Privacy Policy
Last updated: 21 June 2026
The Indigo Elephant ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, and how we handle it.
Who we are
The Indigo Elephant (currently being incorporated)
Provisional address:
Gouden Boomstraat 20
8000 Brugge
Belgium
Contact: welcome@the-indigo-elephant.com
We act as the data controller for the personal data described in this policy.
Once incorporation is complete, this policy will be updated with our formal company name, registered office, and KBO/BCE and VAT numbers.
What data we collect, and why
We collect personal data only when you choose to share it with us.
When you contact us, we collect your name, email address, organisation, role, and any context you choose to share. We use this data to respond to your enquiry. This information is processed through our customer relationship and email platform, ActiveCampaign, which acts as our processor under a data processing agreement.
When you request a sample Undercurrent Report, we collect your name, email address, organisation and role. We use these details to send you the sample, and to recognise you if you contact us further.
When you choose to receive updates from us, we use your email address to send occasional insights, publications and event invitations. You can unsubscribe at any time via the link included in every email.
When we meet with you, we may collect notes and reflections from our conversations, as part of our advisory work. These are kept securely within our systems and used only to support our work together.
When you visit our website, our hosting provider may process basic technical information (such as IP addresses) for security and operational purposes. We do not currently use website analytics.
Legal basis for processing
We process your data on the following bases under the General Data Protection Regulation (GDPR):
Pre-contractual measures or performance of a contract — when responding to your enquiry or delivering materials or services you have requested.
Legitimate interest — for the secure operation of our website and to understand how it is used.
Consent — where you have explicitly agreed, such as receiving occasional updates from us.
How we share your data
We do not sell your data. We share it only with:
Service providers who help us operate, each bound by appropriate data processing agreements:
- Lovable — our website platform
- Storyblok — our content management system
- ActiveCampaign — our email and customer relationship platform
- Google Workspace — our internal email and document infrastructure
- Zoom — our meeting platform for client and prospect conversations
Authorities, where legally required.
Meetings and conversations
We use Zoom to host calls with clients and prospects. Zoom processes the audio and video of our conversations to enable the call itself, and does not retain meeting content unless we choose to record.
Recording, only on request
We do not record meetings by default. When a client or prospect finds it valuable to have a recording or transcript of our conversation — for their own notes, for their team, or for continuity — we use Fathom Video for that purpose. Recording starts only after explicit consent at the beginning of the call. The resulting recording and transcript are shared with the client and retained only as long as we agree together.
International data transfers
Some of our service providers process data outside the European Economic Area: ActiveCampaign, Google Workspace, Zoom and Fathom Video each operate from the United States. These transfers are covered by the EU-U.S. Data Privacy Framework, under which each of these providers is certified, providing an adequate level of data protection as recognised by the European Commission. Where required, we also rely on Standard Contractual Clauses approved by the European Commission to safeguard transfers.
Our content management system, Storyblok, is hosted within the European Union.
How long we keep your data
We keep your data only as long as needed for the purpose for which it was collected, and for any legal retention periods that apply.
Enquiry and service data — kept for the duration of our working relationship and for a reasonable period afterwards, to maintain continuity of advice and care.
Sample report requests and marketing data — kept until you unsubscribe, or until we have not heard from you for 24 months, whichever comes first.
Meeting recordings and transcripts — kept only as we agree with you at the time of recording, and shared with you.
Website data — basic hosting logs are kept for a short period for security purposes; no website analytics are currently collected.
Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data deleted
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with a supervisory authority
The competent authority in Belgium is the Gegevensbeschermingsautoriteit / Autorité de protection des données (www.gegevensbeschermingsautoriteit.be).
To exercise any of these rights, contact us at welcome@the-indigo-elephant.com. We will respond within one month.
Security
We take appropriate technical and organisational measures to protect your data. No system can be guaranteed entirely secure, but we work with providers who maintain industry-standard protections.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top reflects the most recent change.
