Privacy policy

Who processes your data

Two companies carry the Plasm business. The one named in your contract, quote or invoice is the data controller for that file. For this website and for any privacy request, write to the address below: it covers both entities.

We have not appointed a data protection officer (DPO).

When you visit this site

Our host, Vercel Inc., records the requests sent to the site. These technical logs hold your IP address, the date and time, the page requested, the response code, the browser type and the operating system.

We use those logs to serve the pages, keep the site available and spot abuse. We do not use them to identify you or to build a profile. The legal basis is our legitimate interest in running a safe website.

The videos on the homepage, the offer pages and the case studies are not stored on the pages themselves: they are served from Vercel Blob storage. When a video loads, your IP address and browser details go to that service.

The fonts are copied onto our own domain when the site is built. Your browser calls no Google server to display them.

When you write to us or book a call

Here you give us the data yourself. Depending on the channel, it covers:

• your first name and last name
• your email address
• your phone number, if you give it
• your company name and your role, if you give them
• the content of your message and of the exchanges that follow
• the date, time and time zone of the meeting you book

Booking runs through Cal.com, Inc. The booking script loads with the page. When you open the booking window and fill in the form, Cal.com processes that data on our behalf, as our processor.

We use this data to answer you, prepare the call, draw up a proposal and follow up. The legal bases are the pre-contractual steps taken at your request, and our legitimate interest in managing our commercial relationship.

When you become a client

To deliver a project we process the contact details of the people involved, billing data, the VAT number, signed contracts and quotes, the exchanges about the file, the briefs, the access you grant us to advertising accounts, and production documents.

The legal bases are performance of the contract and our legal obligations on accounting and VAT.

When you grant us access to an advertising account, a page or a mailbox, we use that access only for the agreed project. You can withdraw it at any time from the platform concerned.

When you appear in one of our films

We film company owners, teams, customers and sometimes people present on location. The image and the voice of a recognisable person are personal data.

Before we publish a film in which someone is recognisable, we ask for a written release covering image rights and the intended uses. The legal bases are your consent and the contract with the company that commissions the film.

You can withdraw your consent at any time, by email. We then remove the film from the channels we control and we ask our client to do the same. Withdrawal is not retroactive: it does not make earlier publication unlawful, and it may not reach copies shared by third parties.

The campaigns we run for our clients

When we buy and steer advertising on Meta, TikTok, Snapchat, LinkedIn or Google for a client, that client decides the purposes and the means of the processing. The client is the data controller. We act as a processor, on their instructions, within the frame set by article 28 GDPR.

The advertising platforms separately process the data they collect on their own services. For that processing they act as controllers or joint controllers, and their own policies apply.

If a campaign carries a form (lead ad), the details you leave there go to the advertiser. Send any request about that data to the advertiser. If you write to us, we pass your request to the client concerned.

Summary of legal bases

Contract and pre-contractual steps

Answering your request, preparing an offer, delivering a project, invoicing.

Legal obligation

Keeping our accounts, meeting VAT rules, answering a request from a competent authority.

Legitimate interest

Running a safe website, managing and following up the commercial relationship, keeping proof of our agreements, defending our rights.

Consent

Publishing the image and voice of a recognisable person, and any processing for which we explicitly ask your agreement.

Cookies and third-party elements

This site sets no advertising cookie and no audience measurement cookie. We use no Google Analytics, no Meta pixel and no equivalent tool on it. That is why the site shows you no consent banner.

Two elements come from other companies:

• the booking module from Cal.com, Inc., whose script loads on the pages that carry a “Book a call” button. Cal.com may set cookies needed for its own service. We have no access to those cookies.
• the video files, served from Vercel Blob storage, which receives your IP address when a video loads.

If we ever add an audience measurement tool or an advertising pixel to this site, we will ask for your consent before it loads, and we will update this page.

Who receives your data

Your data stays with us and with the providers that let us work. Each of them acts on our instructions, under a data processing agreement:

Vercel Inc.

Website hosting, server logs, storage and delivery of the videos.

Cal.com, Inc.

Meeting bookings and the related reminders.

Our email provider

Hosting of our mailboxes and of our exchanges with you.

Our accountant and our accounting software

Invoices and supporting documents.

The advertising platforms

Meta, TikTok, Snapchat, LinkedIn and Google, for the campaigns we run for our clients.

Our advisers and the authorities

Lawyer, accountant or competent authority, where the law requires it or where we must defend our rights.

We sell no personal data and we rent out no address lists.

Transfers outside the European Union

Several of these providers are established in the United States or process part of the data there. Those transfers rest on the European Commission adequacy decision for the EU–US Data Privacy Framework, where the provider is certified under it, or on the European Commission standard contractual clauses.

You can ask us for a copy of the safeguards that apply to a specific transfer.

How long we keep the data

Server logs

Kept by our host for a short period, then deleted automatically.

Contact requests and bookings with no follow-up

3 years after the last exchange.

Contracts and client files

For the length of the project, then up to 10 years, the limitation period for contractual claims.

Invoices and accounting records

7 years, as Belgian accounting law requires.

Rushes and edit files

For the licence period agreed with the client, then archived or deleted.

Image rights releases

For as long as the film is published, then for the limitation period.

Your rights

The GDPR gives you the following rights over the data we process about you:

• the right of access: to know whether we process data about you, and to obtain a copy
• the right to rectification of inaccurate or incomplete data
• the right to erasure, in the cases the regulation provides
• the right to restriction of processing
• the right to portability, for the data you gave us
• the right to object to processing based on our legitimate interest
• the right to withdraw your consent at any time, with no effect on what happened before

To exercise one of these rights, write to contact@plasm-agency.com. We answer within one month. If the request is complex, we can extend that period by two months and we tell you so. If we have serious doubt about your identity, we can ask for something that confirms it.

If our answer does not satisfy you, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, +32 (0)2 274 48 00. You can also bring the matter to court.

Security

The site is served over HTTPS. Our accounts and tools are protected with a separate password per service. We limit access to a file to the people working on it, and we choose established providers.

No system is infallible. In the event of a breach that carries a high risk to your rights, we inform you and we notify the Belgian Data Protection Authority, as the GDPR requires.

Changes to this page

We update this page when our tools or our processing change. The date at the top shows the version in force. Read it again before you send us data.

A question about this text or about your data? Write to contact@plasm-agency.com.