Privacy policy

1. Who answers for your data

The controller, that is, the one who decides what is collected and why, is:

Alfin Vestors SRL Avenue Louis Lepoutre 48, box 4, 1050 Ixelles, Belgium Company number (BCE): 0772.847.696 VAT: BE 0772.847.696 Contact: contact@opulion.com

Opulion is an editorial activity of Alfin Vestors SRL. Quentin de Viron, manager, personally handles requests relating to your data.

We are not required to appoint a data protection officer: that obligation targets bodies which monitor individuals on a large scale or process sensitive data on a large scale, and we do neither. Any question is handled directly at the address above.

2. What we collect, and what we do not collect

What we collect

Your e-mail address, if you subscribe to the letter or open an account. You give it to us yourself.

The date and time of your choices. Subscription, confirmation, withdrawal. These are recorded for a precise reason: to be able to demonstrate, should the question ever arise, that you did consent, and when. The regulation requires us to be able to provide that proof.

Your IP address, but never in clear form. When you submit the subscription form, your IP address is read in memory, for the duration of the request, to prevent automated sign-ups and abuse. It is never stored in clear form. Only an irreversible cryptographic digest is kept, and it is deleted automatically after one hour. We do not know, and we cannot know, where you connected from.

Your account data, if you open an account. It is set out in point 3.

What we do not collect

We collect neither your assets, nor your horizon, nor your risk tolerance, nor the slightest information about your investments. We ask you no suitability question, because we do not advise you.

We count readings. We do not know who reads.

Since 21 August 2026, we have kept a counter. It records, day by day and page by page, a number of views, and the number of times a link to another site has been followed from our pages, reduced to the destination's domain name alone. That is all. It is already aggregated at the moment it is written, and it does not disaggregate.

There is no identifier in it: no visitor number, no session identifier, no browser fingerprint, no IP address, not even in hashed form. Nothing is written into your browser: neither cookie nor local storage. We therefore cannot know who read what, nor connect two visits to one another, nor reconstruct a journey. Nobody could, from these figures: there is no row that is you. Whether you have an account or not, the counter is the same: it does not know that you exist.

The site contains no third-party audience-measurement tool, no tracking pixel, no advertising tracker, no font loaded from a third-party server, no third-party script. The counting is done by our own server, it stays with us, nobody else sees it.

We build no profile. We take no automated decision concerning you. We do not sell, rent or exchange your data with anyone whatsoever. This is not a commercial promise: it is a consequence of what we collect, which is next to nothing.

3. Your reader account

Opening an account is optional. The site can be read in full without one.

There is no password. You enter through a link sent to your address, valid once. There is therefore no secret to remember, and no secret to steal from us.

Here is everything an account contains, without exception:

The second factor, if you turn it on. You may protect the entrance to your account with a code generated on your device. In that case, the key that allows your codes to be verified is kept by the provider that holds our account database, and it serves nothing else. This setting is optional: your account remains fully usable without it. You may remove it whenever you wish.

Signing in with a Google account. It is not open. Entry into your account is by a link sent to your address, and by that means alone. No data about you is therefore exchanged with Google. If we opened this way in one day, this page would change before, not after.

What you see of all this. A page in your space, "What we know about you", shows this inventory applied to your account, with your real values, and the means to correct or withdraw them.

4. Why we process this data

Three purposes, and nothing else:

1. To send you the Opulion letter, that is, our publications and our analyses.
2. To let you into your account and to write to you about it.
3. To protect our forms against automated sign-ups and abuse.

Your data is not used to send you advertising, nor to offer you the products or services of a third party. Nor is it used to tell you apart from other readers: the letter goes to everyone, and the published analyses are the same for all.

5. On what legal basis

Your consent, for the letter

We write to you because you asked us to, and for as long as you want us to (Article 6(1)(a) of the GDPR, which allows processing based on consent).

This consent is obtained by double confirmation. After entering your address, you receive an email containing a link. Until you have clicked that link, your subscription is not active and you receive nothing. This mechanism protects a person whose address may have been entered by a third party, by mistake or with malicious intent.

You may withdraw your consent at any time (Article 7(3), which guarantees that withdrawal is as easy as consent). An unsubscribe link appears in every email. Withdrawal takes effect without your having to justify it. It does not affect the lawfulness of the emails already sent.

Performance of what you ask us for, for the account

When you open an account, we process your address, your display name and your language because that is necessary to provide the service you ask us for (Article 6(1)(b)).

Our legitimate interest, for the rest

The irreversible digest of the IP address, the declared capacity, the founding rank, the technical dates and the internal code rest on our legitimate interest (Article 6(1)(f), which allows processing necessary for the controller's legitimate interests, where the rights of the individual do not override them). That interest is proportionate: none of this data allows you to be tracked, and the IP digest never exists in clear form and disappears in less than one hour.

You may object to processing based on this legitimate interest, by writing to us.

6. Cookies

The site sets a single cookie: `NEXT_LOCALE`. It remembers the language you have chosen, French or English, so as to serve you the site in that language.

This cookie is strictly functional. It is necessary to provide the service you have expressly requested, namely to read the site in the language you selected. As such, it is exempt from your prior consent: the Belgian Law of 30 July 2018, in its Article 10/2, second paragraph, exempts storage strictly necessary for a service expressly requested by the user.

This is why you will see no cookie-consent banner on this site: there is nothing to consent to. We have no trackers to ask you to accept.

This cookie has no expiry date: it disappears when you close your browser. You can also delete it at any time from your browser settings; the site will remain fully functional.

If you open an account, your browser also keeps a session cookie, for as long as you stay signed in. It serves nothing else, and it disappears when you sign out.

We do nonetheless measure our audience, and we owe you the explanation. Our counter writes nothing into your device and reads nothing from it: it adds up views on our server. Belgian law attaches consent to the act of writing or reading information in your equipment (Law of 30 July 2018, Article 10/2). We do neither, and that is why there is nothing for you to accept. Should we ever install a tool that does write to or read from your device, we would do so only after obtaining your consent, and this page would change beforehand, not afterwards.

7. Who processes your data on our behalf

We rely on technical providers, which act on our instructions alone and have no right to use your data for their own purposes.

8. What leaves the European Union

The database that holds your address is hosted in the European Union, in Frankfurt. That is a choice, not an accident.

A transfer outside the Union nonetheless occurs by reason of our host, Vercel Inc., established in the United States. It is framed in two ways:

• Vercel Inc. states that it comes under the data protection framework between the European Union and the United States, which the European Commission recognised as offering an adequate level of protection by a decision of 10 July 2023;
• Vercel Inc. also applies the standard contractual clauses adopted by the European Commission, which bind the recipient by contract.

No exchange takes place with Google. Entry into your account is by a link sent to your address, and by that means alone. If we one day opened entry through a Google account, this page would change before, not after.

Our other providers have their parent company in the United States. Remote access for technical-support purposes therefore cannot be ruled out; it is framed by the same contractual mechanisms.

You can obtain a copy of the applicable safeguards by writing to contact@opulion.com.

9. How long we keep all this

Data that no longer has a use must disappear. That is the principle, and here is how we apply it.

10. Unsubscribing is not being erased, and you are entitled to both

This is a distinction that many sites leave in the shadows. We prefer to state it.

• Unsubscribing means withdrawing your consent. We stop writing to you immediately. We then keep, for a limited time, the trace of your presence and of your withdrawal, for the purposes described in point 9.
• Requesting erasure means exercising a distinct right. We then delete your data.

The unsubscribe link in our emails unsubscribes you. It does not amount to a request for erasure. If you want every trace of your presence to disappear, write to us at contact@opulion.com requesting erasure: it is immediate, free, and we will not ask you why.

One honest point. If you request erasure including of the digest on our exclusion list, we delete that too, but we then lose the technical means of recognising you. Should your address be re-entered one day, by you or by a third party, nothing would allow us to prevent it. You choose: we apply.

11. Your rights

You have, over your data, the following rights:

• Access: to know whether we hold data concerning you, and to obtain a copy (Article 15).
• Rectification: to correct inaccurate data (Article 16).
• Erasure: to obtain the deletion of your data (Article 17).
• Restriction: to freeze the use of your data without erasing it (Article 18).
• Portability: to receive your data in a machine-readable format (Article 20).
• Objection: to object to processing based on our legitimate interest, and at any time to your data being used to write to you (Article 21).
• Withdrawal of consent: at any time, via the link in every email or by a simple email (Article 7(3)).

How to exercise them: write to contact@opulion.com. One sentence is enough. It is free of charge.

Our deadline: no later than one month from receipt of your request. If your request is complex, this period may be extended by two months; we would inform you of this, with the reasons, within the month.

We may ask you to confirm your request from the address concerned, so as not to disclose your data to someone else.

12. If you consider that we have acted wrongly

You have the right to lodge a complaint with the supervisory authority. In Belgium, this is:

Data Protection Authority (Autorité de protection des données) Rue de la Presse 35, 1000 Brussels, Belgium Telephone: +32 (0)2 274 48 00 E-mail: contact@apd-gba.be Website: www.autoriteprotectiondonnees.be

You may also refer the matter to the supervisory authority of your State of residence, as well as to the competent courts.

We would be grateful if you would write to us first: a mistake is corrected faster than it is litigated.

13. Security

Our measures are suited to what is really at stake, an e-mail address and a few preferences:

• all exchanges with the site are encrypted in transit;
• the database is hosted in the European Union, with restricted and authenticated access;
• there is no password to steal, and you may add a second factor;
• the IP address is never stored in clear form;
• no third-party script is loaded on the site, which removes an entire attack surface;
• no sensitive data is collected, and we want none of it.

14. If this page changes

If our processing changes, this page changes. The last-updated date, at the top, is authoritative. If the change concerns the purposes, the version of the policy changes too, and your earlier consents remain readable, dated with the former version. If the change is substantial, we inform subscribers by a dedicated email.