Privacy policy

Who we are

[Company legal name], [address], [enterprise number], is the controller for account and marketing data, and the processor for the technical-file content our customers upload. Contact: [privacy e-mail].

What we process

Account data: e-mail address, name, language, password hash (local accounts) and organisation membership with role.

Customer content: technical documentation, machine data, risk assessments, decisions and comments that your organisation uploads or creates. We process this only on your organisation's instructions (see the data processing agreement).

Audit trail: who did what and when, linked to a user id. It is append-only and hash-chained so your dossier stays verifiable.

Demo and quiz requests: name, company, e-mail and message you send us, and quiz answers.

Security data: hashed IP address and account identifiers for rate limiting (kept 24 hours).

Why and on which legal basis

To provide the service under our contract with you (Art. 6(1)(b) GDPR).

To keep the service secure and the audit trail intact: legitimate interest (Art. 6(1)(f)).

To answer demo requests and send the quiz result you asked for: your request / legitimate interest. We do not send newsletters without separate consent.

AI processing

When your organisation enables an AI provider, document excerpts are sent to that provider only to produce suggestions. Your documents are not used to train models by us; provider terms that exclude training are listed under subprocessors. Every AI suggestion must be accepted or rejected by a person.

Retention

Technical file and audit trail: as long as your organisation keeps its account. Manufacturers must keep the technical file for 10 years (Regulation (EU) 2023/1230, Art. 10(3)); export it before you delete the organisation.

[To be reviewed by a lawyer] Ten-year continuity: frozen dossier versions, their EU declarations and instructions are kept until 10 years after the "last unit placed on the market" date you record per machine; while no date is recorded we keep them without time limit. When you delete the organisation, these frozen items stay in a read-only archive (including the names in signed declarations, Art. 17(3)(b) GDPR) so that /d/ links and QR codes keep working; everything else is erased. The archive is removed automatically when the 10 years have passed.

Demo and quiz requests: 24 months. Finished background jobs: 30 days. Expired or revoked portal links: 90 days after expiry. Rate-limit and idempotency records: 24 hours.

Your rights

Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR). Export and erasure are self-service under Settings → Privacy & data. You may complain to the Belgian Data Protection Authority (www.dataprotectionauthority.be).

Where data is stored

[Hosting provider and region — must be an EU region]. Transfers outside the EEA only to subprocessors listed on the subprocessors page with appropriate safeguards (Art. 46).