Legal
Privacy Policy
Last updated: 15 October 2026
This policy explains what personal data McKay Consulting collects, why, how it is stored and protected, who it is shared with, and the rights you have under the EU General Data Protection Regulation (GDPR) and Belgian data protection law. We keep it short and specific: this website does not use cookies, analytics or advertising trackers, and we only collect what you choose to send us.
01Who we are
The data controller responsible for your personal data is Keith McKay, trading as McKay Consulting, a sole proprietorship registered in Belgium.
- Address: Gordaallaan 4, 3080 Tervuren, Belgium
- Enterprise / VAT number: BE 1042.570.846
- Email: keith@mckayconsulting.be
We are a small business and are not required to appoint a Data Protection Officer. For any privacy question or request, write to the email address above and Keith will deal with it personally.
02What we collect
Information you give us
- Enquiry form: your name, email address, company (optional) and the message you write.
- Email and calls: your contact details and anything you choose to include when you contact us directly.
- Clients and prospective clients: contact and role details of the people we work with, meeting notes, proposals, engagement letters, and invoicing details such as company name, address and VAT number.
- Suppliers and partners: business contact details and the information needed to work together and pay or be paid.
Please don’t send special-category data (for example health information) through the enquiry form. We don’t need it to respond.
Information collected automatically
- Server logs: our hosting provider, Netlify, records standard technical data when you load the site, such as IP address, browser type, the page requested and the time. This is used to deliver and secure the site.
- Web fonts: the site loads its typefaces from Google Fonts, which means your browser connects to Google’s servers and shares your IP address and browser details with Google so the fonts can be delivered.
We do not use analytics tools, tracking pixels, advertising networks or social-media plug-ins, and we do not build profiles of visitors.
03How we use it, and why
The GDPR requires a legal basis for each use of personal data. Ours are set out below.
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your enquiry and discussing a possible engagement | Enquiry form and email details | Steps taken at your request before entering a contract (Art. 6(1)(b)); otherwise our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Delivering our services and managing the client relationship | Client contact and engagement data | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, bookkeeping and tax compliance | Invoicing and transaction details | Legal obligation under Belgian accounting and tax law (Art. 6(1)(c)) |
| Running and securing the website, and filtering spam | Server logs, form submissions | Legitimate interest in a secure, working website (Art. 6(1)(f)) |
| Displaying the site’s typefaces | IP address and browser details sent to Google Fonts | Legitimate interest in a consistently presented website (Art. 6(1)(f)) |
| Establishing or defending legal claims | Relevant records | Legitimate interest (Art. 6(1)(f)) |
We do not sell your data, use it for automated decision-making or profiling, or send you marketing emails unless you have asked to receive them. If you ever do sign up for updates, you can unsubscribe at any time.
04Who we share it with
We share personal data only where needed, and only with:
- Netlify, Inc., which hosts this website and receives enquiry form submissions on our behalf. Netlify uses Akismet (Automattic) to filter spam from form submissions.
- Google, which delivers the web fonts used on this site (see section 2).
- Our email, cloud storage and office software providers, which store our correspondence and working files.
- Yolande Visser, our transformation and systems partner, where your enquiry or engagement involves that work. She is bound by the same confidentiality obligations as we are.
- Our accountant, bank, insurers and professional advisers, where needed to run the business.
- Public authorities, such as the Belgian tax administration, where the law requires it.
Service providers act on our instructions under data processing terms that require them to protect your data and use it only for the service they provide to us.
05Transfers outside the EU
Some of our providers, including Netlify and Google, are based in the United States, so your data may be processed there. Where that happens we rely on the provider’s certification under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing adequate protection, or on the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards.
06Storage and security
Personal data is stored in the systems of the providers listed above and on password-protected business devices. We protect it by:
- serving the website only over an encrypted (HTTPS) connection;
- using strong, unique passwords and two-factor authentication on our business accounts;
- limiting access to Keith McKay and, where relevant to an engagement, our named partner;
- moving enquiries out of the website form inbox once handled, so they are not kept in more places than necessary;
- keeping devices encrypted, locked and up to date.
No system is perfectly secure. If a data breach occurs that is likely to put your rights at risk, we will notify the Belgian Data Protection Authority and, where required, you.
07How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not lead to an engagement | Up to 2 years after our last contact, then deleted |
| Client correspondence and engagement files | For the engagement, then up to 5 years after it ends, to deal with questions or claims |
| Invoices and accounting records | 10 years, as required by Belgian accounting and tax law |
| Website server logs | As set by our hosting provider, typically a short rolling period |
When a retention period ends, we delete the data or anonymise it so it can no longer identify you.
08Cookies
This website does not set cookies and does not use analytics or advertising trackers, so no cookie banner is needed. If that changes, we will update this policy and ask for your consent before setting any non-essential cookies.
09Data we handle for clients
When we provide bookkeeping, financial management or CFO services, we may handle personal data that belongs to our clients, such as employee, customer or supplier records in their accounts. In that work we act as a processor on the client’s behalf, and the client remains the controller. The terms for that processing are set out in our engagement letter or a separate data processing agreement, not in this policy. If your data is held by one of our clients, please contact that business first.
10Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase your data, where we no longer have a reason to keep it;
- restrict how we use your data in certain circumstances;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- data portability, receiving data you gave us in a structured, machine-readable format;
- withdraw consent at any time, where we rely on it, without affecting earlier processing.
To exercise any of these rights, email keith@mckayconsulting.be. We will reply within one month, and may ask you to confirm your identity first. Exercising your rights is free of charge.
11Complaints
If you have a concern, please contact us first and we will try to resolve it. You also have the right to lodge a complaint with the Belgian supervisory authority:
- Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données)
- Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels
- www.dataprotectionauthority.be
If you live in another EU country, you may also complain to the authority there.
12Changes to this policy
We may update this policy when our services, providers or the law change. The date at the top shows when it was last revised. If a change significantly affects how we use your data, we will let affected clients know directly.