Legal notice

Last updated: 20 October 2026

This legal notice applies to the coty.agency website and, in the sections that concern it, to the Orbit application available at orbit.coty.agency. It is published in accordance with Articles III.74 and XII.6 of the Belgian Code of Economic Law and with Regulation (EU) 2016/679 on data protection (the “GDPR”).

1. Website publisher

  • Name: COTY Agency, trade name of Cédric Sterken
  • Legal form: sole proprietorship (natural person) under Belgian law
  • Registered address: Rue des Glaïeuls 37 boîte 22, 1180 Uccle, Belgium
  • Company number (Crossroads Bank for Enterprises): 1019.695.177
  • VAT number: BE 1019.695.177
  • VAT status: VAT-registered under the special VAT exemption scheme for small enterprises (Article 56bis of the Belgian VAT Code) — no VAT is charged
  • Activities: computer programming, other IT services, web search portals
  • Email: contact@coty.agency
  • Publication director: Cédric Sterken

2. Hosting

coty.agency website

OVH SAS, 2 rue Kellermann, 59100 Roubaix, France — RCS Lille Métropole 424 761 419.

Orbit application (orbit.coty.agency)

  • Application server: Contabo GmbH, Welfenstrasse 22, 81541 Munich, Germany (Amtsgericht München, HRB 180722).
  • Database and authentication: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Data is hosted in the European Union, in Frankfurt (Germany), on Amazon Web Services infrastructure (eu-central-1 region).

3. Intellectual property

All elements of the website (texts, structure, graphics, logos, images, videos and source code) are the property of Cédric Sterken (COTY Agency) or are used with the permission of their owners. They are protected by copyright and, where applicable, by trademark law (Book XI of the Belgian Code of Economic Law).

Any reproduction, representation, adaptation or extraction of these elements, in whole or in part, without prior written permission is prohibited, subject to the exceptions provided by law (in particular short quotations with the source indicated).

Third-party names and trademarks mentioned on the website belong to their respective owners and are cited for information only. The website may contain links to third-party websites whose content COTY Agency does not control and for which it accepts no liability.

4. Personal data

This section describes how COTY Agency processes personal data, in accordance with the GDPR and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. It distinguishes between the coty.agency website and the Orbit application, because COTY Agency's role differs in each case.

4.1 coty.agency website — COTY Agency as controller

Controller: COTY Agency (Cédric Sterken), contact details in section 1. Contact for any data protection question: contact@coty.agency.

  • Data collected through the contact form: name, email address, company (optional), selected subject and message content.
  • Use: the message is forwarded by email to contact@coty.agency so that we can reply; it may then be recorded in our sales follow-up tool to keep track of the conversation. Your data is never sold, rented or transferred to third parties.
  • Purpose: replying to your request and, where relevant, preparing a proposal or a project.
  • Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); failing that, COTY Agency's legitimate interest in replying to messages sent to it (Article 6(1)(f)).
  • Retention period: 3 years from the last contact. If the conversation leads to a contract, the data is kept for the duration of the contractual relationship and then for the applicable statutory periods.
  • Recipients: Cédric Sterken (COTY Agency) only, and the technical providers strictly necessary for the service: OVH SAS (website hosting and email) and, only if you have accepted it, Google (reCAPTCHA spam check, see section 5).
  • Spam protection: the form uses a hidden field designed to detect bots (legal basis: COTY Agency's legitimate interest in protecting its form against abuse, Article 6(1)(f)) and, only if you accept it, the Google reCAPTCHA v3 service (legal basis: your consent, Article 6(1)(a) GDPR, see section 5).
  • Technical logs: like any web server, the host records technical connection data (IP address, date, requested page) to ensure the security and proper operation of the website. These logs are kept for a limited period.

4.2 Orbit application

Orbit is a prospecting and customer relationship management software offered to businesses on a subscription basis.

a) Prospect and contact data — COTY Agency as processor. For data about prospects, contacts and customers that users import, enter or collect in Orbit, the customer company is the controller and COTY Agency acts as a processor within the meaning of Article 28 GDPR. COTY Agency processes this data only on the customer's documented instructions and solely to provide the service, under a data processing agreement concluded with each customer. The customer is responsible for determining the legal basis of its processing and for informing data subjects, in particular where the data was not obtained from them (Article 14 GDPR). If your data is held in Orbit on behalf of a customer company, please send your requests to that company; if COTY Agency receives such a request, it forwards it to the customer and assists it in responding.

End of contract. In accordance with Article 28(3)(g) GDPR, when the subscription ends, COTY Agency returns to the customer, at its request, the data processed on its behalf (export in a common format, to be requested within 30 days), then deletes that data and its copies no later than 60 days after the end of the subscription, unless a legal retention obligation applies. Backup copies are erased no later than at the end of their rotation cycle; until then, they are used only for disaster recovery.

b) User accounts — COTY Agency as controller.

  • Data: name, business email address, organisation and role, authentication and two-factor authentication data (passwords are never stored in plain text), the user's email settings (encrypted credentials or sign-in authorisations), technical connection logs, billing data.
  • Purposes: providing the service, managing account access and security, providing support, invoicing the subscription.
  • Legal bases: performance of the contract (Article 6(1)(b) GDPR), legitimate interest in securing the service (Article 6(1)(f)), statutory accounting and tax obligations (Article 6(1)(c)).
  • Retention period: for the duration of the subscription. When it ends, access to the service is closed and the customer has 30 days to request an export of its data; user accounts and associated data are then deleted within 30 days, i.e. no later than 60 days after the end of the subscription (earlier deletion can be requested). Backup copies are erased no later than at the end of their rotation cycle. Technical connection and security logs are kept for a maximum of 12 months. Invoices and accounting records are kept for the Belgian statutory periods, i.e. up to 10 years (in particular Article 60 of the Belgian VAT Code).

Security. Orbit applies appropriate technical and organisational measures, including encrypted connections (HTTPS), two-factor authentication, data segregation by organisation and encryption of stored email credentials.

4.3 Orbit sub-processors

To provide Orbit, COTY Agency uses the following providers:

  • Contabo GmbH (Germany) — hosting of the application servers.
  • Supabase Pte. Ltd. (Singapore) — database and authentication; data hosted in the European Union, in Frankfurt (Germany). Any access by the provider from outside the European Union is covered by the European Commission's standard contractual clauses.
  • OVH SAS (France) — domain name and email (service and authentication emails).
  • Brevo (France) — relay for sending follow-up emails.
  • Apify (Czech Republic) — collection, at users' request, of publicly available business data for prospecting.
  • Anthropic (United States) — AI-assisted qualification of prospect records. This transfer outside the European Union is covered by the European Commission's standard contractual clauses.
  • Microsoft and Google — only when a user chooses to connect their own Outlook / Microsoft 365 or Gmail mailbox to send their emails from Orbit.

The up-to-date list of sub-processors is appended to the data processing agreement and provided on request. Customers are informed of any intended change.

4.4 Your rights

Under Articles 15 to 21 GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing. Where processing is based on your consent, you may withdraw it at any time.

To exercise these rights, write to contact@coty.agency. You will receive a reply within one month. If there is reasonable doubt about your identity, additional information may be requested.

You may also lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données): Rue de la Presse 35, 1000 Brussels, Belgium — phone +32 (0)2 274 48 00 — contact@apd-gba.be — www.dataprotectionauthority.be.

5. Cookies and trackers

coty.agency website

The website uses no audience measurement or advertising cookies and no visitor tracking tools. Fonts are hosted on the website itself (no calls to Google Fonts); like the other website resources, loading them does not send your IP address to any third party.

Only the Contact page can load the Google reCAPTCHA v3 service, which protects the form against automated submissions, and only after your explicit consent (checkbox above the send button). Without this consent, no Google script is loaded and the form cannot be sent; you can then email us directly at contact@coty.agency. Once loaded, this service may read or set cookies and collects technical information (including the IP address and interaction data with the page) in order to tell human visitors from bots. This data may be transferred to Google LLC and processed in the United States; Google LLC is certified under the EU–US Data Privacy Framework. More information: Google Privacy Policy.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 10/2 of the Belgian Act of 13 June 2005 on electronic communications, which transposes the ePrivacy Directive). Your choice is stored in your browser's local storage, without being sent to any server, so that you are not asked again on every visit. You can withdraw your consent at any time, without affecting the lawfulness of prior use: untick the box on the Contact page or use the button below. Cookies already set by Google can be deleted from your browser settings.

Orbit application

Orbit uses the browser's local storage solely for its operation: keeping the login session, display preferences and language. On the first visit, a tiered consent window lets you accept or refuse non-essential elements, such as loading third-party content. Orbit uses no advertising cookies. You can delete this data at any time from your browser settings.

6. Orbit terms of use

The general terms of use and sale of Orbit are provided to each customer before subscription and are available on request at contact@coty.agency.

7. Updates

Last updated: 20 October 2026. COTY Agency may amend this notice to reflect legal or technical changes; the version in force is the one published on this page.

This notice is governed by Belgian law. It is available in French, English and Spanish; in the event of any discrepancy, the French version prevails.