Privacy Policy - Brussels Headshots
1. Introduction
Your trust matters.
This privacy policy explains how your personal data is collected, used, and protected when you visit my websites or contact me.
I comply with the General Data Protection Regulation (GDPR – EU 2016/679) and Belgian privacy laws.
2. Data controller
Lillo Mendola – Lilutch
Rue des Liégeois 11, 1050 Brussels, Belgium
Company number: BE 0799 580 007
📞 +32 473 46 37 09
3. Websites covered
This policy applies to:
- https://www.brusselsheadshots.eu (hosted on Odoo)
- https://www.lilutch.com (hosted on Squarespace)
Forms on Lilutch.com are technically embedded from Odoo (BrusselsHeadshots.eu).
Therefore, all collected data is securely stored and processed within the same Odoo CRM system.
4. Data collected
When you submit a form, the following information may be collected:
- First and last name
- Email address
- Phone number
- Your message or enquiry
No sensitive data (e.g. health, political views, etc.) is collected.
5. Purpose of processing
Your data is used solely to:
- respond to your messages and enquiries;
- prepare quotes or schedule a photo session;
- manage administrative and contractual follow-up;
- (in the future) send occasional updates or newsletters, if you choose to receive them.
👉 Your data is never sold, rented, or shared with third parties.
6. Legal basis
Data processing is based on:
- your consent (form submission or cookie acceptance);
- pre-contractual or contractual necessity (quotes, bookings);
- legitimate interest (website improvement and secure functioning).
7. Data retention
Personal data collected via contact forms is stored for up to five (5) years, unless:
- you request deletion sooner, or
- legal obligations require longer retention (e.g. invoices).
After that period, data is deleted or anonymised.
8. Data sharing and storage
All data is securely processed within Odoo CRM, hosted in the EU and compliant with GDPR.
Access is restricted to Lillo Mendola and, if necessary, technical partners bound by confidentiality agreements (e.g. hosting or IT support).
Data is not transferred outside the European Union.
9. Your rights
Under GDPR, you have the right to:
- Access your personal data;
- Rectify inaccurate or incomplete data;
- Erase your data (“right to be forgotten”);
- Restrict or object to processing;
- Portability of your data in a structured format.
To exercise your rights, contact:
You will receive a reply within 30 days.
10. Data security
Appropriate technical and organisational measures are implemented to protect your data from unauthorised access, alteration, loss, or disclosure.
Both Odoo and Squarespace use encrypted (HTTPS) connections and secure servers.
11. Cookies and similar technologies
For details on how cookies are used, please see our dedicated page:
12. Complaints
If you believe your data is being processed unlawfully, please contact:
You may also file a complaint with the Belgian Data Protection Authority (APD/GBA):
Rue de la Presse 35, 1000 Brussels
📞 +32 2 274 48 00
13. Policy updates
This policy may be updated at any time.
The latest version is always available on this page.
Last updated: October 2025.