Privacy Policy
This policy is a draft. It is not the final text until it has been reviewed by a legal agent (PLAN 4.12.f).
Last updated: May 23, 2026
This Privacy Policy serves as a notice of direct collection in accordance with Article 13 of the GDPR. Slim does not collect personal data indirectly from third parties (excluded under Article 14).
1. Data Controller (Art. 13 §1(a))
The data controller for this service is as follows.
- Statement
- Kim Wonmin
- Company Number
- 1037.548.919
- VAT number
- BE 1037.548.919
- Contact Email
- kim.wonmin91@gmail.com
DPO (Article 13(1)(b)) This service is not subject to the obligation to appoint a DPO under GDPR Article 37 (small-scale sole proprietorship, no high-risk processing).
2. Purpose of Processing and Legal Basis (Art. 13 §1(c))
Processing the PA-01 Comparison Request
- Purpose: To calculate and provide results of telecommunications plan comparisons based on user input (household type, current provider, and usage).
- Legal basis: GDPR Art. 6(1)(b) — Performance of a contract for the use of comparison services.
- Data collected: household type, current provider ID, usage by category. No postal/ZIP code is collected. No IP or device information is collected.
PA-02 Comparison Results: Permanent Preservation
- Purpose: To provide a permanent link (/r/[shortId]) — so you can revisit the comparison results at any time.
- Legal basis: GDPR Art. 6(1)(b) — Performance of a contract.
PA-03 Affiliate Click Attribution
- Purpose: To record when a user has been redirected to a partner provider’s site after giving consent and to settle commissions.
- Legal basis: Art. 6(1)(a) Consent (click history) + Art. 6(1)(c) Legal obligation (Belgian accounting retention requirements).
PA-04 Security Log
- Purpose of processing: Detection of security incidents and monitoring of system anomalies.
- Legal basis: Article 6(1)(f) (legitimate interests) — secure operation of the service.
Sending a follow-up email regarding PA-05
- Purpose: Send a single follow-up email 7 days after an attribution click (to measure beta conversion rates).
- Legal basis: Art. 6(1)(a) Explicit consent (separate checkbox, pre-checked=false).
3. Legitimate interests (Art. 13 §1(d))
PA-04 Security Logs: Service security operations, such as the detection of fraud and malicious access, constitute a legitimate interest. Balance with the interests, rights, and freedoms of data subjects: The data collected is minimized and proportionate to the security objectives.
4. Recipients and Third Parties (Art. 13 §1(e))
PA-01/PA-02 comparison data is not transferred externally. The third-party data processors are listed below.
- Sentry — Error monitoring (security logs). Sentry Inc. (U.S., SCCs apply).
- PostHog — Product Analytics (Security Logs). EU region option available.
- Neon — Database hosting. EU-Central-1 (Frankfurt). Neon DPA signed.
- Vercel — Service hosting. EU edge deployment (FRA1).
- Resend — Send a follow-up email (PA-05). Use the EU region.
Affiliate Redirect: The user navigates directly to the merchant's site via their browser. Slim does not transmit personal data to the merchant (not a third-party transfer under the GDPR).
5. Transfer to a third country (Art. 13 §1(f))
Neon, Resend, and PostHog use the EU region. Sentry is a U.S. entity, and data is transferred in accordance with the SCCs (Standard Contractual Clauses). Detailed compliance with the transfer requirements is scheduled to be confirmed following an external audit (immediately prior to the beta launch).
6. Retention Period (Art. 13 §2(a))
- Comparison request PII (household type, usage): 90 days after collection. After that, data is anonymized or set to NULL.
- Results of the comparison: Permanent retention (permanent link SLA). PII-derived fields in the results: Set to NULL after 90 days.
- Affiliate click FK: SET NULL after 90 days. Settlement field: Belgian accounting requirements (7–10 years).
- Email address: Set to NULL immediately after successful delivery. Meta column: Deleted after 90 days.
7. Rights of Data Subjects (Art. 13 §2(b))
Data subjects may exercise the following rights. Please submit your request via email to the contact address below.
- Right of Access (Art. 15)
- Right to Rectification (Art. 16)
- Right to Erasure (Art. 17)
- Right to Restrict Processing (Art. 18)
- Right to Object to Processing (Art. 21)
- Right to Data Portability (Art. 20)
- Right to Withdraw Consent (Art. 7(3)) — Consent for affiliate marketing, follow-up emails, and analytics cookies may be withdrawn separately.
8. Withdrawal of Consent (Art. 13 §2(c))
Art. 6(1)(a) Consent-based processing (PA-03/PA-05/Analytics Cookies): You may withdraw your consent at any time. How to withdraw consent: Affiliate consent — Operator email. Follow-up emails — 1-click unsubscribe link in the email. Analytics Cookies — Cookie settings at the bottom of the page.
9. Right to File a Complaint with the Supervisory Authority (Art. 13 §2(d))
Data subjects may file a complaint with the following supervisory authority.
- Belgium: Autorité de protection des données (APD) / Gegevensbeschermingsautoriteit (GBA) — www.autoriteprotectiondonnees.be
- Netherlands: Autoriteit Persoonsgegevens (AP) — www.autoriteitpersoonsgegevens.nl
- Luxembourg: Commission nationale pour la protection des données (CNPD) — www.cnpd.public.lu
10. Nature of the obligation to provide data (Art. 13 §2(e))
The information requested for the comparison (household type and usage) is necessary for the provision of the service (Art. 6(1)(b)). If this information is not provided, we will be unable to calculate the comparison results.
11. Automated decision-making (Art. 13 §2(f))
Slim's comparison engine performs only arithmetic calculations to determine potential savings. It does not involve automated individual decision-making or profiling as defined in GDPR Article 22. The ranking of comparison results is based on an arithmetic comparison of provider pricing data and the input assumptions, not on profiling based on personal characteristics.
12. Contact Information
Please contact us at the email address below for inquiries regarding personal information or to exercise your rights.