Privacy Policy | BACKBONE — Cedric De Vlieger

1. Who is responsible

Mission 4 Mastery BV, trading as BACKBONE. Performance, VAT BE 1017.930.371, Sint-Bavostraat 14, 8700 Kanegem, België. Both websites belong to this company.

Questions about your data: cedric@backboneperformance.eu. Via cedricdevlieger.com you can also write to cedric@cedricdevlieger.com. Both addresses reach Cedric De Vlieger.

2. Contact form and email

On both sites. You fill in your name, email address, optionally your organisation, the type of request and your message. We also store your language and the site you came from.

Purpose: answering your request and preparing a possible collaboration.
Legal basis: steps at your request prior to a contract, and our legitimate interest in replying.
Retention: 24 months after your request. After that the request is deleted automatically. If it leads to a collaboration, we keep the data within that collaboration for as long as the law requires.
Processors: Supabase (database), Resend (email), Vercel (hosting). If you email us directly, Google Workspace processes your message as our email provider.

3. Waiting lists and mission manual (cedricdevlieger.com)

You can sign up for the online programme, for the next live evening, or request the mission manual that goes with the book. You give your email address and optionally your first name. We also store your language, the list and the time.

Purpose: letting you know when the programme or the live evening is there, sending you the manual, and emailing you now and then about the book, the talk and the programme.
Legal basis: your consent. You withdraw it with the unsubscribe link at the bottom of every email, or with a short email to us.
Mission manual: double opt-in. The manual is only sent after you click the confirmation link. If you do not confirm within 30 days, your sign-up is deleted automatically.
Retention: until you unsubscribe, and at the latest 12 months after the launch of what you were waiting for.
Processors: Supabase (database), Resend (email), Vercel (hosting).

4. After a keynote: key takeaways and my next book (backboneperformance.eu)

After a keynote you can request the key takeaways, and you can sign up to hear when pre-orders for my next book open. You only give your email address. We also store your language, the time, the list, the edition of the book you chose and the page or button you came through.

Purpose: sending you the key takeaways. Only if you choose this separately (a box that is not pre-ticked, or the pre-order button) will I email you now and then with an idea to take it further, or let you know when pre-orders for the book open.
Legal basis: for the key takeaways, your own request; for follow-up emails and the pre-orders, your consent. You withdraw it with the unsubscribe link at the bottom of every email, or by sending us an email.
Double opt-in: your address is only confirmed once you open the link in our email. Without that click you will not hear from us again, and after 30 days your sign-up is deleted automatically.
Retention: if you did not opt in to follow-up emails, your address is deleted 12 months after your request. With follow-up emails: until you unsubscribe. For the pre-orders: no later than 12 months after the book comes out.
We never pass your address on to anyone.
Processors: Supabase (database), Resend (email), Vercel (hosting).

5. Book orders

If you order the book through the site, payment takes place on Stripe’s secure page. We never see your card details and we do not ask for a phone number.

Data: name, email address, delivery address, quantity, amount and the Stripe reference number.
Purpose: processing, shipping and confirming your order.
Legal basis: the contract with you, and our legal accounting obligation.
Retention: your delivery address is deleted automatically 12 months after the order. Name, email address and amount are kept for 7 years, as accounting law requires.
Processors: Stripe (payment), SendCloud (shipping label, Netherlands), Supabase (database), Resend (email), Vercel (hosting).

6. BACKBONE Teamscan (for client teams)

The teamscan is an anonymous questionnaire for a team within an organisation we work with. Your organisation gives us the participants’ email addresses for the invitation.

Invitations: email address, and when you were invited, reminded and finished. Nothing more.
Answers: without name, email address, IP address or exact time. They cannot be linked to you, not even by us.
Purpose: an honest team reflection, fed back to the whole team at once.
Legal basis: the legitimate interest of your organisation and of us in guiding the team. You only give your answers after agreeing on the start screen.
Retention: individual answers and invitations are deleted automatically 6 months after the team session. Only the group figures remain, without personal data.
Processors: Supabase (database), Resend (email), Vercel (hosting).

7. Protection against bots

Our forms are attacked by spam robots every day. So we do two things you do not see.

With every submission we keep an encrypted fingerprint of your IP address for 48 hours, not the address itself. That lets us stop a flood from one place. After 48 hours the fingerprint is deleted automatically.
On pages with a form, Cloudflare Turnstile runs. That check processes your IP address and a few browser characteristics to tell a human from a robot. Cloudflare does not build a profile with it.
Legal basis: our legitimate interest in keeping the site working and the inbox usable.

8. Website statistics

We measure visits with Google Analytics, loaded through Google Tag Manager. That only happens after you click Accept in the cookie banner. Without that click nothing from Google is loaded and nothing is sent to Google. Details are in the cookie policy.

9. Processors and transfers outside the EU

We never sell your data. We work with these providers, each under a data processing agreement: Vercel (hosting), Supabase (database), Resend (email), Stripe (payment), SendCloud (shipping), Cloudflare (bot check), Google (statistics after consent, and our email provider). Some of them process data outside the European Economic Area. In that case we rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

10. Security

All traffic is encrypted. Access keys live only in a secured server environment, never in the website itself. We do not store IP addresses in readable form. Only Cedric De Vlieger has access to the data. Security reports can be sent to the address in security.txt on both sites.

11. Your rights

You have the right to access, correct, erase, restrict and port your data, and you can object to processing based on legitimate interest. You can withdraw consent at any time. Send your request to cedric@backboneperformance.eu; you will hear from us within a month. Not satisfied? You can lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

12. Changes

If anything changes in what we do with data, we update this policy and the date at the top. The current version is on both sites.