Website Privacy Policy

This policy explains how Replasia BV processes personal data when you visit or interact with our public websites and online pages available at https://replasia.com and any subdomains that link to this notice. It applies to site browsing, contact forms, aggregate visitor statistics, and related website operations only.

It does not apply to clinical, research, imaging, usability testing, or AI-related processing of health data. Those activities are covered by the Replasia Privacy Policy for Clinical, Research, and AI Data Processing.

Contact: Miguel Azevedo (Qity BV)
Email: dpo@qity.be

We collect only what we need to operate and improve the site and to provide content you request.

• Technical and usage data: IP address, date and time, pages viewed, referrer URL, browser and device information, operating system, and similar log data.
• Analytics data: aggregate and pseudonymous statistics generated by our hosting provider, Lovable, and by Google Analytics 4: page views, number of visitors, visit duration, bounce rate, traffic source, device type, and country-level location. Google Analytics sets cookies on your device to distinguish users and measure sessions. The identifiers placed by these cookies are pseudonymous and are not used to build a profile identifying you as an individual.
• Communication data: details you submit via contact forms or email, such as your name, email address, company, message content, and preferences.

We do not ask for special category data on the website. Please do not include health information or other sensitive data in web forms. If such information is received inadvertently, we will delete or redact it unless a lawful reason requires retention.

We process website personal data for the following purposes, using the legal bases set out in Articles 6 and 7 GDPR.

• Site operation and security: to deliver pages, maintain availability, prevent abuse, and detect incidents. Legal basis: our legitimate interests (Art. 6(1)(f)).
• Analytics and performance: to understand site usage and improve content using aggregate and pseudonymous measurement through Lovable's built-in statistics and Google Analytics 4. Google Analytics processes data based on your consent, which you can give or refuse via the cookie consent banner. Legal basis: consent (Art. 6(1)(a)) for Google Analytics processing; our legitimate interests (Art. 6(1)(f)) for Lovable's cookie-free aggregate measurement.
• Responding to enquiries: to answer questions and manage follow-up. Legal basis: pre-contractual steps or legitimate interests (Art. 6(1)(b) or 6(1)(f)).
• Compliance: to meet legal obligations and handle rights requests. Legal basis: legal obligation (Art. 6(1)(c)).

You may object at any time to processing based on our legitimate interests by contacting us using the details in this policy.

This website uses cookies for analytics purposes through Google Analytics 4. Google Analytics sets first-party cookies (such as _ga and related cookies) to distinguish users and measure sessions. These cookies store a pseudonymous client identifier and are not used for advertising or cross-site tracking.

Before Google Analytics cookies are placed, we ask for your consent through a cookie consent banner. You can accept or reject analytics cookies at any time; rejecting them means no GA4 cookies are set and analytics data is not collected through that tool. Our hosting provider Lovable's built-in visitor statistics continue to operate without cookies regardless of your choice.

We do not use marketing, advertising, or social-media tracking cookies. If we introduce additional non-essential cookies in the future, we will update this policy and ask for your consent before those technologies are placed on your device.

Our website is hosted and published by Lovable, which provides built-in, cookie-free visitor analytics acting as our processor. It reports aggregate metrics only — page views, visitor counts, visit duration, bounce rate, traffic sources, device types, and country-level location. It does not use cookies, does not track you across websites, and is not used for advertising or profiling.

We also use Google Analytics 4 to measure traffic and engagement. Google Analytics processes data through cookies that are placed only after you give consent via the cookie consent banner. When you consent, Google Analytics collects pseudonymous usage data (page views, session duration, traffic source, device and approximate location) and reports it in aggregate. You can withdraw consent at any time by clearing your cookies or by declining analytics in the consent banner. Google Analytics data is processed by Google LLC under its standard terms; where data is transferred outside the EEA, Google relies on Standard Contractual Clauses and additional safeguards.

We do not use any third-party advertising, marketing, or social-media tracking tools on this website.

Personal data are shared only as needed with trusted service providers acting under contract to host the site, deliver emails, provide visitor statistics, and secure our infrastructure. These include Lovable (hosting and built-in analytics) and Google LLC (Google Analytics 4), both acting as our processors. We require processors to follow Article 28 GDPR and implement appropriate technical and organisational measures.

If personal data are transferred outside the EEA, we use recognised safeguards such as European Commission adequacy decisions or Standard Contractual Clauses, and we assess any additional measures needed to protect the data.

• Server logs: typically up to 12 months, shorter where feasible.
• Lovable analytics: retained by our hosting provider in aggregate form only; the statistics do not identify individual visitors.
• Google Analytics 4: event-level and user-level data is retained for up to 14 months by default, after which it is automatically deleted or aggregated. The pseudonymous cookie identifiers expire after a maximum of 2 years.
• Contact enquiries: for as long as needed to handle your request and for a limited period thereafter for audit and compliance.

We delete or anonymise data when retention ends, keeping minimal records where required by law.

You have the rights of access, rectification, erasure, restriction, objection, and data portability. You also have the right to lodge a complaint with your supervisory authority. In Belgium, this is the Gegevensbeschermingsautoriteit / Autorité de protection des données (GBA/APD), http://www.dataprotectionauthority.be/ .

To exercise your rights, contact us at info@replasia.com or the postal address above. We will respond within one month, extendable where permitted for complexity.

Our website is not directed to children.

We do not knowingly collect children’s personal data through the site.

We protect personal data using appropriate technical and organisational measures, including TLS encryption, access controls, logging, vulnerability management, and processor due diligence. Internet transmission is never entirely risk-free, so if you prefer, you may contact us by telephone or post.

We do not use the website to carry out decisions based solely on automated processing that produce legal or similarly significant effects.

We may update this policy from time to time to reflect changes in law, services, or providers. Material changes will be highlighted on the site. The effective date above shows when this version took effect.

This website policy covers visitors, website analytics (Lovable's cookie-free statistics and Google Analytics 4), and online forms. It is not intended for processing of medical images, clinical records, or other special category data. If you interact with Replasia in a clinical, research, usability, or AI context, please refer to the Replasia Privacy Policy for Clinical, Research, and AI Data Processing, which addresses Article 9 GDPR safeguards, retention, and participant rights for those activities.