B2B website visitor identification in Belgium

It is workable under the GDPR, which applies directly, together with the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, which sets up the national supervisory authority and completes the GDPR on matters left to member states. The usual legal basis is legitimate interest under Art. 6(1)(f) GDPR, documented through a written balancing test that weighs the commercial interest in company-level identification against the expectations of the visitor, and the practice is disclosed in the privacy notice available in whichever of Dutch, French or English the reviewer works in. lead.box acts strictly as processor under a data processing agreement; the final assessment of whether this legal basis fits your own website and audience always stays with you as controller, and none of this constitutes legal advice for your specific situation.

The Autorité de protection des données, known as the Gegevensbeschermingsautoriteit in Dutch and commonly abbreviated APD or GBA depending on language, is Belgium's single national supervisory authority, structured with separate directorates including a chambre contentieuse / geschillenkamer that handles enforcement decisions and cooperates with the other EU authorities on cross-border complaints. Its published guidance on cookies and trackers follows the same EU-level logic as the ePrivacy framework: it addresses storing or reading information on a visitor's device, which is not how company-level identification operates, since no identifier is placed on the device and no natural person is singled out. Belgian organisations that already deal with the APD/GBA on other matters — many do, given the density of federations and public bodies in and around Brussels — tend to recognise this device-versus-network distinction quickly once it is spelled out plainly.

Belgian legal and procurement reviewers, particularly the many federations, permanent representations and public affairs consultancies concentrated around Brussels, typically work through a standard vendor checklist even for a modestly priced tool: the written balancing test under Art. 6(1)(f) GDPR, an entry ready for the record of processing activities required under Art. 30 GDPR, the data processing agreement under Art. 28 GDPR, and the sub-processor list, all reviewed before a purchase order is raised rather than after. Because Belgium is functionally trilingual for business documentation, the reviewer conducting this check may work in Dutch, French or English depending on the region and sector, so having the same set of documents available in all three avoids a translation delay at exactly the stage where procurement is otherwise ready to proceed.

lead.box resolves the name and domain of the visiting organisation from network-level signals tied to the visit; it does not set a cookie, does not read from or write to the visitor's device, and does not build a cross-site advertising profile of any kind. It also does not identify the individual employee behind a visit, does not automatically enrich a session with a contact's name or email address, and does not perform a lookup against the Banque-Carrefour des Entreprises or Kruispuntbank van Ondernemingen (BCE/KBO) as part of the core identification step — a Belgian sales team that needs the registered legal name, VAT number or BCE/KBO details for a prospective account typically checks that register separately once a lead looks worth pursuing. The output stays a company name and the pages viewed, never a person and never a verified commercial record.

Belgium's business culture around Brussels is shaped by its institutional density: federations, chambers, EU affairs consultancies and permanent representations often research vendors quietly across a bilingual or trilingual site for weeks, and decisions inside these organisations tend to be consensus-driven across language communities rather than made unilaterally by one manager, which can lengthen the path from first visit to first call. Sales and business development teams commonly run HubSpot or Salesforce, and identified organisations are pushed there by webhook so a regional account owner — often organised by Flanders, Wallonia and Brussels rather than by a single national territory — sees a new lead without manual entry. For logistics and industrial suppliers along the Antwerp-Brussels-Liège corridor, a simple weekly export naming which regional accounts looked at which pages is often enough to justify a direct call.

The data processing agreement under Art. 28 GDPR and a versioned sub-processor list are published in the languages a Belgian reviewer is likely to need, so a data protection officer, an in-house counsel or an external Délégué à la protection des données / functionaris voor gegevensbescherming can complete a first review before a purchase order is raised. Data concerning EU visitors, including Belgian visitors, is processed in ISO-certified EU data centres and is not moved outside the EU for this purpose, which matters in a country whose courts and public institutions pay close attention to international transfer questions given Belgium's role as an EU institutional hub. Because Belgian procurement checklists specifically ask for the processing location and retention period as separate line items, having both published in advance removes two of the more common points where a review otherwise stalls.

Getting started means adding a first-party JavaScript snippet to the site, most often deployed through a tag manager, after which identified organisations typically begin appearing within the first days of traffic without any waiting period tied to a contract term. From there, results can be exported as CSV or Excel, filtered by region, sector or page visited, or pushed automatically by webhook into whichever CRM the team already runs, which matters for organisations split across Flemish, French-speaking and Brussels-based teams that may otherwise track leads in separate spreadsheets. Seats can be added as the team grows, and cancellation happens through self-service account settings rather than a formal written notice, which fits how many Belgian organisations prefer to trial a new tool on a limited basis before a longer commitment is discussed internally.

Identification depends on how a visit reaches the internet, and a visitor on a fixed office connection through a major Belgian operator such as Proximus, Orange Belgium, Telenet or VOO is generally resolved reliably, while mobile connections, personal VPNs and shared connections are harder or impossible to attribute correctly. Brussels adds a specific complication: many federations, permanent representations and public affairs consultancies share a single office building and a single internet connection, which can produce a resolved name that reflects the building's main occupant rather than the specific organisation actually browsing the site, and the same applies to holding structures where several subsidiaries share one group-level connection. Visitors near the language and national borders with France, the Netherlands or Germany can also occasionally resolve to a parent entity registered abroad. lead.box treats every match as a signal to qualify, not a confirmed fact, and a sales team should verify the account before treating it as a qualified lead.