Privacy Policy

1. Introduction and controller identity

Vik-Immo BV ("Vik-Immo", "we", "us", "our") is a Belgium-based organization that provides professional financial education programs. This Privacy Policy describes what personal data we collect, why we collect it, how we use it, and the choices you have.

Data Controller: Vik-Immo BV, Nachtegalendreef 17, 2280 Grobbendonk, Belgium.

Contact email: [email protected]. Phone: +32 14 70 84 63.

We do not appoint a Data Protection Officer as a matter of course. If your request relates to privacy, you can contact us at the email address above and we will route it to the appropriate person.

Effective Date: March 14, 2026.

2. Personal data we collect

The personal data we collect depends on how you interact with the site. We aim to collect only what is needed for educational inquiries, site operation, and (if you consent) measurement and advertising relevance.

• Identity and contact data: name, email address, phone number, and similar details you provide in forms or in email correspondence.
• Form content: messages, course selection, and any project or learning details you share when requesting information.
• Technical data: IP address, browser type, device identifiers, operating system, language settings, and approximate location derived from IP (country or region level).
• Usage data: pages viewed, time spent on pages, referral source, click paths, and general interaction events. This is typically collected through analytics tools only when you consent.
• Cookies and identifiers: essential cookies for site continuity and a consent cookie; optional analytics and marketing identifiers if you opt in (see Section 4).
• Conversion events: events such as successful form submissions, used to measure the effectiveness of pages and campaigns (only where applicable and only with the appropriate consent for analytics/marketing).

We do not intentionally collect special-category data (such as health information, religion, political opinions), financial account numbers, government identification documents, or payment card details through this website. Please do not include sensitive information in the message fields.

3. Why we process personal data and legal bases (GDPR Article 6)

We process personal data for specific purposes and rely on the legal bases defined by the General Data Protection Regulation (GDPR).

• Responding to inquiries and course information requests: to communicate with you, provide program details, and confirm next steps. Legal basis: Article 6(1)(b) (steps prior to entering a contract) and Article 6(1)(a) (consent where required for the form submission context).
• Providing and securing the website: to operate the site, maintain availability, prevent abuse, and investigate suspicious activity. Legal basis: Article 6(1)(f) (legitimate interests in security and service continuity).
• Analytics measurement (optional): to understand how pages perform and improve content. Legal basis: Article 6(1)(a) (consent).
• Marketing and remarketing (optional): to measure advertising performance and to show more relevant messages to people who have interacted with our site. Legal basis: Article 6(1)(a) (consent).
• Legal compliance: where we must keep records or respond to lawful requests. Legal basis: Article 6(1)(c) (legal obligation).

Automated decision-making (GDPR Article 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Cookies and tracking

Cookies are small text files placed on your device. Some cookies are essential for the site to function. Others help us measure usage or support advertising attribution and remarketing. We also use similar technologies such as pixel tags and server-side events, depending on your consent settings.

Essential cookies (always active)

Essential cookies are required for basic site operation and to remember your consent choice. These do not require consent under EU rules.

• _site_session: supports basic session continuity. Retention: session to up to 30 days.
• cookie_consent: stores your cookie preferences. Retention: 12 months.

Analytics cookies (optional, consent required)

If you opt in, we may use Google Analytics 4 (GA4) to understand how the website is used. Where configured, we use IP anonymization and limit retention to 14 months for analytics data in reporting.

• _ga: GA4 user identifier. Typical retention: 2 years.
• _ga_XXXXXXXXXX: GA4 session state. Typical retention: 2 years.

Marketing cookies (optional, consent required)

If you opt in, we may use Google Ads and Meta advertising tools for conversion attribution, remarketing audiences, and measurement. These tools can set marketing identifiers that help recognize a browser and attribute ad clicks to site activity.

• _gcl_au: Google Ads conversion linker. Typical retention: 90 days.
• _fbp: Meta Pixel browser identifier. Typical retention: 90 days.
• _fbc: Meta Pixel click identifier (when click ID is present). Typical retention: 90 days.

Beyond cookies, marketing and analytics implementations may involve pixel tags (for example, gtag.js or a Meta Pixel) and server-side measurement (for example, Google Tag Manager or Conversion API integrations). If server-side measurement is enabled, it may use limited identifiers such as IP address and User-Agent, and may hash certain fields (such as email) before transmission for matching. These technologies are activated only when the relevant consent category is enabled.

5. Consent for analytics and marketing (EEA and UK)

Users in the European Economic Area and the United Kingdom receive a consent notice under GDPR and UK GDPR principles. Analytics and marketing cookies activate only after explicit, informed, freely given consent (GDPR Article 6(1)(a)).

Consent is recorded in the cookie_consent cookie and is typically stored for up to 12 months. You can withdraw consent at any time by using the "Manage cookie preferences" link in the footer (or by clearing cookies in your browser). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Sharing with advertising and service partners

We use a limited set of service providers to operate the website and (if you consent) to measure and improve advertising relevance. We do not sell personal data.

• Google LLC (Google Analytics 4, Google Ads, Google Tag Manager, remarketing): may receive cookie identifiers, usage data, conversions, and audience membership signals when enabled. Reference: https://policies.google.com/privacy.
• Meta Platforms, Inc. (Meta Pixel, Custom/Lookalike Audiences, Conversion API): may receive page views, conversions, audience membership, and hashed identifiers when enabled. Reference: https://www.facebook.com/privacy/policy.
• Cloudflare (content delivery network and security): may process IP and security-related signals to protect the site. Reference: https://www.cloudflare.com/privacypolicy/.

We do not permit these providers to use site data for their own independent commercial purposes. Where they act as independent controllers for some processing, their policies apply as well.

7. International data transfers

Some providers may process data outside the European Economic Area, including in the United States. Where transfers occur, we rely on appropriate safeguards such as the EU-US Data Privacy Framework (where applicable) and Standard Contractual Clauses (EU 2021/914) as a fallback, as well as additional measures where appropriate.

If you want details on the safeguards used for a specific transfer, contact us at [email protected].

8. Data retention

We keep personal data only as long as needed for the purposes described above, unless a longer period is required by law or is necessary to resolve disputes or enforce agreements.

• Contact submissions: typically up to 2 years from the last interaction, unless a longer period is justified by the context of the inquiry.
• Email correspondence: typically for the duration of the relationship plus 1 year, unless legal obligations apply.
• Server logs: typically up to 90 days for security and troubleshooting.
• Analytics data: 14 months for reporting retention (where configured), and cookies as described in Section 4.
• Marketing cookies: per cookie lifetime (typically 90 days), and audiences as configured in advertising platforms when enabled by consent.
• Cookie consent record: up to 3 years for audit and compliance documentation.
• Legal and tax records: retained as required by applicable law (often 6 to 10 years for invoices, if any).

9. Your rights under GDPR

If GDPR applies to you, you may have the following rights: access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), objection (Article 21), and the right to withdraw consent at any time (Article 7(3)). You also have the right to lodge a complaint with a supervisory authority (Article 77).

To exercise your rights, email [email protected]. Please include enough detail for us to identify your request and the context. We may ask for additional information to verify identity and prevent unauthorized disclosure.

We aim to respond within 30 days. If a request is complex, this may be extended by up to 60 additional days, and we will inform you of the reason.

Supervisory authority in Belgium: the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit). Website: https://www.dataprotectionauthority.be/. You can also consult the European Data Protection Board for general guidance: https://edpb.europa.eu/.

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal data from minors. If we become aware that personal data from a child under 16 has been collected without verifiable parental consent, we will delete it promptly.

11. Do Not Track signals

This website does not respond to Do Not Track (DNT) browser signals. Third-party providers may have their own handling of such signals or offer separate opt-out mechanisms.

12. Requests for deletion

To request deletion of personal data, email [email protected] with the subject line "Data Deletion Request". We may need to verify identity before completing deletion. We will complete verified requests within 30 days, except where limited retention is required by law or necessary for security, fraud prevention, or legal claims.

13. Business transfers

If Vik-Immo BV is involved in a merger, acquisition, reorganization, financing, asset sale, or insolvency, personal data may be transferred to a successor or affiliate as part of that transaction. If the transfer materially changes how personal data is used, we will provide notice on the website.

14. California (CCPA / CPRA)

If you are a California resident and the CCPA/CPRA applies, you may have rights to know, delete, correct, and opt out of the "sale" or "sharing" of personal information as defined by California law. We do not sell personal information for money. We may share information for cross-context behavioral advertising when marketing cookies are enabled by consent.

Categories disclosed in the past 12 months may include: identifiers (such as name, email, IP address, cookie IDs), internet or network activity (such as page views and interactions), and inferences (such as interests used for ad relevance). We disclose these to service providers and advertising partners only as needed for the purposes described in this policy.

To submit a request, email [email protected] with the subject line "California Privacy Request". We will verify your request as required by law. Authorized agents may submit requests with proof of authorization.

15. Virginia (VCDPA)

If you are a Virginia resident and the VCDPA applies, you may have rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising. We do not sell personal data and do not engage in profiling that produces legal or similarly significant effects.

To submit a request, email [email protected] with the subject line "Virginia Privacy Request". If we decline a request, you may appeal by emailing with the subject line "Appeal of Refusal — Privacy Request". We aim to respond to appeals within 60 days.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject "Nevada Do Not Sell Request". We do not currently sell personal information as defined by Nevada Revised Statutes Chapter 603A.

17. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or technical implementations. If we make material changes, we will provide a notice on the website at least 14 days before the changes take effect where practicable. The "Last Updated" date at the top of this page indicates the latest revision.

18. Contact

If you have questions about this Privacy Policy or your personal data, contact:

• Vik-Immo BV
• Nachtegalendreef 17, 2280 Grobbendonk, Belgium
• Email: [email protected]
• Phone: +32 14 70 84 63