Slim

Privacy Policy

This policy is a draft. It is not the final text until it has been reviewed by a legal agent (PLAN 4.12.f).

Last updated: October 19, 2026

This Privacy Policy serves as a notice of direct collection in accordance with Article 13 of the GDPR. Slim does not collect personal data indirectly from third parties (excluded under Article 14).

1. Data Controller (Art. 13 §1(a))

The data controller for this service is as follows.

Statement
Kim Wonmin
Company Number
1037.548.919
VAT number
BE 1037.548.919
Contact Email
contact@slim.lu

DPO (Article 13(1)(b)) This service is not subject to the obligation to appoint a DPO under GDPR Article 37 (small-scale sole proprietorship, no high-risk processing).

2. Purpose of Processing and Legal Basis (Art. 13 §1(c))

Processing the PA-01 Comparison Request

  • Purpose: To calculate and provide comparison results based on user input (household type, current provider, and usage).
  • Legal basis: GDPR Art. 6(1)(b) — Performance of a contract for the use of comparison services.
  • Data collected: household type, current provider ID, usage by category. No postal/ZIP code is collected. No IP or device information is collected.
  • An optional monthly bill amount you type on the results page is used only in your browser to estimate savings. It is not sent to or stored by Slim.

PA-02 Comparison Results: Permanent Preservation

  • Purpose: To provide a permanent link (/r/[shortId]) — so you can revisit the comparison results at any time.
  • Legal basis: GDPR Art. 6(1)(b) — Performance of a contract.

PA-03 Affiliate Click Attribution

  • Purpose: To record when a user has been redirected to a partner provider’s site after giving consent and to settle commissions.
  • Legal basis: Art. 6(1)(a) Consent (click history) + Art. 6(1)(c) Legal obligation (Belgian accounting retention requirements).

PA-04 Security Log

  • Purpose of processing: Detection of security incidents and monitoring of system anomalies.
  • Legal basis: Article 6(1)(f) (legitimate interests) — secure operation of the service.

Sending a follow-up email regarding PA-05

  • Purpose: Send a single follow-up email 7 days after an attribution click (to measure beta conversion rates).
  • Legal basis: Art. 6(1)(a) Explicit consent (separate checkbox, pre-checked=false).

PA-07 Switching report (concierge, by email)

  • Purpose: To prepare and send you a switching report based on the contract details you provide by email.
  • Legal basis: Art. 6(1)(a) Consent. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing before it.
  • Data collected: whether your subscription is mobile-only or bundled; the monthly price of the mobile line; and, if you choose to share them, the tariff plan name, whether a handset was included, and monthly data usage.
  • Not collected: name, address, phone number, customer number, bank details, contract documents, screenshots.
  • Retention: deleted within 14 days of the report being delivered, or immediately on request.

PA-08 Switching-intention question on the results page

  • Purpose: To find out whether a comparison actually leads anywhere, and what stops it when it does not. One optional question, one click, seven fixed options.
  • Legal basis: Art. 6(1)(f) legitimate interest — improving a service we cannot otherwise measure, weighed against an impact we have kept at nil by storing no record of you. Not consent: consent would oblige us under Art. 7(1) to prove who agreed, which would mean keeping exactly the per-person record this design removes.
  • Data stored: none about you. Your answer adds 1 to a counter identified by four values — question version, chosen option, product category, and the calendar month. Nothing else is written.
  • Not stored: your identity, the link to your result, the time of your answer, any free text, your current provider, your bill, or any row representing a single answer. Because no record of an individual answer exists, we count answers, not people, and we cannot find, show or delete your particular answer.
  • Retention: the counters are kept indefinitely, as they contain no personal data and sit outside the 90-day chain. Answering is irreversible — once counted, an answer cannot be identified or withdrawn, and we say so next to the question before you click.

3. Legitimate interests (Art. 13 §1(d))

PA-04 Security Logs: Service security operations, such as the detection of fraud and malicious access, constitute a legitimate interest. Balance with the interests, rights, and freedoms of data subjects: The data collected is minimized and proportionate to the security objectives.

4. Recipients and Third Parties (Art. 13 §1(e))

PA-01/PA-02 comparison data is not transferred externally. The third-party data processors are listed below.

  • Sentry — Error monitoring (security logs). Sentry Inc. (U.S., SCCs apply).
  • PostHog — Product Analytics (Security Logs). EU region option available.
  • Neon — Database hosting. EU-Central-1 (Frankfurt). Neon DPA signed.
  • Vercel — Service hosting. EU edge deployment (FRA1).
  • Resend — Send a follow-up email (PA-05). Use the EU region.
  • Gandi — Mail hosting for contact@slim.lu (PA-07 concierge correspondence). France (EU).

Affiliate Redirect: The user navigates directly to the merchant's site via their browser. Slim does not transmit personal data to the merchant (not a third-party transfer under the GDPR).

5. Transfer to a third country (Art. 13 §1(f))

Neon, Resend, and PostHog use the EU region. Sentry is a U.S. entity, and data is transferred in accordance with the SCCs (Standard Contractual Clauses). Detailed compliance with the transfer requirements is scheduled to be confirmed following an external audit (immediately prior to the beta launch).

6. Retention Period (Art. 13 §2(a))

  • Comparison request PII (household type, usage): 90 days after collection. After that, data is anonymized or set to NULL.
  • Results of the comparison: Permanent retention (permanent link SLA). PII-derived fields in the results: Set to NULL after 90 days.
  • Affiliate click FK: SET NULL after 90 days. Settlement field: Belgian accounting requirements (7–10 years).
  • Email address: Set to NULL immediately after successful delivery. Meta column: Deleted after 90 days.

7. Rights of Data Subjects (Art. 13 §2(b))

Data subjects may exercise the following rights. Please submit your request via email to the contact address below.

  • Right of Access (Art. 15)
  • Right to Rectification (Art. 16)
  • Right to Erasure (Art. 17)
  • Right to Restrict Processing (Art. 18)
  • Right to Object to Processing (Art. 21)
  • Right to Data Portability (Art. 20)
  • Right to Withdraw Consent (Art. 7(3)) — Consent for affiliate marketing, follow-up emails, and analytics cookies may be withdrawn separately.

8. Withdrawal of Consent (Art. 13 §2(c))

Art. 6(1)(a) Consent-based processing (PA-03/PA-05/Analytics Cookies): You may withdraw your consent at any time. How to withdraw consent: Affiliate consent — Operator email. Follow-up emails — 1-click unsubscribe link in the email. Analytics Cookies — Cookie settings at the bottom of the page.

9. Right to File a Complaint with the Supervisory Authority (Art. 13 §2(d))

Data subjects may file a complaint with the following supervisory authority.

  • Belgium: Autorité de protection des données (APD) / Gegevensbeschermingsautoriteit (GBA) — www.autoriteprotectiondonnees.be
  • Netherlands: Autoriteit Persoonsgegevens (AP) — www.autoriteitpersoonsgegevens.nl
  • Luxembourg: Commission nationale pour la protection des données (CNPD) — www.cnpd.public.lu

10. Nature of the obligation to provide data (Art. 13 §2(e))

The information requested for the comparison (household type and usage) is necessary for the provision of the service (Art. 6(1)(b)). If this information is not provided, we will be unable to calculate the comparison results.

11. Automated decision-making (Art. 13 §2(f))

Slim's comparison engine performs only arithmetic calculations to determine potential savings. It does not involve automated individual decision-making or profiling as defined in GDPR Article 22. The ranking of comparison results is based on an arithmetic comparison of provider pricing data and the input assumptions, not on profiling based on personal characteristics.

12. Contact Information

Please contact us at the email address below for inquiries regarding personal information or to exercise your rights.

contact@slim.lu

Privacy Policy · Slim