Privacy Policy

Last updated: March 2026

1. Who we are

Thank you for visiting our website! Milieu Consulting SRL (“Milieu”, “we”, “our” or “us”) acts as the data controller for the processing of your personal data described in this Privacy Policy.

We are committed to protecting your personal data and processing it in accordance with the General Data Protection Regulation (GDPR) and applicable Belgian data protection law.

This Privacy Policy aims to inform you about the processing of your personal data when you visit our website.

2. What personal data we process

The following sections provide information on the personal data that we process when you use our website or actively communicate with us. We particularly aim to ensure that you are informed of the following: (i) what data we process; (ii) the purpose of processing; (iii) the legal basis; and (iv) retention period.

  • Contact enquieris

When you contact us via any of our contact details published on our website, we process:

  • Name or other identification details
  • Contact details (e.g. email, telephone number)
  • Content of your message.

In such cases we only process data that you have submitted to us voluntarily and for the purpose of responding to your enquiry.

Purpose: Responding to your enquiry

Legal basis: Article 6(1)(b) or (f) GDPR

Retention: Data are deleted once the enquiry is resolved, unless follow-up is required.

  • Job application

When applying for a job or a position at Milieu (via our website or through a spontaneous application sent to us via e-mail), we process:

  • Name or other identification details
  • Contact details (e.g. email, address, telephone number)
  • CV and cover letter
  • Years of professional experience and your fields of expertise
  • Any other data you choose to disclose.

In case of a potential interview, we might ask you to provide us with additional data such as certificates and documents supporting your application, references etc.

Purpose: Recrutiment and selection

Legal basis: Article 6(1)(b) GDPR (pre-contractual steps)

Retention: With your consent, we may retain unsuccessful applications for up to three (3) years. Consent may be withdrawn at any time.

No automated decision-making or profiling is used in recruitment.

  • Use of our website (general)

When you visit our website, certain technical data may be processed (e.g. IP address, device information).
 Details about cookies and similar technologies are provided in our Cookie Policy, accessible at all times via the website footer.

3. Cookies and tracking technologies

We use cookies and similar technologies on our website.
 Detailed information about:

  • the categories of cookies used,
  • their purposes,
  • their duration,
  • and how to manage your preferences

is available in our Cookie Policy, which forms a separate document.

4. No disclosure of personal data to third parties

We do not disclose your personal data to third parties, whether by transmission or otherwise, except in the following limited circumstances:

  • where such disclosure is necessary to fulfil our contractual obligations towards you or to establish, exercise or defend legal claims;
  • where you have given your consent;
  • where disclosure is required by competent public authorities, in particular law enforcement or data protection authorities, on the basis of applicable law;
  • where we engage service providers acting on our behalf (such as IT, hosting or security providers, recruitment providers), and only to the extent necessary for them to provide their services, subject to appropriate contractual safeguards;
  • where we are otherwise legally obliged to disclose personal data.

In all cases, we ensure that any disclosure of personal data is carried out in accordance with applicable data protection law and is limited to what is strictly necessary for the relevant purpose.

5.Transfer of personal data outside the EU/EEA

As a matter of principle, we endeavour to ensure that personal data are processed within the European Union or the European Economic Area (EU/EEA).

At present, we work exclusively with service providers established within the EU/EEA, and personal data are therefore processed within this area.

Where, in exceptional and duly justified circumstances, a transfer of personal data outside the EU/EEA would nevertheless be necessary, we ensure that such transfers are carried out in accordance with applicable data protection law and subject to appropriate safeguards. These may include, as appropriate:

  • the Standard Contractual Clauses adopted by the European Commission, and
  • supplementary technical or organisational measures, where required, to ensure an essentially equivalent level of protection.

In all cases, any transfer of personal data outside the EU/EEA is limited to what is strictly necessary for the relevant purpose.

6. Security of processing

The security of your personal data is important to us. We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, taking into account:

  • the state of the art,
  • the costs of implementation,
  • the nature, scope, context and purposes of the processing, and
  • the risks to the rights and freedoms of natural persons.

Access to personal data is restricted to authorised persons who require such access for the performance of their duties.

These measures are designed in accordance with Article 32 GDPR and applicable Belgian data protection law.

We regularly review and, where necessary, update our security measures in order to ensure an appropriate level of protection. 

Despite these measures, the transmission of information via the Internet is not completely secure. We therefore cannot guarantee the absolute security of personal data transmitted to or through our website.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the principle of storage limitation.

The retention period applicable to a specific category of personal data depends on:

  • the purpose for which the data are processed;
  • applicable legal or regulatory retention obligations; and
  • the need to retain data for the establishment, exercise or defence of legal claims.

Once the relevant retention period has expired, personal data are permanently deleted or anonymised, unless further retention is required by law. Statistics which have been anonymised may be saved thereafter.

8. Your data protection rights

Under applicable data protection law, you may exercise the following rights in relation to your personal data, subject to the conditions and limitations set out in the GDPR:

  • Right of access – you have the right to information regarding the data we process concerning you and request Milieu for a copy of your personal data together with additional information (Article 15 GDPR).
  • Right to rectification – you have the right to request Milieu to correct any information you believe is inaccurate or incomplete (Article 16 GDPR).
  • Right to erasure – you have the right to request Milieu to delete your personal data if such data are no longer required for the for the original purposes or is processed unlawfully (Article 17 GDPR).
  • Right to restriction of processing – you have the right to request Milieu to restrict the processing of your personal data (Article 18 GDPR).
  • Right to object to processing – if data processing is based on our legitimate interest, you have the right to object to Milieu’s processing of your personal data (Article 20 GDPR).  
  • Right to data portability – you have the right to request that Milieu transfers the data that we have collected to another organisation, or directly to you (Article 20 GDPR).
  • Right to withdraw your consent – where processing is based on your consent, you have the right to withdraw your consent at any time by sending us an email to privacy@milieu.be.  Where processing is based on consent, the withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
  • If we use your personal data for direct marketing purposes, you have the right to object to such processing at any time, free of charge and without giving any reason by sending us an email to privacy@milieu.be.

You also have the right to lodge a complaint with the Belgian Data Protection Authority if you consider that the processing of your personal data infringes applicable data protection law.

9. Contact us

If you wish to:

  • exercise your data protection rights;
  • ask questions regarding this Privacy Policy; or
  • raise concerns about the processing of your personal data,

you may contact us at: privacy@milieu.be

We will handle your request in accordance with applicable data protection law and within the statutory time limits.

10. Changes to thisPrivacy Policy

We may update this Privacy Policy from time to time in order to reflect legal, regulatory or organisational developments.

The most recent version of this Privacy Policy is always available on our website and is indicated by the “Last updated” date at the top of the document.

Where changes materially affect the processing of personal data, we will take appropriate steps to inform users in accordance with applicable data protection law.