Who I am
I am Lucy, an independent private companion based in Brussels, Belgium. This policy explains what personal data I collect through dearlucy.be, why I collect it, and how I handle it.
Data controller: Lucy. For any question about this policy or your data, contact bookings@dearlucy.be.
What I collect
The website’s contact form sends your first name, age, and acceptance of the terms to my hosting provider for eligibility and anti-abuse checks. A short-lived, essential browser cookie links repeat requests. The form does not collect your telephone number or residency. Rejected screening records contain the submitted age and expire after 24 hours; a blocked repeat request starts a new 24-hour period. Suspected misuse creates a private alert containing the submitted name, original and changed ages, and time of the attempt. The form does not send a booking enquiry. When you contact me directly, I may also collect:
- Your first name, telephone number, age, city, preferred date, time, duration, and location.
- Any additional information you choose to share in your message.
- Technical information processed automatically by my hosting provider, such as an IP address and basic request logs used for security and delivery.
Why I collect it, and my legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Enquiry details | Considering, arranging, and responding to your request for a meeting. | Your consent and the steps you ask me to take before a possible agreement. |
| Age and contact details | Confirming eligibility, communicating with you, and protecting my safety. | Your consent and my legitimate interest in preventing misuse and maintaining safety. |
| Technical records | Keeping the website and form secure and reliable. | My legitimate interest in operating a secure website. |
| Screening records and private abuse alerts | Checking eligibility, detecting inconsistent repeat requests, and preventing misuse. | My legitimate interest in protecting my safety and operating a secure contact process. |
The checkbox confirms acceptance of my terms. Submitting the form initiates the screening described above, not a booking enquiry. You may withdraw any consent given when contacting me directly at any time by contacting me.
Who sees your data
I review enquiries personally and do not sell, rent, or trade your personal data.
Netlify processes screening requests and stores limited security records on my behalf. Suspected misuse alerts are processed through Netlify Forms and sent to my private email address; Netlify and my email provider process those alerts. Routine form requests are not emailed to me.
I may disclose information to Belgian authorities only where I am legally required to do so or where disclosure is necessary to protect someone from harm.
How long I keep it
Screening records and the essential browser cookie expire after 24 hours. Expired database records are removed by a task running every ten minutes. Private alert delivery records are kept in the database for up to seven days; the name is removed from that database record once delivery is accepted. Copies in Netlify Forms and my email inbox remain until I review and delete them when no longer needed for security.
I keep enquiry details only for as long as needed to consider your request, arrange a meeting, manage necessary correspondence, or comply with a legal obligation. Information that is no longer needed is deleted.
How I protect it
Information submitted through the form is transmitted over an encrypted HTTPS connection. Access is restricted, and I take reasonable measures to protect it against loss, misuse, or unauthorised access.
Your rights
Under the GDPR, you may ask me to:
- Give you access to the personal data I hold about you.
- Correct inaccurate or incomplete data.
- Delete your data where the law allows.
- Restrict or object to certain processing.
- Provide eligible data in a portable format.
- Record the withdrawal of your consent at any time.
Contact
To exercise your rights or ask a privacy question, email bookings@dearlucy.be. You may also lodge a complaint with the Belgian Data Protection Authority.