Privacy policy

What personal data we collect, why, and how to see or delete it.

Last updated 5 October 2026 Version 1.1

Who is responsible

Neuval SRL, the Brussels company behind HOVR Studios, decides what happens to your data.

Neuval SRL is the controller of the personal data described here, under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Belgian Law of 30 July 2018 on data protection.

Controller: Neuval SRL, trading as HOVR Studios
Registered office: Chaussée de Charleroi 49/5, 1060 Saint-Gilles (Brussels), Belgium
Privacy contact: info@hovrstudios.com
Data protection officer: None appointed (we don't need one). Privacy questions go to the address above.

What we collect, why, and for how long

Only what you send us and what a shoot or the website needs. Nothing is sold or used for ads.

What	Why	Legal basis	How long
Project enquiries from the brief form: your name, email, the service and budget band you pick, your message. If you add them: company, phone, date, location, references and the estimate from our pricing page. With it: the page you sent it from, the language, and how long the form was open (a spam check).	To answer you and prepare a quote.	Steps you ask for before a contract (GDPR art. 6(1)(b)). The spam check: our legitimate interest in a form robots can't flood (art. 6(1)(f)).	24 months after our last exchange, unless it becomes a project (see Clients).
Emails and messages you send us, and your address.	To reply and keep track of the conversation.	Steps before a contract (art. 6(1)(b)), or our legitimate interest in answering questions (art. 6(1)(f)).	24 months after our last exchange.
Clients: contact details, quotes, contracts, invoices and project correspondence.	To deliver the project, invoice it and meet our accounting duties.	The contract (art. 6(1)(b)) and our legal obligations (art. 6(1)(c)).	For the period Belgian accounting and tax law requires.
People we film: the image and voice of anyone recognisable in the footage, and their signed release.	To make the film our client ordered and use it as the release allows.	Your consent, given in the release, for anyone featured. For people only passing through a shot: our client's and our legitimate interest, with blurring or removal on request.	Raw footage: 12 months after delivery. Delivered films: as long as they are in use, by you or, with your permission, in our portfolio.
Visit counts: daily totals of page views and a few actions, with no identifier of any kind. The full list is under Cookieless statistics.	To know which pages help people and which don't.	Our legitimate interest in running a useful website (art. 6(1)(f)). The counts themselves aren't personal data.	Daily totals, kept as statistics.
Analytics, only if you accept it: the identifiers Google's cookies hold, the pages you view, the films you open, your device and browser type, an approximate location and your IP address, which any request to Google carries.	To see which pages and films people watch.	Your consent (art. 6(1)(a)), which you can withdraw at any time.	14 months, the retention set in our Google Analytics property.
Server logs: your IP address, browser details and the address requested, recorded by our hosting provider when your browser asks for a page.	To deliver the site and protect it from abuse.	Our legitimate interest in a working, secure website (art. 6(1)(f)).	Kept by Google: according to Firebase, Hosting keeps IP data for a few months.
Our team's sign-in to the admin: email address, plus sign-in logs.	To let only our team read enquiries and edit the site.	Our legitimate interest in securing the admin (art. 6(1)(f)).	While the person is on the team. According to Firebase, sign-in IP logs are kept for a few weeks.

To answer an enquiry we need your name, an email address and a rough idea of the project. Everything else is optional. If you'd rather not use the form, email us. We make no automated decisions about you and build no profiles.

If you message us on Instagram, TikTok or YouTube, that platform handles your data under its own policy. We use what you send only to reply.

Who processes it for us

Google runs our hosting and database. The database sits in the European Union (Belgium).

Google (Firebase): Hosting, our database (Cloud Firestore) and the admin sign-in (Firebase Authentication).
Google (Analytics 4): Counts visits and the films people watch, only if you accept analytics cookies. Google receives the data those cookies send.
Email: Hostinger, our mailbox provider (the domain's email is hosted there).
Advisers: Our accountant, lawyer or insurer, only when a matter needs them.

They process data on our instructions, under data processing terms. We never sell or rent personal data, and we don't share it for advertising.

Our database (Cloud Firestore) is stored in Google's europe-west1 region, in Belgium. Google LLC, which provides Firebase, is certified under the EU–US Data Privacy Framework, which the European Commission recognises as giving adequate protection, for any access from outside the EU. Firebase also offers the European Commission's standard contractual clauses for transfers the framework doesn't cover.

How Google uses data from sites that use its services

Cookieless statistics

We count visits as daily totals, with no cookies or identifiers. If your browser asks not to be counted, we don't count you.

When a page loads, your browser sends one small request that adds 1 to that day's totals: views per page, a referrer category (for example "search" or "social"), a device class and, for the first page of a visit, a landing. When you leave, it can add how fast the page felt (good, needs improvement or poor), once per page. A few actions are counted the same way, as daily totals: opening a film (each film has its own total), clicking a link to our contact page, Instagram or neuval.be, starting or sending the brief form, and finishing a price estimate. When a page is not found, the address that was asked for, without anything after a question mark, is counted too, so we can fix broken links. Nothing in it identifies you: no cookie, no ID, no timestamp beyond the day, no address of the page you came from, no browser details.

Like any request on the internet, it reaches Google's servers with your IP address. We don't receive or store that address. We don't count at all when your browser sends Global Privacy Control or Do Not Track, in our admin, or in automated test browsers.

When the cookie banner is shown, the choice you make (accept all, reject all or your own selection) is counted the same way, as one more daily total with no cookie and no identifier. If your browser sends Global Privacy Control or Do Not Track, nothing is counted, your choice included.

The "Run a live test" button on our colophon asks Google's PageSpeed Insights to measure this site. It only runs when you press it.

Cookie policy

Analytics, only with your consent

Google Analytics 4 runs only if you accept it. Nothing is sent to Google before you do.

If you accept analytics cookies, Google Analytics 4 collects data about your visit and Google processes it for us: the pages you view, the films you open, your device and browser type, an approximate location and your IP address. It lets us see which films people watch.

We ask first, rejecting is as easy as accepting, and the analytics tag does not load until you accept. If your browser sends Global Privacy Control or Do Not Track, we treat that as a rejection. You can change your choice at any time.

How we keep it safe

Anyone can send us an enquiry. Only our team can read it.

The site is served over HTTPS only.
Our database rules let the public create an enquiry, never read, change or delete one.
The admin needs a sign-in with an invited, verified email address.
The public pages load no third-party scripts, except Google Analytics, and only after you accept it.

No system is perfect. If a breach puts your rights at risk, we'll tell you and the Data Protection Authority, as the GDPR requires.

Your rights

See, correct, delete, export or stop what we do with your data. One email is enough.

Access: get a copy of the data we hold about you.
Rectification: have it corrected.
Erasure: have it deleted, unless the law makes us keep it.
Restriction: have us pause its use while a question is settled.
Objection: object to a use based on our legitimate interest.
Portability: receive what you gave us in a common, machine-readable format.
Withdrawal: withdraw a consent you gave, such as a release, for the future.

Write to us and say which right you want to use. We may ask you to prove who you are. We answer within one month.

info@hovrstudios.com

If you think we've got it wrong, you can complain to the Belgian Data Protection Authority. We'd like the chance to fix it first, but you don't have to ask us.

Authority: Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit)
Address: Rue de la Presse 35, 1000 Brussels
Email: contact@apd-gba.be
Website: dataprotectionauthority.be

Changes to this policy

Each version is numbered and dated. We keep the old ones.

When the way we handle data changes, we update this policy with a new version number and date. If a change affects what you've already sent us, we'll tell you directly. Ask us for any earlier version.