Legal
Privacy Policy
This site collects very little, and what it does collect is set out below: which form asks for what, where it goes, on what legal basis, and how long it stays. There is no analytics, no tracking and no advertising code in it. That isn't a promise for later — it's how the site is built.
Last updated: August 2026
Who processes your data
Work of Co is the controller: House of Co, registered at Bosdreef 9, 2390 Malle, Belgium, company number BE 0650.856.637. You'll find us at Lange van Sterbeeckstraat 27, 2060 Antwerp, Belgium. For anything privacy-related, write to info@workofco.com.
What this site doesn't do
No Google Analytics, no tag manager, no tracking pixels, no ad networks — none of it is in the code, not even switched off. Visits are counted, but that happens at Vercel and without cookies; how it works is set out further down. The site sets no cookies of its own. The fonts are bundled with the site rather than fetched from Google, and the map on the contact page is a plain image, not an embedded Google Map. That's also why there's no cookie banner: there is nothing to accept. It follows from how the site was built, not from forgetting.
Booking a trial day
For a trial day we ask for your name, email address and phone number. The number is required, because if something goes wrong at the door that morning, email is too slow. You then pick a date and an arrival time between 9:00 and 17:00, and you can add your company name and how you found us if you feel like it. A trial day is free, so no payment and no payment details are involved. We don't keep your booking in a database of our own, nor in your browser: your browser sends it straight to Web3Forms, which turns it into an email to Work of Co. Web3Forms does retain a submission on its own systems for up to three years. Legal basis: handling your request and the steps leading up to an agreement (Article 6(1)(b) GDPR). For the optional ‘how did you hear about us’ field it's our legitimate interest in knowing where people find us (Article 6(1)(f)) — feel free to leave it blank.
Buying a day pass
A day pass costs €25. For that we ask your name, email address, phone number, optionally your company name and VAT number, and the day you're coming. Those details go to Stripe: they travel along as metadata on the payment, and your email address is used to send you Stripe's receipt. We never see your card details — you type them into a window served by Stripe itself, and they go straight from you to Stripe without passing through our site. Legal basis: performance of the contract (Article 6(1)(b)), and for keeping the invoice data, our statutory bookkeeping obligation (Article 6(1)(c)).
The contact form
Name, email address, a subject and your message; a phone number if you want, but it's optional. This too goes straight from your browser to Web3Forms and reaches us as email. We use it to answer your question and for nothing else — you're not signing up for a newsletter. Legal basis: our legitimate interest in replying to people who write to us (Article 6(1)(f)), or preparing an agreement if that's what your question is about (Article 6(1)(b)).
Event tickets, and where they stay
For event tickets we ask each attendee's first name, last name and email address, plus a phone number for the buyer. We'd rather be straight about how that works today: those details are stored in your own browser's local storage, under the key woc.tickets.v1, together with the ticket code and — once you arrive — your check-in time. They never leave your device and we can't reach them, but nothing ever clears them either: they stay until you clear this site's data in your browser yourself. Paid tickets don't work at the moment; that part isn't connected yet. Once there's a real database behind it, we'll update this policy before it goes live.
Language preference
The language lives in the address: the English version sits on the bare path, the Dutch one on that same path with /nl in front. Nothing is stored in your browser for it and there is nothing to remember — switching language simply takes you to a different URL. Your choice used to be kept in local storage under the key workofco_lang; that no longer happens, and any old value still sitting there is ignored.
Cookies
The site sets no cookies of its own — there isn't a line of code anywhere that writes one. What does happen: the moment a payment reaches the payment step, Stripe's code loads and Stripe sets its own cookies, among other things to spot fraud. Nothing from Stripe is loaded before that step. So if you're browsing, booking a free trial day or sending us a message, no cookie is involved at all. Visitor counts are gathered without a cookie too, which is why this site never asks you to accept anything.
What our hosting records
The site runs on Vercel. Like any web server, Vercel keeps technical logs of incoming requests: your IP address, your user agent, the URL requested and the time. We don't use them to follow you around; they exist so the site works, so faults can be found and abuse kept out. Legal basis: our legitimate interest in a working, secure site (Article 6(1)(f)). How long those logs are kept is Vercel's setting: on the Pro plan runtime logs are kept for one day, or thirty days with Observability Plus enabled. Vercel also measures for us how many people visit the site and how quickly pages load. For each page view it records which page you opened, where you came from, which country, what kind of device and browser, and how long the page took to become usable. No cookie is involved and nothing is stored in your browser; to recognise a repeat view within a single day, Vercel derives a temporary hashed fingerprint that does not survive the day and cannot be traced back to you. So we see counts, not people, and we do not follow you to other websites. Legal basis: our legitimate interest in knowing what works on our own site (Article 6(1)(f)).
Who else sees your data
We sell nothing and share nothing for advertising. A few parties do help us run things and see data along the way. Web3Forms turns the trial-day and contact forms into email (Web3Forms, a product of Web3Creative, a registered business in Kerala, India, with servers in the United States). Stripe Payments Europe Ltd. in Dublin, Ireland handles payments. Vercel Inc. hosts the site and counts visitors there as well. The emails those forms produce then sit in our mailbox at Google Workspace. Web3Forms in turn uses sub-processors; two of them, CleanTalk and Akismet, see your IP address and email address in order to filter spam. Beyond that, we only hand anything over when the law obliges us to.
Outside the European Economic Area
Stripe handles European payments through its Irish entity, so within the EEA — with the caveat that Stripe operates globally and describes for itself when data travels further. Vercel is a US company: the site is served from European edge locations, but as a processor Vercel can reach data from the United States. For that transfer we rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), which form part of Vercel's data processing addendum. The same caveat applies to Web3Forms: the same Standard Contractual Clauses, incorporated into Web3Creative's data processing agreement.
How long we keep things
Honestly, most of this currently lives in a mailbox rather than in a system that tidies itself. So we're writing down what we hold on to, and we stick to it. Trial-day and contact emails: one year. Payment records and invoices for a day pass: as long as bookkeeping law requires, ten years in Belgium since assessment year 2023. Whatever Stripe keeps on its side follows Stripe's own retention periods. Ticket data in your browser sits on your device and stays there until you clear it. For server logs, see above.
How we protect it
Everything travels over an encrypted connection. Stripe's secret key lives on the server and never ends up in the code your browser downloads. The Web3Forms key does ship in that code, because their service only works that way; they publish it as a public key, and it grants nothing beyond the right to send us an email. When a submission fails, we write the technical error to our log but deliberately not your email address or your message. And the most sensitive thing that passes through here — your card details — never touches our systems at all.
What we don't do with your data
No profiles, no scoring, no automated decisions that affect you. No reselling, no renting out mailing lists. And we never ask about health, origin, beliefs or anything else in the special categories of Article 9 GDPR. If you do volunteer that kind of thing in the message field it will ride along in the email — so please don't.
Your rights
You have the right to see what we hold about you, to have it corrected if something is wrong, to have it erased, to have the processing restricted, to receive what you gave us in a portable form, and to object to processing that rests on a legitimate interest. Where we would ever rely on consent, you can withdraw it at any time without undoing what happened before. One email to info@workofco.com is enough. We answer within a month, and if it exceptionally takes longer, we'll say so within that month. We may ask you to prove who you are, but only when we genuinely can't tell.
Making a complaint
If you think we're getting it wrong, tell us first — that's the quicker route. Either way, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, gegevensbeschermingsautoriteit.be. If you live elsewhere in the EEA, you can also go to the supervisory authority there.
Building access
The locks are prepared for digital access through Tapkey (Austria), but that system is switched off today, so no access data is processed. If we do put it into use, it means a digital key per member and a log of door openings. We'll update this policy before that happens, and we'll tell members about it.
Changes
When the site changes, this text changes with it — certainly once there's a database or ticket sales behind it. The date at the top says when we last touched it.
Contact
Questions, a request, or plain curiosity about what we hold: info@workofco.com, or come by at Lange van Sterbeeckstraat 27, 2060 Antwerp.