Privacy notice
- Effective
- Version
- 1.1
- Last updated
Contents
This notice explains how personal data is handled when you visit this website or contact us through it. It covers this website only, not the services we provide to clients.
Our company is established in Belgium, so the EU General Data Protection Regulation (GDPR) governs this processing. Where India’s Digital Personal Data Protection Act, 2023 (DPDP Act) also applies to it, this notice gives the information that Act requires. If anything is unclear, ask us using the contact details in section 1.
Who is responsible
The controller of the personal data described in this notice is LAAP Group, with its registered office at Opgeëistenlaan 2, 9000 Gent, Belgium, and enterprise number 0440.481.750. FromNine is part of LAAP Group. The DPDP Act uses the term Data Fiduciary for the party that decides why and how personal data is processed, and Data Principal for the person the data relates to.
For any question or request about your personal data, including a grievance, write to contact@fromnine.com. This address reaches the people who can answer questions about how we process personal data. Mentioning “privacy” in the subject line helps us pass your message to the right person quickly.
- Company name
- LAAP Group
- Registered office
- Opgeëistenlaan 2, 9000 Gent
- contact@fromnine.com
What we process, why, and on what basis
We process personal data in three situations. For each, we list the data, the purpose, the legal basis under the GDPR and how long we keep it.
This itemised description also gives the information that section 5 of the DPDP Act and rule 3 of the Digital Personal Data Protection Rules, 2025 (DPDP Rules) require in a notice, where that Act applies. Those notice rules apply from May 2027.
When you visit the website
To deliver pages and keep the website secure, our hosting provider processes technical data each time your browser requests a page: IP address, date and time, the requested address, browser and operating system details, the referring page and the response status.
Purpose: delivering the website, detecting and preventing abuse, and fixing faults. Legal basis: our legitimate interest in operating a secure, working website (Article 6(1)(f) GDPR). Retention: server logs are deleted after no more than 30 days, unless they are needed to investigate a specific security incident.
We do not use analytics, advertising or social media tracking on this website. If that changes, we will update this notice first and ask for your consent where the law requires it.
When you contact us
If you use the contact form, we process your name, your email address, your organisation if you give it, the topic you choose, your message and the language version of the website you used.
Purpose: answering your enquiry and, if you wish, continuing the conversation about a project. Legal basis: steps taken at your request before a possible contract (Article 6(1)(b) GDPR), and otherwise our legitimate interest in replying to messages sent to us (Article 6(1)(f) GDPR). Retention: we delete enquiries 12 months after our last contact with you, unless they lead to a business relationship, in which case the retention rules of that relationship apply.
Your message is delivered to our team by email. The website does not store it in a database. Our operational logs record only a reference number and whether delivery succeeded, never your name, email address or message.
To protect the form against abuse, we use a hidden spam check and limit the number of messages per sender. For that limit, your IP address and email address are converted into one-way hashed values that are kept in memory for at most 24 hours and then discarded.
Preferences stored in your browser
The website remembers your choice of theme and your animation setting in your browser, and your language and region if you use the switcher. The theme and animation choices stay on your device. The details are in the cookie policy.
Who receives your data
We share personal data only with service providers that process it on our behalf and under our instructions, bound by a data processing agreement: our hosting provider, which delivers the website and keeps the server logs; our email delivery provider, which delivers contact form messages to our team; and our email and collaboration platform, where our team reads and answers your message.
Within FromNine, an enquiry may be passed to the colleagues or the office best placed to answer it, based on our legitimate interest in handling your request properly. FromNine has offices in Antwerp, Ghent, Amsterdam and Cyberjaya (Malaysia); the next section explains how access from outside the European Economic Area is safeguarded.
We do not sell personal data and do not share it for advertising.
Transfers outside the European Economic Area and outside India
We aim to process personal data within the European Economic Area (EEA). FromNine also has an office in Cyberjaya, Malaysia, which is outside the EEA. Where colleagues there, or a service provider outside the EEA, have access to personal data, we make sure that this access is covered by appropriate safeguards under Article 46 GDPR, in particular the Standard Contractual Clauses adopted by the European Commission, with additional measures where needed. Where the European Commission has adopted an adequacy decision for the country concerned, we may rely on that decision instead.
If you are in India, sending us a message means that your personal data is processed outside India, in the places described above. Under section 16(1) of the DPDP Act, the Central Government may restrict the transfer of personal data to a country or territory outside India by notification, and under section 16(2) a law in India that provides a higher degree of protection or restriction prevails. From May 2027, rule 15 of the DPDP Rules also makes transfers subject to any requirements the Central Government specifies by order for making personal data available to a foreign State or its agencies. We will follow any such notification or order that applies to our processing.
You can ask for a copy of the relevant safeguards by writing to contact@fromnine.com.
How we protect your data
FromNine operates an information security management system certified to ISO/IEC 27001. Access to enquiries is limited to the people who need it to answer you, and data is encrypted in transit between your browser, our website and our mail systems.
If a personal data breach occurs, we follow the GDPR, including notification of the supervisory authority and, where required, of the people affected. Where the DPDP Act applies, we will also inform the affected individuals and the Data Protection Board of India without delay and give the Board a detailed report within 72 hours, as rule 7 of the DPDP Rules requires from May 2027.
Your rights
You can ask us for access to your personal data and for its rectification or erasure, or ask us to restrict its processing. You can object to processing that is based on our legitimate interests, and you have the right to data portability where processing is based on steps towards a contract. These rights are set out in Articles 15 to 21 of the GDPR.
If you are in India and the DPDP Act applies, you also have the rights it gives a Data Principal: to obtain information about your personal data, to have it corrected, completed, updated or erased, to have your grievances redressed and to nominate another person to exercise your rights. Where processing is based on your consent, you can withdraw it as easily as you gave it, by writing to the same address.
To use a right, write to contact@fromnine.com. We reply within one month, wherever you live. For complex requests this can be extended by two further months; we will tell you if that happens and why. Grievances under the DPDP Act are answered within ninety days at the latest, including any extension, which is the maximum period rule 14 of the DPDP Rules allows from May 2027. We may ask you to confirm your identity first.
We do not use automated decision-making or profiling that produces legal or similarly significant effects for you.
Changes to this notice
We update this notice when our processing changes, and when Indian rules that apply to it come into force. The version and dates at the top of the page show which version you are reading. We announce significant changes on this page.
Questions about this page?Contact us