Privacy Policy
Last updated: 19 August 2026
1. Who we are
This website (https://jeroen-de-flander.com) is operated by The Performance Factory BV, with registered office at Louizalaan 143/4, 1050 Brussels (Ixelles), Belgium, company number BE 0808.913.187.
We are the data controller for the personal data described in this policy.
For any privacy question, or to exercise your rights, contact us at jeroen.de.flander@the-performance-factory.com.
2. What this policy covers
This policy explains what personal data we collect when you visit this website, why we collect it, how long we keep it, who we share it with, and what rights you have. It applies to this website and the forms on it. It does not apply to third-party websites we link to.
3. The data we collect and why
3.1 Contact form
When you use the contact form, we collect your full name, email address, subject and message, together with a record that you ticked the privacy consent box.
We use this data solely to read and answer your message, and to follow up on a possible speaking engagement or collaboration.
Our forms run on the Gravity Forms plugin. Submissions are stored in this website’s database, hosted by Combell in Belgium, and are also sent to us by email.
Legal basis: our legitimate interest in responding to enquiries addressed to us and, where your message concerns a possible booking, steps taken at your request before entering into a contract (Article 6(1)(f) and 6(1)(b) GDPR).
3.2 Newsletter and email list
When you subscribe through one of the signup forms, we collect your email address, the date of subscription and a record of your consent.
We use this to send you articles, insights and resources on strategy and strategy execution, and occasionally information about our books, keynotes or other services.
We send these emails through Brevo (Sendinblue SAS, France). Brevo processes your email address on our behalf and records standard engagement data such as whether an email was opened and which links were clicked, so that we can measure what is useful and stop sending what is not.
Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time through the unsubscribe link in every email, or by emailing us. Withdrawal does not affect the lawfulness of emails sent before.
3.3 Downloads and gated content
When you request a whitepaper or other download, we collect the data you enter in that form, normally your email address and, where asked, your name and organisation. We keep that email address and add it to our email list on the basis of the consent you give in the form, so the download form is also a subscription to our mailings.
Legal basis: your consent (Article 6(1)(a) GDPR). The same unsubscribe options apply as in section 3.2.
3.4 Bot protection: Cloudflare Turnstile (invisible mode)
All forms on this website are protected by Cloudflare Turnstile, a bot detection tool provided by Cloudflare, Inc. Turnstile runs in invisible mode: it works in the background and you never see a widget or have to solve a puzzle.
To distinguish human visitors from automated traffic, Turnstile processes a limited set of client-side signals, including:
- your IP address;
- your TLS fingerprint;
- your browser’s User-Agent header;
- the sitekey of this website and the origin of the request.
Cloudflare states that it cannot directly identify individuals from these signals, and that it does not use them to profile or target anyone. Turnstile may store a small amount of information on your device where that is strictly necessary to run the security check.
If Turnstile classifies a submission as automated, that submission can be blocked or flagged as spam. This is a purely technical security measure and produces no legal effect for you. If you believe a genuine message of yours was blocked, email us at jeroen.de.flander@the-performance-factory.com and we will make sure it reaches us.
Legal basis: our legitimate interest in protecting this website and its forms against spam, abuse and automated attacks (Article 6(1)(f) GDPR). This processing is strictly necessary for the security of the service, so it does not depend on cookie consent.
Roles: Cloudflare acts as our processor when it uses these signals to protect our forms. Cloudflare acts as an independent controller when it uses the same signals to improve its own bot detection capabilities, relying on its own legitimate interest.
For full details of how Cloudflare handles this data, see the Cloudflare Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/. That addendum supplements Cloudflare’s general privacy policy, to which it links. Cloudflare’s Data Protection Officer can be reached at dpo@cloudflare.com.
3.5 Server logs and hosting
This website is hosted by Combell NV (Ghent, Belgium), on servers located in Belgium. Our hosting environment automatically records technical data when you visit, such as your IP address, the pages you request, timestamps, referrer and browser type. These logs exist to keep the site running, diagnose faults and detect abuse.
Server logs are kept for 14 days and then deleted.
Legal basis: our legitimate interest in the security, availability and troubleshooting of the website (Article 6(1)(f) GDPR).
3.6 Cookies and Google Tag Manager
This website uses Google Tag Manager (Google Ireland Limited) to load measurement and marketing scripts. Tag Manager is a container: the tags it loads are what actually collect data about you.
These tags place cookies or similar identifiers on your device and can share data with the providers concerned, including outside the European Economic Area.
We only load these tags after you give consent through our cookie banner. You can change or withdraw your choices at any time via Cookie-instellingen aanpassen. Strictly necessary cookies, including those needed for security and for the forms to work, are always active.
Legal basis: your consent (Article 6(1)(a) GDPR and Article 129 of the Belgian Electronic Communications Act, implementing the ePrivacy Directive), except for strictly necessary cookies, which rely on our legitimate interest.
3.7 Embedded YouTube videos and other embedded content
Articles on this site embed content from other platforms, in particular YouTube videos. These videos are embedded directly, which means YouTube (Google Ireland Limited) can place cookies and collect data about you as soon as the page loads, including your IP address, device information and viewing behaviour. If you are logged in to a Google account, YouTube can link that activity to your account.
We have no control over this processing. See Google’s privacy policy for details.
These videos are embedded directly and load automatically as soon as the page loads, regardless of the choice you make in the cookie banner. This means YouTube may already set cookies and collect data before you have given consent. We acknowledge that this is a weaker privacy position than using a privacy-enhanced embed (youtube-nocookie.com) or click-to-load, and we are looking into improving this.
Legal basis: our processing of this data is not currently gated by your consent; see the acknowledgement above.
3.8 Social media links
Our pages link to profiles on LinkedIn, X, YouTube and Instagram. These are plain links. Clicking them takes you to those platforms, where their own privacy policies apply.
4. Who we share your data with
We do not sell your personal data. We share it with service providers who process it on our behalf under a data processing agreement, and with the providers of the tags and embedded content described above:
| Provider | Purpose | Location |
|---|---|---|
| Combell NV | Website hosting, form storage, server logs | Belgium |
| Sendinblue SAS (Brevo) | Sending and managing our email list | France |
| Cloudflare, Inc. | Bot protection on forms (Turnstile) | United States / global network |
| Google Ireland Limited | Tag management, [analytics], embedded YouTube videos | Ireland, with transfers to the United States |
We may also disclose data where we are legally required to do so, or to establish, exercise or defend legal claims.
5. International transfers
Combell and Brevo process your data within the European Union.
Cloudflare is established in the United States. Google, although contracted through its Irish entity, transfers data to the United States. Where personal data leaves the European Economic Area, the transfer is covered by an appropriate safeguard under Chapter V GDPR, namely the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.
You can request further information about these safeguards at jeroen.de.flander@the-performance-factory.com.
6. How long we keep your data
| Data | Retention |
|---|---|
| Contact form submissions | 24 months after the exchange is closed |
| Newsletter and download subscriptions | Until you unsubscribe |
| Record of consent and unsubscribe requests | 3 years after the subscription ends, as proof of compliance |
| Server logs | 14 days |
| Analytics and marketing cookies | As stated per tag in section 3.6 |
| Turnstile signals | Determined by Cloudflare; see the Turnstile Privacy Addendum |
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict our processing;
- object to processing based on legitimate interest, including the bot protection described above;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing carried out before withdrawal.
Send any request to jeroen.de.flander@the-performance-factory.com. We respond within one month. We may ask for information to confirm your identity.
If you are unhappy with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be.
8. Security
We apply appropriate technical and organisational measures to protect your data, including encrypted transport (HTTPS), access controls, keeping the website and its plugins up to date, and the bot protection described in section 3.4. No system is completely secure, but we take these obligations seriously.
9. Automated decision-making
We do not take decisions with legal or similarly significant effects about you based solely on automated processing. The Turnstile bot check described in section 3.4 is an automated technical filter on form submissions only, and you can always reach us directly by email if it blocks you.
10. Children
This website is aimed at professionals. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with data, contact us and we will delete it.
11. Changes to this policy
We may update this policy when our website or our processing changes. The date at the top shows the current version. Significant changes will be announced on this page.
12. Contact
The Performance Factory BV
Louizalaan 143/4
1050 Brussels (Ixelles), Belgium
BE 0808.913.187
jeroen.de.flander@the-performance-factory.com
Reference to Cloudflare’s Turnstile Privacy Addendum is included as required for the use of Turnstile in invisible mode: https://www.cloudflare.com/turnstile-privacy-policy/