Studio.
- Exercising your rights is free, unless a request is manifestly unfounded or excessive.
- Withdrawing consent for analytics is possible at any time through Cookie settings, without affecting earlier processing.
- Some data must be kept for legal reasons, such as invoices; we then tell you what we keep and why.
9. Complaints
In short: Tell us first if you like, but you may always complain to the Belgian Data Protection Authority.
Contact support@ninawa.net so we can investigate. You may also complain to the Belgian Data Protection Authority (www.dataprotectionauthority.be) or another competent supervisory authority; contacting NINAWA first is not a condition for exercising that right.
10. Automated decisions
In short: No computer decides about you on its own.
NINAWA does not use inquiry or booking data for solely automated decisions that produce legal or similarly significant effects.
11. Changes to this notice
In short: Every version has a date; important changes are announced before they apply.
Each version of this notice carries a version date, shown in the Legal Center together with the history of versions. Material changes, for example a new purpose, provider or retention period, are published as a new version and, for clients, also announced by email or in Client Studio.