Privacy policy

1. Who is responsible and how to reach us

1.1. The controller is LTC Group SRL, a company under Belgian law, Rue du Noir Jambon 13, 7830 Thoricourt (Silly), Belgium — CBE 1036.831.317 — VAT BE 1036.831.317 ("LTC", "we").

1.2. For any question about your data or to exercise your rights: by email to contact@ltcai.be (subject "GDPR"), by telephone on +32 466 43 16 55, or by post to the address above. Our data protection lead (internal officer) is Cyrille Liétard, co-founder, who can be reached at the same contact details and at admin@ltcai.be.

1.3. We process your data in compliance with Regulation (EU) 2016/679 (GDPR), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, the Act of 13 June 2005 on electronic communications (cookies), the Code of Economic Law (commercial communications) and, where our processing relies on AI systems, Regulation (EU) 2024/1689 (AI Act). Our full internal framework is described in our data protection policy (PDF, in French) and on our compliance page.

2. Who and what this policy applies to

2.1. This policy applies to processing for which LTC determines the purposes and means, i.e. where we act as controller. It concerns: visitors to www.ltcai.be and its language versions; people who use our forms, our AI solutions generator, our guide, our newsletter or our booking module; our prospects, clients and their contacts; our suppliers, partners and their contacts; job applicants; people who interact with us by email, telephone, WhatsApp or on social networks.

2.2. Where we process data on behalf of our clients — for example the data of their own customers, patients, users or staff that passes through an automation, an AI agent, software or infrastructure that we design or operate for them — we act as processor: our client is the controller, and section 12 describes our commitments in that case.

2.3. Our software products (Nota / Sérénotaire, Dedal IA, the Léa voice agent, Demo Studio) and their dedicated websites have their own privacy policies, for example on the Nota trust centre. The third-party websites we link to (LinkedIn, Facebook, WhatsApp, Calendly, Google…) apply their own policies.

3. The data we collect, situation by situation

We apply the principle of data minimisation: each form and each tool only asks for what we need. Here is, case by case, what we collect and what we do with it.

3.1. When you browse the website

a) Internal audience measurement, without cookies. Our website sends browsing events to our own server: page viewed and its title, scroll depth, active reading time, click on a call-to-action button, outbound link, download, form submission, steps of the AI solutions generator and of the booking module (display, slot selected, appointment confirmed). These events are associated with: the domain of the referring website and campaign parameters (utm), the device type, the browser and operating system family, the language, the screen width, and an approximate location (country, region, city) derived from your IP address by our hosting provider. We never store your IP address: it is only used to compute a session identifier in the form of an irreversible fingerprint (hash of the IP address, the browser, the current date and a secret), renewed every day, which makes it impossible to identify you or to track you from one day to the next. No cookie or tracker is set for this measurement, and we honour your browser's "Do Not Track" signal. Bots and automated agents are excluded from the measurement. In addition, our hosting provider Vercel performs its own aggregated, cookieless audience measurement (Vercel Web Analytics: pages viewed, country, device, browser), without any persistent identifier.

b) Google tags (with your consent). The website loads Google Tag Manager, Google Ads and, through these tags, Google Analytics. By default, these tools operate in "consent denied" mode (Google Consent Mode v2): no advertising or analytics cookie is set until you accept via our banner. In this mode, cookieless and identifier-free technical signals may nevertheless be sent to Google (page, timestamp, truncated IP address) for aggregated modelling. If you accept, Google sets measurement and advertising cookies (audience, conversions, retargeting) described in our cookie policy. Your choice is stored in your browser's local storage and can be changed at any time.

c) Technical resources. When pages load, your browser downloads fonts from Google Fonts and the booking module from Calendly; these providers then see your IP address and technical data. Our hosting provider (Vercel) keeps technical logs (IP address, page requested, browser, timestamp) needed for the security and proper operation of the website, retained for a short period.

3.2. When you fill in a contact or request form

We collect: your name and first name, your email address, your telephone number (optional), your company, the type of request (diagnostic, project, support, partnership, general question), the subject and content of your message and, if you provide them, your budget, your timeline, the size of your company and your sector. This data is recorded in our database (hosted in the European Union), transmitted to our sales follow-up tools (our n8n orchestrator hosted in France, our CRM), and triggers a notification email for our team and an acknowledgement of receipt for you. We then get back to you through the channel indicated (email, telephone, WhatsApp).

3.3. When you book a free diagnostic

Booking is done through the Calendly module integrated into the website. Calendly collects your name, your email address, the slot chosen, your time zone, and your answers to any preparation questions (company, telephone, topic). This data is transmitted to LTC to organise the appointment, send you confirmation and reminders, and generate the video-conference link (Google Meet) or agree on a venue. We also record, without personal data, the fact that a booking was made, to measure the effectiveness of the website. Diagnostic conversations are not recorded, unless the participants explicitly agree. The notes taken during the conversation and the summary we give you are kept in our prospect file.

3.4. When you use the AI solutions generator

To build your selection, the generator asks for your sector, your trade, the size of your organisation, your main objective, the tasks that cost you time, your budget range and your current tools. To unlock and send you the full report, it asks for your first name, your email address, your telephone number, the desired call-back date and slot, and your agreement. We record all these answers, the solutions selected, the calculated estimate (hours per week, annual value, recommended tier) and the originating page, in our database hosted in the European Union. You receive a summary by email, our team is notified to prepare the call-back, and your address is added to our mailing list (source "generator"), from which you can withdraw at any time. The estimates are produced by general calculation rules and do not constitute a decision about you (section 10).

3.5. When you download the AI guide

We collect your first name, your email address, your company name (optional), your agreement to be contacted occasionally, the originating page and the timestamp. The guide is sent to you by email with a download link, and our team is notified. This information is kept in our email system and our follow-up tools. You can unsubscribe in one click or by simple email.

3.6. When you subscribe to the newsletter

We collect your email address, your first name (optional), the article or page from which you subscribe and the timestamp. We record your subscription in our database, send you a confirmation email and notify our team. Each mailing explains how to unsubscribe; you can also reply to one of our emails or write to us. We do not measure the opening of our emails individually for profiling purposes.

3.7. When you write to us or call us

When you contact us by email (our professional email is hosted on Microsoft 365), by telephone, by WhatsApp (Meta), by LinkedIn or by Facebook, we process your contact details, the content of your messages and the attachments you send us. We do not record telephone conversations. Exchanges via WhatsApp and social networks are also subject to those platforms' policies, over which we have no control; for sensitive information, prefer email or a channel agreed with us.

3.8. When you become a client (or supplier)

In the context of a quote, contract, subscription or order, we process: the identity, role and contact details of your contact persons; your company's identification and billing data (company number, address, VAT, bank details visible on your payments); quotes, contracts, purchase orders, invoices and the history of the relationship; project data (minutes, requirements, tickets, technical access you entrust to us, intervention logs); payment data processed by our payment providers when you pay online (we never store card numbers). When you pay by card through a provider (Stripe or Mollie), that provider processes your payment data under its own policy. The same principles apply to the contacts of our suppliers and partners.

3.9. When you apply for a job with us

If you send us an application (spontaneous or in response to a vacancy), we process your CV, your letter, your contact details, your background and interview notes, solely to assess your application. We do not request any sensitive data. Unsuccessful applications are deleted at the latest two years after the end of the process, with your agreement to this retention.

3.10. Testimonials, references, photos and videos

We only publish a testimonial, a named case study, a photograph or a video concerning you with your prior agreement, which you can withdraw at any time for the future. Case studies published on the website are, unless stated otherwise, anonymised or illustrative.

3.11. Social networks

We run pages on LinkedIn and Facebook. When you interact with them (follow, reaction, comment, message), the platform and we process these interactions; the platform also provides us with aggregated audience statistics. This processing is governed by the policies of LinkedIn and Meta, with whom we are, for page statistics, joint controllers within the meaning of Article 26 GDPR.

3.12. What we do not collect

On our own behalf, we do not collect special categories of data (health, opinions, beliefs, biometric or genetic data, sexual orientation), data relating to criminal convictions, data of minors under 16, or precise geolocation data. We do not buy data files, do not sell or rent your data, and do not transfer it to any data broker. We do not carry out any targeted advertising based on an individual profile, apart from the Google tools you may accept or refuse.

4. Why we process it and on what legal basis

Each processing operation relies on one of the legal bases provided for in Article 6 GDPR. Where we rely on our legitimate interest, we have verified that the processing is proportionate and does not override your rights; you may object to it (section 9).

5. Who has access: recipients and processors

5.1. Internally, your data is only accessible to the people who need it: the co-founders and, where applicable, the staff or freelancers working on your file, all bound by confidentiality.

5.2. To operate, we use service providers that process data on our behalf (processors), each bound by a contract compliant with Article 28 GDPR and selected for its guarantees. Here is the list of providers actually used on the date of this policy:

5.3. We may also disclose your data to administrative or judicial authorities where the law requires us to do so, to an acquirer or successor in the event of a reorganisation of our company (who will take over the commitments of this policy), and to any person you ask us to make a recipient.

5.4. This list is kept up to date whenever a provider changes. Providers used specifically in the context of a client engagement (automation platforms, AI models, telephony, hosting) are specified in the engagement documentation and in the data processing agreement (section 12).

6. Transfers outside the European Union

6.1. We favour providers and hosting located in the European Union: our website databases are in Ireland, our automations, products and backups in France, our email within Microsoft's European boundary.

6.2. Some of our providers are nevertheless established in the United States or process data there (Vercel, Resend, Notion, Calendly, Google, HubSpot, Meta, LinkedIn, Stripe, some AI model providers). Each transfer is framed, in order of preference, by: the European Commission's adequacy decision on the EU–US Data Privacy Framework, for certified providers; the standard contractual clauses adopted by the European Commission (Decision 2021/914), supplemented where necessary by additional measures (encryption, minimisation, pseudonymisation); or, failing that, one of the derogations of Article 49 GDPR. You can obtain a copy of the applicable safeguards by writing to us.

6.3. When we design a solution for a client, the choice of providers and of the location of processing is agreed with the client according to the sensitivity of the data; for professions bound by professional secrecy, we favour exclusively European processing and upstream pseudonymisation (section 12).

7. How long we keep it

We keep your data for as long as necessary for the purposes described, then delete or anonymise it. Our reference periods:

Encrypted backups of our systems are purged automatically on expiry of their retention cycle (35 days at most for the environments we host).

8. How we protect it

8.1. Technical measures. Encryption of exchanges (HTTPS/TLS with HSTS) and of data at rest with our hosting providers; website security headers (protection against framing, content injection and MIME sniffing); database access restricted by row-level security rules, with public forms only able to write; server keys never exposed in the browser; named accounts, strong authentication (MFA) and centralised secrets management; least-privilege principle; separation of development and production environments; access logging; regular backups; security updates; anti-bot measures on forms; pseudonymisation and minimisation, in particular through our Veil™ technology where sensitive data must be submitted to an AI model.

8.2. Organisational measures. Confidentiality commitments from everyone working for LTC; internal data protection policy and responsible AI usage policy, binding on our staff; regular awareness and training; rigorous selection and contracting of our providers; periodic access reviews; record of processing activities; impact assessments for high-risk processing (for example our notarial platform); incident management procedure.

8.3. In the event of a data breach. Should a data breach likely to result in a risk to your rights and freedoms occur, we would notify the Data Protection Authority within 72 hours of its discovery and, in case of high risk, inform you directly as soon as possible, with the measures taken and our recommendations.

8.4. No measure offers absolute security. We invite you to protect your own equipment and accounts, and never to send us passwords, codes or banking details by email or form; we will never ask you for them through these channels.

9. Your rights and how to exercise them

In accordance with Articles 15 to 22 GDPR, you have the following rights:

• Access: obtain confirmation that we process your data, a copy of it and information about this processing.
• Rectification: have inaccurate data corrected or incomplete data completed.
• Erasure: obtain the deletion of your data, in the cases provided for (data no longer necessary, withdrawal of consent, objection, unlawful processing), subject to our legal retention obligations.
• Restriction: request the temporary freezing of the use of your data, for example while a dispute is being verified.
• Portability: receive the data you have provided to us in a structured, commonly used and machine-readable format, or have it transmitted to another controller where technically feasible.
• Objection: object at any time to processing based on our legitimate interest, on grounds relating to your particular situation; and object without any justification to any direct marketing.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing (newsletter, guide, communications, cookies, testimonials).
• Automated decisions: not to be subject to a decision based solely on automated processing producing legal effects or significantly affecting you (we take none, see section 10).

9.1. How. Write to us at contact@ltcai.be with the subject "GDPR", or by post to LTC Group SRL, Rue du Noir Jambon 13, 7830 Thoricourt, Belgium, specifying the right exercised and the data concerned. To unsubscribe from a communication, use the unsubscribe link where available, reply to the email concerned or write to us; unsubscription is processed without undue delay and at the latest within the following business days. For cookies, use the "change my preferences" link in the cookie policy.

9.2. Verification and timeframes. We may ask you to confirm your identity in a proportionate manner (for example by replying from the known email address) before processing a request. We respond within one month, extendable by two months for complex or numerous requests, in which case we inform you. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests. Each request and our response are recorded.

9.3. If your data was entrusted to us by a client. Where we act as processor (section 12), we forward your request to our client, the controller, and assist it in responding; we invite you to contact the client directly.

9.4. Complaint. If you believe your rights are not being respected, you may lodge a complaint with the Data Protection Authority (section 16) or with the supervisory authority of your Member State of residence, and seek a judicial remedy.

10. Automated decisions, scoring and profiling

10.1. We take no decision based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you. No refusal of service, no pricing and no contractual decision is automated.

10.2. AI solutions generator. The selection of use cases and the estimate (hours, value, tier) are calculated by general rules from your answers. They are purely indicative, do not constitute an assessment of you as a person and have no effect other than presenting you with leads, which are then discussed with a human.

10.3. Internal follow-up score. To organise our call-backs, our internal tool assigns each incoming request a prioritisation score based on simple criteria (originating channel, budget indicated, message length, company and telephone provided) and suggests an allocation between the co-founders. This score is used solely to order our work; it does not condition access to our services or our prices, and every decision is taken by a person. You may object to this processing.

11. Artificial intelligence and your data

11.1. Our internal tools. To draft, analyse, summarise or code, our team uses AI assistants provided by publishers under contract (in particular Claude by Anthropic and Microsoft Copilot), in accordance with our internal AI usage policy (PDF, in French). Rules applied: we only entrust these tools with the data strictly necessary, minimised or pseudonymised; we only use professional versions whose terms exclude training models on the data transmitted; no sensitive data or data covered by professional secrecy is submitted to a consumer tool; every output is reviewed and validated by a person. You may ask us to process your request without using these tools.

11.2. Our solutions and products. When we design or operate an AI solution for a client (agent, chatbot, voice agent, automation), the data passing through it is never used to train or fine-tune a model, neither by LTC nor by its providers; model providers are chosen for their non-retention and non-training commitments; where identifying data must be submitted to a model, it is, wherever possible, pseudonymised upstream by our Veil™ technology, whose mapping table never leaves our infrastructure. Our conversational and voice agents clearly indicate that they are AI, and the synthetic content we publish is marked where the law requires (Article 50 of the AI Act).

11.3. Transparency. Some content on this website and in our communications may have been written or illustrated with the help of AI tools, under human review. Our replies to your requests are always validated by a person. Our inventory of AI systems and their classification under the AI Act are documented internally and summarised on our compliance page.

12. When we process data on behalf of our clients

12.1. In the course of our engagements (automations, AI agents, integrations, IT support, hosting, software products), we access personal data for which our clients are responsible: their customers, patients, users, suppliers, staff. We then process it only on the client's documented instructions, for the purposes of the engagement, as processor within the meaning of Article 28 GDPR.

12.2. Our commitments. We enter into a data processing agreement (DPA) with each client, which specifies the subject matter, duration, nature and purposes of the processing, the categories of data and data subjects, our security measures, the list of our sub-processors (with prior notification of any change and a right to object), our assistance in responding to data subjects' requests, impact assessments and breach notifications, and the fate of the data at the end of the contract (return or deletion, in principle within 60 days). We never use this data for our own purposes or to train a model. Our staff only access it in a restricted, named and logged manner, for support purposes. We respect the professional secrecy by which our clients may be bound.

12.3. Location. We favour processing located in the European Union (hosting at OVHcloud in France, AI model inference in a European region where available) and agree with each client on the level of location and confidentiality suited to its data. For our products, the details of sub-processors and of the location of processing are published, for example on the Nota trust centre.

12.4. Your rights in this case. If you are a customer, patient, user or employee of a company that uses a solution designed or operated by LTC, that company is your point of contact for information and the exercise of your rights. If you contact us directly, we forward your request to it and assist it in responding.

13. Cookies and trackers

13.1. The website uses: strictly necessary cookies and storage (remembering your consent and language choice, security); cookieless internal audience measurement (section 3.1); Google measurement and advertising cookies, set only with your consent; functional cookies of the Calendly booking module when you use it.

13.2. You may accept or refuse non-essential cookies via the banner shown on your first visit, and change your choice at any time from the cookie policy, which details each tracker, its purpose and its duration. Refusal does not prevent access to the website.

14. Minors

Our website and services are intended for professionals. We do not knowingly collect data about persons under 16. If you believe a minor has provided us with data, write to us and we will delete it.

15. Changes to this policy

We update this policy when our services, our providers or the regulations change. The date and version number appear at the top of the page; previous versions are available on request. In the event of a significant change (new purpose, new transfer, major new provider), we inform you by a visible notice on the website or, if you are a client or subscriber, by email.

16. Complaints and contact

16.1. For any question, request or complaint about your data: contact@ltcai.be — +32 466 43 16 55 — LTC Group SRL, Rue du Noir Jambon 13, 7830 Thoricourt (Silly), Belgium. We answer in plain language, and quickly.

16.2. You may also lodge a complaint with the Belgian Data Protection Authority (APD / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels — +32 2 274 48 00 — contact@apd-gba.be — dataprotectionauthority.be, or with the supervisory authority of your Member State of residence.

---

See also: cookie policy, terms of use, terms and conditions of sale, legal notice, GDPR & AI Act compliance, Nota trust centre.