Last updated: 17 August 2026 Privacy policy

1. Who we are

Grava Group ("the Company", "we", "us") is responsible for the processing of personal data as described in this privacy policy.

Company name: Grava Group BV.

Company number (CBE/VAT): BE 0782.538.788

Registered office: Sneeuwbeslaan 14, 2610 Antwerp, Belgium

Website: www.gravagroup.be

Email for privacy questions: info@gravagroup.be

We attach great importance to protecting your personal data and process it in accordance with the General Data Protection Regulation (GDPR) and Belgian data protection legislation.

2. What data we collect

Depending on how you use our website, we may collect the following categories of data:

2.1 Data you provide to us directly

Surname and first name

Email address

Phone number

Address details (e.g. for quote requests for renovation work)

Content of your message/request via the contact form

Any attachments (photos, plans) you share with us

2.2 Data collected automatically

IP address

Browser and device type

Pages visited and time spent on the website

Referring website (referrer)

Cookies and similar technologies (see section 6)

2.3 Data via third parties (advertising and analytics tools)

If we use Facebook/Meta advertising (Meta Pixel), Google Analytics or similar tools, these parties may collect additional data such as device IDs, ad interaction data and anonymised usage statistics. See sections 6 and 7.

2.4 WhatsApp

If you contact us via WhatsApp (Business), we process your phone number, the content of your messages and any attachments (photos, documents) you send us. WhatsApp is operated by Meta Platforms Ireland Ltd. Meta may process certain metadata (e.g. time of sending, device data) in accordance with WhatsApp/Meta's own privacy policy. We use this data solely to answer your question and follow up your file. Messages are kept for as long as necessary to follow up your request or ongoing site (see section 4).

2.5 Analysis of user behaviour (heatmaps, session recordings)

If we use tools such as Hotjar, Microsoft Clarity or similar software to analyse how visitors use our website (e.g. mouse movements, scrolling behaviour, click patterns), this happens only after your consent via the cookie banner. These tools may record sessions in anonymised or pseudonymised form. Sensitive fields (such as passwords or payment details) are never recorded. See section 6 for more information on the cookie categories used.

3. Why we process your data (purposes and legal basis)

Purpose — Legal basis (GDPR)

Answering your question/quote request — Performance of (steps prior to) a contract — art. 6.1.b

Following up ongoing sites and client files — Performance of a contract — art. 6.1.b

Sending newsletters, offers and updates — Consent — art. 6.1.a

Website analysis and improving our services — Legitimate interest — art. 6.1.f

Personalised advertising (Facebook/Meta, Google) — Consent (via cookie banner) — art. 6.1.a

Compliance with legal/accounting obligations — Legal obligation — art. 6.1.c

The Company has the right to send the User notifications about new products and services, special offers and various events. The User can unsubscribe from such messages by sending an email to privacy@gravagroup.be stating "Unsubscribe from notifications" / "Opt-out van meldingen".

4. How long we keep your data

Contact form/quote requests: up to 2 years after the last contact, unless a contract is concluded (in which case the retention periods below for client files apply)

Client files and invoicing: at least 7 years, in accordance with Belgian accounting and tax law

Newsletter subscriptions: until you unsubscribe

Cookies and analytics data: see section 6 (cookie policy) for specific retention periods per cookie type

5. Who we share your data with

We only share your data where necessary, with:

Processors who provide services on our behalf: hosting provider, bookkeeper/accountant, email platform, CRM system

Advertising and analytics platforms: Meta (Facebook/Instagram), Google (Analytics, Ads) — if you have given consent via our cookie banner

Subcontractors and suppliers, only insofar as necessary to carry out your site/assignment, and only the relevant data

Public authorities, if we are legally obliged to do so

We never sell your data to third parties.

International transfers

Some of our service providers (such as Meta and Google) may process data outside the European Economic Area (EEA), including in the United States. In that case we make sure appropriate safeguards are applied, such as the European Commission's Standard Contractual Clauses (SCCs).

6. Cookie policy

Our website uses cookies and similar technologies. On your first visit, a cookie banner asks you to indicate your preferences.

Category — Purpose — Example — Consent?

Necessary cookies — Correct functioning of the website — Session management, language setting — No (always active)

Functional cookies — Remembering preferences — Form data, previous choices — Yes

Analytical cookies — Measuring and improving website use — Google Analytics, Hotjar, Microsoft Clarity — Yes

Marketing cookies — Personalised advertising — Meta Pixel (Facebook/Instagram), Google Ads — Yes

You can change your cookie preferences at any time via the cookie settings at the bottom of the website, or via your browser settings. Please note that disabling certain cookies may limit the website's functionality.

Note — WhatsApp: communication via WhatsApp takes place outside our website and is not governed by cookies. It falls under WhatsApp/Meta's own privacy policy, in combination with section 2.4 of this document.

7. Your rights

Under the GDPR you have the following rights regarding your personal data:

Right of access — you can ask which data we process about you

Right to rectification — you can have incorrect data corrected

Right to erasure ("right to be forgotten") — within legal limits

Right to restriction of processing

Right to data portability

Right to object — in particular to direct marketing and profiling

Right to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal

To exercise these rights, you can contact us at privacy@gravagroup.be. We respond within the legal period of one month.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (DPA): Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be

8. Security of your data

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure or alteration.

9. Minors

Our website and services are not aimed at persons under 16. We do not knowingly collect data from minors without the consent of a parent or guardian.

10. Changes to this privacy policy

We may update this privacy policy from time to time. The most recent version is always available on this page, with the date of the last update.

11. Contact

For questions about this privacy policy or the processing of your data:

Grava Group

Sneeuwbeslaan 14, 2610 Antwerp, Belgium

Email: privacy@gravagroup.be