Privacy policy

Effective date: 29 July 2026

1. Who we are

Shalima BV is responsible for the personal data described in this policy. In data protection language, Shalima BV is the data controller.

Shalima BV
Enterprise and VAT number: BE 0479.029.154
Rozendalstraat 36a
3080 Tervuren
Belgium
Email: alain@alainthys.com

Shalima BV has not appointed a data protection officer because its current activities do not require one. Privacy questions and requests can be sent to the email address above.

2. What this policy covers

This policy applies to:

• www.alainthys.com

• www.thetransformationarchitects.com

• www.arsmoriendix.com

• www.dfrktn.com

• www.customerfit.eu

It also covers personal data Shalima BV receives when you contact us through an email link on one of these websites, subscribe to a Shalima BV publication through Substack, or give permission for us to publish a testimonial, photograph or video.

The websites are intended for business audiences and are not directed at children.

3. Personal data we process

Depending on how you interact with us, we may process:

• Technical and usage data: IP address, device and browser information, visited pages, referring pages, approximate location, timestamps and technical or security logs.

• Cookie choices: your consent identifier, date and time, consent status and related technical information used to record your cookie preferences.

• Enquiry data: your name, business contact details, the content of your message and our correspondence with you.

• Newsletter data: your email address, subscription status, consent record and engagement information made available through Substack, such as deliveries, opens or link interactions.

• Testimonials and media: your name, role, organisation, testimonial, photograph, audio or video when you have agreed to its use.

• Business and legal records: information needed for client administration, accounting, compliance or the establishment, exercise or defence of legal claims.

We may use genuinely anonymised information, including anonymised research quotations. Information that can no longer be linked to an identifiable person is not personal data.

We do not currently use the websites to create user accounts, accept payments, receive job applications or collect identifiable survey or research responses. We do not use personal data from these websites for profiling, solely automated decisions or AI processing.

4. Why we process personal data

ActivityPurposeLegal basisOperating the websites and keeping them secureDeliver pages, diagnose faults, prevent misuse and maintain securityOur legitimate interests in operating secure and reliable websitesBasic website analyticsUnderstand visits and improve the websitesYour consent, where non-essential cookies or similar technologies are usedRecording cookie choicesRemember and demonstrate your consent or refusalCompliance with our legal obligations and our legitimate interest in keeping an accurate consent recordAnswering an email enquiryRespond to your message and follow up where appropriateOur legitimate interests in communicating with business contacts and, where relevant, taking steps at your request before entering into a contractSending a Substack publication, including occasional related promotionsDeliver the publication you requested and manage your subscriptionYour consentPublishing a testimonial, name, photograph or videoShare authorised feedback or mediaYour consentKeeping client, accounting or legal recordsMeet legal duties and manage legal claimsCompliance with a legal obligation or, for legal claims, our legitimate interests

Where we rely on legitimate interests, we consider whether our interests are necessary and balanced against your rights and reasonable expectations. You may object to this processing as explained below.

You are not required to give us personal data merely to browse the public pages. If you choose not to provide information needed for an enquiry, subscription or requested business discussion, we may not be able to provide that particular response or service.

We use a double opt-in process for the Substack publication. This means that the subscription is activated only after the email address has been confirmed.

5. Cookies and similar technologies

Cookies are small files or similar identifiers placed on or read from your device. The websites may use:

• Strictly necessary technologies to deliver the website, protect it and remember privacy choices. These do not require consent where they are genuinely necessary.

• Analytics technologies to understand website traffic and use. We ask for consent before activating non-essential analytics cookies or similar technologies.

You can accept or reject non-essential technologies through the cookie banner. Refusing them does not prevent access to the public content. You can change or withdraw your choice at any time through the cookie settings link available on the relevant website. Withdrawing consent does not affect processing that was lawful before withdrawal.

Cookiebot, provided by Usercentrics A/S, is used to manage and record cookie choices. It may process a consent identifier, consent status, date and time, IP-derived location and related browser or device information for this purpose.

The cookies and similar technologies in use can differ between the websites and may change when a supplier updates its service. The live declaration below forms part of this policy and identifies the technologies detected on the website you are visiting, including their provider, purpose and duration.

Cookie declaration for this website

[Insert the Cookiebot Cookie Declaration for the current domain here.]

6. Who receives personal data

We do not sell or rent personal data.

We use service providers where needed to run the websites and our business. Depending on the website and your interaction, these may include:

• Squarespace and Weebly/Square for website hosting, delivery and basic analytics.

• GoDaddy for domain name and related technical services.

• Cookiebot/Usercentrics for cookie consent management.

• Substack for publication subscriptions, email delivery and related publication analytics.

• Microsoft 365, Dropbox and Infomaniak for email, productivity, storage or cloud services.

• Cloudflare or another infrastructure and security provider where active.

• Professional advisers, public authorities or courts where disclosure is necessary to comply with law or manage legal claims.

These providers may act as processors on our instructions, or as separate controllers when they determine their own purposes and means of processing. For example, Substack generally acts as our processor for publisher functions but also processes certain platform data for its own purposes under its own privacy documents.

At present, website-related personal data is handled solely by Alain Thys on behalf of Shalima BV, apart from the service providers described above.

7. International transfers

Some providers or their subprocessors may process personal data outside Belgium, the European Economic Area, the United Kingdom or your country of residence, including in the United States or Switzerland.

Where data protection law requires a safeguard for such a transfer, we use the mechanism made available by the relevant provider, such as an adequacy decision, participation in an applicable Data Privacy Framework, European Commission standard contractual clauses, or the applicable United Kingdom transfer addendum. You can ask us for more information about the safeguard relevant to your data.

8. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting and dispute-resolution requirements.

Our current working periods are:

• Email enquiries and unsuccessful business discussions: up to two years after the last meaningful contact.

• Newsletter details: while you remain subscribed. After you unsubscribe, we may keep a minimal suppression record where needed to honour your choice not to receive further mail.

• Testimonials and identifiable photographs or videos: while the material remains in use, unless you withdraw your permission earlier.

• Cookie and analytics data: for the periods stated in the Cookiebot declaration on the relevant website.

• Technical and security logs: for the standard period applied by the relevant website or infrastructure provider, unless a longer period is needed to investigate misuse or a security incident.

• Client, tax and accounting records: for the period required by applicable law.

• Information needed for a legal claim: until the relevant limitation period or proceedings have ended.

Genuinely anonymised information may be retained because it no longer identifies an individual.

9. How we protect personal data

We take reasonable technical and organisational measures appropriate to the nature of the data and the risks involved. These include limiting access, using authentication and device protection, applying software updates and selecting established service providers.

No website, email system or online storage service can be guaranteed to be completely secure. If a personal data breach occurs, we will assess it and notify the competent authority and affected individuals where the law requires us to do so.

10. Your rights

Subject to the conditions and exceptions in applicable data protection law, you may have the right to:

• Ask whether we process your personal data and receive a copy.

• Correct inaccurate or incomplete personal data.

• Ask us to erase personal data.

• Ask us to restrict processing.

• Object to processing based on legitimate interests or to direct marketing.

• Receive certain data in a portable format.

• Withdraw consent at any time where processing is based on consent.

• Lodge a complaint with a data protection authority.

You can unsubscribe from the publication through the link in any Substack email. You can change your cookie choice through the cookie settings on the relevant website.

To exercise another right, email alain@alainthys.com. Please describe your request and the context in which you gave us your data. We may ask for information reasonably needed to verify your identity. We normally respond within one month, although the law permits more time for particularly complex or numerous requests.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Some rights are not absolute, and we will explain if an exception applies.

11. Complaints

Please contact us first if you have a concern, so that we have the opportunity to address it.

You also have the right to complain to the supervisory authority where you live or work, or where you believe an infringement occurred. Shalima BV's lead supervisory authority is:

Belgian Data Protection Authority
Rue de la Presse 35 / Drukpersstraat 35
1000 Brussels
Belgium
Email: contact@apd-gba.be
Website: https://www.dataprotectionauthority.be/

12. External websites and services

The websites contain links to services operated by others, including Amazon and Substack. When you follow an external link, the other service controls its own website and may process personal data under its own privacy information. This policy does not describe processing that takes place independently on those external services.

13. Changes to this policy

We may update this policy when our activities, suppliers or legal obligations change. The current version will be published on the websites with its effective date. If a change materially affects how we use personal data, we will provide additional notice where appropriate.