Last updated: August 11, 2026.
1. Data controller
Data controller: the sole proprietorship registered under number BCE 0801.683.521 and operating under the commercial name Hebora
Official verification: Public Search of the Crossroads Bank for Enterprises
Headquarters: Rue Saint-Vincent 117 box 1, 1140 Evere, Belgium
Contact: contact form
2. Data processed
The site only processes the data necessary for the actions you trigger:
- Contact form: name, email address and message;
- Site diagnosis: address of public site tested, date, time, PageSpeed result and test status;
- Optional diagnostic follow-up: email address, name and message if you explicitly request a response.
No advertising analysis tools, tracking pixels, Google Analytics or Facebook Pixel are loaded by the site.
3. Purposes and legal bases
- Carry out the requested diagnosis and prepare a possible service: pre-contractual steps taken at your request (article 6.1.b of the GDPR);
- Respond to a request for a quote or service: pre-contractual steps (article 6.1.b);
- Respond to optional follow-up requested after a diagnosis: explicit consent (article 6.1.a);
- Prevent abuse and secure forms: legitimate interest in protecting the service (article 6.1.f).
The data is not used for profiling, advertising or automated marketing.
4. Recipients and service providers
Hebora is the recipient of the requests. Strictly necessary technical service providers may process data to provide their service:
- Google PageSpeed Insights: analysis of the public address submitted to the diagnosis;
- Vercel and Upstash: execution of the diagnosis and temporary conservation of its trace;
- Resend: transmission of contact and follow-up requests;
- GitHub Pages: hosting of static pages of the site.
The data is neither sold nor rented. Some service providers are established outside the European Economic Area; their transfer mechanisms and contractual commitments apply depending on the service used.
5. Shelf life
- Trace of diagnosis and contact details possibly attached: maximum 90 days ;
- Contact exchanges: maximum 12 months after the last exchange, unless there is a current contract, legal obligation or need to defend a right;
- Privacy choice kept on the device: maximum six months.
6. Your rights
Under the conditions provided for by the GDPR, you can request access, rectification, erasure or limitation of your data, receive portable data when this right applies, object to processing based on legitimate interest and withdraw consent at any time.
Use the contact form to exercise a right. A response is provided within one month, extendable in the cases provided for by the GDPR. Proof of identity may be requested only if reasonable doubt exists as to the identity of the applicant.
7. Storage on your device
The confidentiality choice is saved in localStorage so you are not asked again on each page. It expires after six months. The chosen language and liked projects are only saved with your permission and are deleted when you reject the preferences.
Voluntarily transferring an Audit Lab summary to the form temporarily uses the tab session. The value is removed after reading and does not appear in the URL.
8. Security
The site is served over HTTPS. Forms are protected against improper submissions and data is transmitted encrypted in transit. Access to data is limited to what is necessary to process the request.
9. Complaint
You can lodge a complaint with theData Protection Authority Belgian:
Rue de la Presse 35, 1000 Brussels
authorityprotectiondonnees.be