Privacy Policy
How Eaglessoft BV processes personal data across eaglessoft.com, DocNaut and our free online tools — and how you can exercise your rights under the GDPR.
Version & Contents
| Version | Date | Change |
|---|---|---|
| 1.0 | 29 October 2026 | First version under this title. Replaces the previous eaglessoft.com “Privacy Policy” in full and also covers DocNaut. |
- About this policy
- Who we are and how to contact us
- Our role: controller or processor
- Website visitors, enquiries, newsletter and business contacts
- DocNaut customers and platform users
- Job applicants
- Legal claims, legitimate interest and deletion
- Where we get your data
- Do you have to provide your data?
- The Peppol network
- Who receives your data
- Transfers outside the EU/EEA
- Security
- Automated decision-making
- Your rights
- Right to complain
- Children
- Third-party services and links
- Changes to this policy
- Related documents
About this policy
This policy explains how Eaglessoft BV (“Eaglessoft”, “we”, “us”) processes personal data when you:
- visit our websites eaglessoft.com, in any of its language versions (English, Dutch, French and German), and www.docnaut.com (the “Websites”);
- use DocNaut: the customer portal portal.docnaut.com, our login service sso.eaglessoft.com, the DocNaut APIs and API documentation, and our Peppol Access Point and Service Metadata Publisher (SMP) (together, the “Services”);
- use the free online tools at tools.docnaut.com and on the Websites: the Peppol Validator, the XML Transformer and the Peppol Participant Lookup (the “Tools”);
- contact us, request a demo, book a meeting, download an e-book or other resource, or sign up for our newsletter;
- are a business contact of ours: a prospect, a partner, a representative or contact person of a customer or supplier, or someone we meet at an event;
- are a person whose organisation is verified before it can use the Services (KYB/KYC);
- send us a job application.
DocNaut is a brand and service of Eaglessoft BV.
Which section applies to you:
| You are | Read |
|---|---|
| A visitor to our Websites, a user of the Tools, someone who contacts us or subscribes to our newsletter, or a business contact | Section 4 |
| A user of DocNaut, a customer’s representative or contact person, or a person whose organisation we verify | Sections 3 and 5 |
| A job applicant | Section 6 |
Sections 7 to 20 apply to everyone.
We process personal data in line with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
This policy does not cover Invocit. For Invocit (invocit.com and its platform), see the Invocit Privacy Policy.
Our use of cookies and similar technologies is explained in the cookie policy of each website: the Eaglessoft Cookie Policy for eaglessoft.com and the Tools, and the DocNaut Cookie Policy for www.docnaut.com, the portal and our login service.
This policy is available in English. If you need help understanding it in Dutch, French or German, contact us at [email protected].
Who we are and how to contact us
| Item | Details |
|---|---|
| Controller | Eaglessoft BV |
| Address | Excelsiorlaan 31, 1930 Zaventem, Belgium |
| Enterprise number | 1025.494.094, RLE Brussels (Dutch-speaking enterprise court); VAT BE 1025.494.094 |
| General contact | [email protected] |
| Data Protection Officer | Rüstem Duru, [email protected], or by post to the address above, marked “For the attention of the Data Protection Officer” |
Our role: controller or processor
We are the controller for the personal data we process for our own purposes:
- visitors to our Websites and users of the Tools, enquiries, demo requests, newsletter subscribers and business contacts;
- user accounts and logins, including sign-in with Google or Microsoft;
- customer and partner verification (KYB/KYC), including data we receive through partners;
- support requests;
- contracts, billing and accounting;
- security, access and activity logs;
- registration of our customers on the Peppol network;
- job applications.
We are a processor for the content of the documents our customers send and receive through DocNaut, such as invoices, credit notes, orders, despatch advice and invoice responses, and any personal data in them. Our customer (the sender or receiver) is the controller of that data. We process it only on the customer’s instructions, under our Data Processing Agreement. The sub-processors we use for those documents are listed on our Sub-processors page. If your personal data appears in such a document, please contact the organisation that sent or received it. If you contact us instead, we will pass your request to that organisation.
The rest of this policy covers the processing for which we are the controller.
Website visitors, enquiries, newsletter and business contacts
| Activity and purpose | Personal data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Website operation and security.Delivering the Websites to your browser, protecting them against attacks, spam and misuse, and investigating incidents. This includes the automated bot check (Cloudflare Turnstile) on the forms of eaglessoft.com. | IP address, date and time, pages requested, referring page, browser and device data, and the technical signals used for the bot check. | Legitimate interest (Art. 6(1)(f)) in running secure and working websites. | Web server and web application firewall logs of eaglessoft.com and www.docnaut.com: 14 days. Logs needed to investigate an incident or a legal claim are kept until it is closed. |
| Enquiries and demo requests.Answering messages sent through our contact forms (including the quick contact form shown on every page of eaglessoft.com), by e-mail, by telephone or through WhatsApp; handling demo and partner programme requests; scheduling meetings and demos you book through Microsoft Bookings. | Name, e-mail address, telephone number, subject, your message, the page from which you sent it, and the details of a meeting you book. Company and job title if you provide them. | Steps taken at your request before a possible contract (Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)). | 6 months after our last contact, unless a business relationship follows. Then the data is kept as described under “Business contacts”. |
| E-books and other resources.Sending you a resource you request, such as the Slovakia E-Invoicing Handbook, and a backup download link by e-mail. | Name, e-mail address, the resource requested, date of the request. | Our legitimate interest (Art. 6(1)(f)) in sending you the resource you requested. The newsletter box on the form is optional and not pre-ticked. | 1 year after the request. If you also tick the box to receive our news, the newsletter row applies to that subscription. |
| Newsletter.Sending our newsletter about e-invoicing, regulatory developments, events and our products and, only with your consent, measuring whether it is opened and which links are clicked. | E-mail address, name if you provide it, language, the date, source and proof of your subscription and, if you have consented to it, open and click data. For recipients who have consented to it, our e-mails contain a small image and tracked links that tell us whether an e-mail was opened and which links were clicked. | Consent (Art. 6(1)(a)), given through a sign-up form and confirmed by e-mail (double opt-in). For existing customers: our legitimate interest (Art. 6(1)(f)) in informing them about similar products and services, within the limits of Belgian law on electronic direct marketing. We measure opens and clicks only for recipients who have consented to it (Art. 6(1)(a) and Article 10/2 of the Belgian Act of 30 July 2018). Customers who receive our news without having subscribed receive it without open and click tracking, unless they have consented to it. You can unsubscribe, or withdraw your consent to the measurement, at any time, free of charge, through the link in each e-mail or by writing to us. | Until you unsubscribe. Proof of consent: for as long as you are subscribed and 3 years after. After you unsubscribe, we keep your e-mail address on a suppression list so that we do not contact you again. |
| Online tools.Validating or transforming the e-invoice or XML file you upload, or looking up a Peppol participant, and returning the result to you. | The content of the file you upload, which may include names and contact details of the people mentioned in it; for the Peppol Participant Lookup, the identifier you enter; and the technical data described under “Website operation and security”. If the file contains data about other people, we process it only to produce the result. The identifiers you look up are sent to the official Peppol services (the Service Metadata Locator, the Service Metadata Publisher of the participant and the Peppol Directory) to retrieve the public registration data they hold. | Legitimate interest (Art. 6(1)(f)) in offering a free tool that you choose to use. | Files are processed only to return the result and are deleted immediately afterwards; they are not kept. Technical access logs (IP address, time, request) are kept for 7 days. Security events, such as blocked attacks, are kept for 90 days in active storage, then up to 1 year in a secured archive, then deleted. Longer only where the law requires it or where they are needed to investigate an incident or a legal claim. Upload only files you are entitled to share, and please use test data or remove personal data that the check does not need. |
| Business contacts, prospects and partners.Managing our relationships with customers, prospects, partners and suppliers; preparing and following up on meetings and events; telling business contacts about our products and services. | Name, job title, organisation, business e-mail address and telephone number, professional profile (for example on LinkedIn), the history of our contacts and meetings, and your marketing preferences. | Legitimate interest (Art. 6(1)(f)) in developing and maintaining business relationships. Marketing e-mails are sent only where the law allows them without consent, or with your consent. You can object at any time. | 2 years after our last interaction, unless a contract is concluded. Contract and billing data are then kept as long as the law requires. Opt-outs: kept on a suppression list. |
| Website statistics on eaglessoft.com (statistics cookies, only with your consent). Understanding how visitors use eaglessoft.com and improving it, using Google Analytics 4 and Microsoft Clarity. | Pseudonymous cookie identifiers, pages viewed, clicks, scrolling and mouse movements, referring page, approximate location (country or city, derived from the IP address), device and browser type. Clarity masks text that you type into forms. Google tags are loaded only after you consent (Google Consent Mode v2 in basic mode). | Consent (Art. 6(1)(a)) and Article 10/2 of the Belgian Act of 30 July 2018. You can withdraw it at any time. | Cookies: see the Eaglessoft Cookie Policy. Google Analytics data: 14 months. Clarity session recordings: 30 days; aggregated statistics up to 13 months. |
| Website statistics on www.docnaut.com (only if you accept statistics cookies). Understanding how visitors use www.docnaut.com. | A pseudonymous visitor identifier, pages visited, referring page, device and browser type. | Consent (Art. 6(1)(a)) and Article 10/2 of the Belgian Act of 30 July 2018. You can withdraw it at any time. | Statistics cookie: 30 days. Statistics data: 13 months, after which it is deleted or kept only in aggregated form. |
| Advertising and conversion measurement on eaglessoft.com (marketing cookies, only with your consent). Measuring the results of our advertising campaigns on Google, LinkedIn and Meta (Facebook and Instagram), and showing our advertisements to visitors of eaglessoft.com and to similar audiences on those platforms. | Pseudonymous cookie identifiers, pages viewed, actions on the website (such as sending a form), ad-click identifiers, IP address, device and browser data. | Consent (Art. 6(1)(a)) and Article 10/2 of the Belgian Act of 30 July 2018. You can withdraw it at any time. | Cookies: see the Eaglessoft Cookie Policy. Further processing by Google, LinkedIn and Meta: under their own policies (section 11). |
If we obtain your data as a business contact or prospect from another source (section 8), we inform you about this policy at our first contact with you, and at the latest within 1 month.
DocNaut customers and platform users
| Activity and purpose | Personal data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Accounts and access.Creating and managing your account (including self-registration), signing you in, “Remember me”, sign-in with Google or Microsoft, roles and permissions, two-factor authentication. | Name, business e-mail address, password (stored only as a secure hash), language, organisation and role, two-factor settings (authenticator app), and the account identifier received from Google or Microsoft. | Contract (Art. 6(1)(b)) where you are our customer or act in your own name. Otherwise our legitimate interest, and that of the organisation you work for, in giving its staff secure access to the Services (Art. 6(1)(f)). | For as long as the account exists, during the customer’s contract. After the account is closed or the contract ends, it is deleted, and from backups within a further 30 days, except data we must keep by law (for example accounting records, for 10 years) or under the rows below. |
| Providing the Services.Operating the portal and the APIs, company and integration settings, network registrations requested by your organisation, service notifications. | The data above, plus your actions in the portal, API client and configuration data, and notification e-mail addresses. | Contract (Art. 6(1)(b)), or legitimate interest (Art. 6(1)(f)) as above. | For the duration of the customer’s contract, then as in the row above. |
| Customer and partner verification (KYB/KYC).Verifying that an organisation exists, is active and has authorised its signatory; checking intermediaries; sanctions screening; re-verification. This also applies to companies that use Invocit or our ERP add-ons, where their documents are exchanged through DocNaut. | Name, function and capacity to represent the organisation, business e-mail and telephone, signature and the data in the signature certificate, mandates, register extracts, sanctions screening results, and the method, result and reference of each check. We never collect or keep copies of identity documents or biometric data. | Legal obligation (Art. 6(1)(c)) where EU or Member State law requires the check. Where the law of a country outside the EU requires it, and otherwise, our legitimate interest (Art. 6(1)(f)) in meeting the Peppol and other network rules that require it, and in preventing fraud and misuse. We do not rely on consent. | 5 years after the end of the customer relationship, even if erasure is requested, because the records are needed to establish or defend legal claims. Applications that do not lead to a contract: the documents, the personal data and the refusal entry (company identifier, date, reason code) are deleted 15 days after the case is closed. |
| Peppol network registration.Registering your organisation’s identifiers in the Peppol network and publishing its business card in the Peppol Directory (see section 10). | Company name (which may be a person’s name for a sole trader), country, identifiers and, if your organisation provides them, a contact name, e-mail address and telephone number. | Contract (Art. 6(1)(b)) and our legitimate interest (Art. 6(1)(f)) in meeting the Peppol rules. | For as long as the registration is active. Removed within the deadlines of the Peppol rules after deregistration or the end of the contract. |
| Support.Answering questions and incidents. | Name, contact details, the content of your request and our replies. | Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)). | For the duration of the customer’s contract, and afterwards for as long as needed to handle any follow-up or claim. |
| Contracts, billing and accounting.Concluding contracts, invoicing, collecting payments, keeping accounting records. | Names and contact details of signatories and billing contacts, contract data, invoices, payment data such as bank account numbers. | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) under Belgian accounting and VAT law. | Accounting records and invoices: as long as Belgian accounting and tax law requires (currently 10 years). Contracts: for the duration of the contract and afterwards for as long as the law requires. |
| Security and logs.Protecting the Services, detecting and investigating misuse and incidents, meeting our Peppol obligations. | IP address, user and client identifiers, time stamps, login events, API calls, browser data, and Peppol transmission data (sender and receiver identifiers, document type, message identifiers, time stamps). | Legitimate interest (Art. 6(1)(f)) in the security of the Services and in meeting the Peppol rules. For Peppol activity logs, also legal obligation (Art. 6(1)(c)) where EU or Member State law, such as tax law, requires us to keep them. | Security event logs (such as sign-in events, administrative access and security alerts): 90 days in active storage, then up to 1 year in a secured archive, then deleted. Application logs and API gateway access logs: 7 days. Longer only where the law requires it. Peppol activity logs: for as long as the law and the Peppol rules require, and at least 3 months. Logs needed to investigate an incident or a legal claim are kept until that is closed. |
| News about our services.Telling customer contacts about new features and similar services. | Name, business e-mail address and organisation that you gave us when you or your organisation became our customer. | Legitimate interest (Art. 6(1)(f)), within the limits of Belgian law on electronic direct marketing. You can object when you give us your address and at any time afterwards, free of charge, through the link in each message or by e-mail. We measure whether these e-mails are opened and which links are clicked only if you have consented to it (Art. 6(1)(a) and Article 10/2 of the Belgian Act of 30 July 2018); otherwise they are sent without such tracking. | Until you opt out or the customer relationship ends. After an opt-out we keep your e-mail address on a suppression list so that we do not contact you again. |
Job applicants
| Activity and purpose | Personal data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Job applications.Assessing applications that you send to us, including unsolicited applications sent by e-mail. | Name, contact details, CV, cover letter, and the notes from our selection process. | Steps taken at your request before a possible employment contract (Art. 6(1)(b)). Keeping your application for future vacancies: consent (Art. 6(1)(a)). | 6 months after the end of the selection procedure. With your consent, 1 year, so that we can contact you about future vacancies. If you are hired, the data becomes part of your personnel file. |
Legal claims, legitimate interest and deletion
| Activity and purpose | Personal data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Legal claims and authority requests.Establishing, exercising or defending legal claims, and answering lawful requests from authorities. | The data relevant to the claim or request. | Legal obligation (Art. 6(1)(c)) or legitimate interest (Art. 6(1)(f)). | For as long as the claim or request requires. |
Where we rely on legitimate interest, we have weighed our interest against your rights. You can ask us for more information about that assessment, and you can object (section 15).
When a retention period ends, we delete the data or anonymise it.
Where we get your data
Most data comes from you. Some comes from other sources:
- Your organisation, when an administrator invites you to DocNaut, names you as a contact person or representative, or sets up a notification address.
- Partners, resellers and intermediaries, such as ERP and software partners or accounting firms that introduce you to us, or act for your organisation and forward application data and mandates to us.
- Public registers and professional sources, such as company websites, the Belgian Crossroads Bank for Enterprises (KBO/BCE), the Belgian Official Gazette, the EU VAT Information Exchange System (VIES), comparable registers in other countries, and professional networks such as LinkedIn.
- Sanctions lists, in particular the EU consolidated list of financial sanctions.
- Authority platforms, where your organisation appoints us as its provider on a tax or e-invoicing authority’s platform.
- Events, trade fairs and webinars where we meet you or where you leave your details.
- Google or Microsoft, if you choose to sign in to DocNaut with them: we receive your name, e-mail address and an account identifier.
Do you have to provide your data?
You need to provide the data for your account to use the DocNaut portal. Verification data is required by law or by the network rules that apply to us; without it, we cannot activate your organisation’s network registrations or document exchange. Billing data is required to conclude and perform the contract. Fields marked as required in a form are needed to answer you or to send you what you ask for; without them we cannot do so. Otherwise you are not required to give us any personal data. Statistics and marketing cookies are always optional, and the Websites work fully without them.
The Peppol network
When we register your organisation on the Peppol network, its identifiers are published in the Peppol Service Metadata Locator (SML) and in our SMP, so that other Peppol participants can find out how to reach it. If your organisation chooses, we also publish a business card in the Peppol Directory. This card contains the company name, country and identifiers, and may contain a contact person.
This information is public by design and can be consulted by anyone. OpenPeppol and the operators of the SML and the Peppol Directory process it under their own policies. When the registration ends, we remove it from our SMP and ask for its removal from the SML and the Directory within the deadlines of the Peppol rules.
Who receives your data
We do not sell personal data.
Inside Eaglessoft, only staff who need the data for their work have access, and access to personal data is restricted to authorised staff resident in the EU/EEA. Access by staff outside the EU/EEA is permitted only where it has been individually approved by our Data Protection Officer and Information Security Manager and recorded under our information security management system (see section 12).
Service providers (processors)
We use the following service providers, which process personal data on our behalf under a data processing agreement:
- hosting, storage and backup of DocNaut: Hetzner Online GmbH (Germany and Finland), 3DS OUTSCALE SAS (France, for the France service only) and, for encrypted offsite backups until their migration to our own storage is complete, Amazon Web Services EMEA SARL (EU region);
- website hosting of eaglessoft.com and www.docnaut.com (data centres in the EU);
- network security, DNS and content delivery: Cloudflare, Inc. (global network, including the Turnstile bot check, see section 12);
- corporate e-mail, collaboration and appointment booking: Microsoft Ireland Operations Limited (Microsoft 365 and Microsoft Bookings, within the Microsoft EU Data Boundary, see section 12);
- electronic signature and identity verification used in customer verification: eID Easy (Estonia, EU);
- newsletter: Mailchimp (The Rocket Science Group LLC d/b/a Mailchimp, an Intuit company, United States);
- website statistics on eaglessoft.com: Google (Google Ireland Limited) for Google Analytics;
- IT support providers for the Websites.
The sub-processors we use for the documents we process for our customers are listed, with their locations, on our Sub-processors page.
Joint controllers (Meta, LinkedIn and Microsoft Clarity)
When you accept marketing cookies on eaglessoft.com, Meta (Meta Platforms Ireland Limited, Meta Pixel) and LinkedIn (LinkedIn Ireland Unlimited Company, LinkedIn Insight Tag) receive data from the website. When you accept statistics cookies on eaglessoft.com, Microsoft (Microsoft Ireland Operations Limited) receives data through Microsoft Clarity, which Microsoft provides as a controller under the Clarity Terms of Use. For collecting that data on the website and transmitting it to these providers, we are joint controllers with each of them (Article 26 GDPR). The essence of the arrangement is: we are responsible for asking your consent before the data is collected and for informing you through this policy and the Eaglessoft Cookie Policy; Meta, LinkedIn and Microsoft are each responsible for their own processing after the transmission, under their own privacy policies, and for answering rights requests about it. You can exercise your rights with us or with them; we pass on requests that concern their part. The terms are set out in the Meta Controller Addendum, LinkedIn’s Data Processing Agreement and the Clarity Terms of Use.
Independent controllers
Google (Google Ireland Limited) receives data for Google Ads as an independent controller under the Google Ads Controller-Controller Data Protection Terms. Google is solely responsible for what it does with that data, under its own privacy policy. If you contact us through WhatsApp, WhatsApp Ireland Limited processes your messages under its own terms.
Our social media pages
We have pages on LinkedIn, Instagram, X and YouTube. When you visit them, the platform processes your data under its own privacy policy and gives us statistics about our page (“page insights”) based on our legitimate interest (Art. 6(1)(f)) in understanding our audience. For LinkedIn and Instagram (Meta), we are joint controllers with the platform for these statistics; the essence is set out in the LinkedIn Page Insights Joint Controller Addendum and the Meta Page Insights Controller Addendum. The platforms handle rights requests for their part.
Other recipients, each acting as an independent controller
- the Peppol network and the participants your organisation exchanges documents with (section 10);
- the official Peppol services (the Service Metadata Locator, Service Metadata Publishers and the Peppol Directory), which receive the identifiers you look up with the Peppol Participant Lookup;
- Peppol Authorities and tax or e-invoicing authorities, where the network rules or the law require it;
- partners or intermediaries that act for your organisation, within its mandate;
- our professional advisers, auditors and certification bodies, who are bound by confidentiality;
- courts, the police and other authorities, where the law requires it;
- a buyer or successor of all or part of our business, under this policy.
Transfers outside the EU/EEA
We host and store the Services, including customer documents, in the EU/EEA. Personal data can leave the EU/EEA only in the following cases:
All traffic to and from the Websites, the Tools, the portal and the APIs, including the content of requests and responses and the documents you upload or download, passes through the global network of Cloudflare, Inc., our network security and content delivery provider, and may be processed in transit outside the EU/EEA. Cloudflare does not store documents. This transfer is covered by the European Commission’s Standard Contractual Clauses, incorporated in Cloudflare’s Data Processing Addendum, and by Cloudflare’s certification under the EU–US Data Privacy Framework. Our login service sso.eaglessoft.com and Peppol message exchange between Access Points do not pass through Cloudflare.
Microsoft 365 and Microsoft Bookings process data within the Microsoft EU Data Boundary. Limited residual transfers outside the EU/EEA are covered by Microsoft’s Data Protection Addendum and the Standard Contractual Clauses it incorporates.
Mailchimp, Google, Microsoft (Clarity), LinkedIn and Meta are based in, or use sub-processors in, the United States or other countries outside the EU/EEA. Such transfers are protected by the European Commission’s adequacy decision for the EU–US Data Privacy Framework, for providers certified under it, and by the European Commission’s Standard Contractual Clauses, as an additional safeguard or where no adequacy decision applies.
Where individually approved and recorded under our information security management system, authorised staff may access personal data from outside the EU/EEA to provide, operate and support the Services. Such access is protected by encrypted connections, multi-factor authentication and access logging.
If you choose this option, Google or Microsoft processes your data under its own policy and may transfer it outside the EU/EEA.
You can ask our Data Protection Officer for a copy of the safeguards.
Security
We protect personal data with appropriate technical and organisational measures, including encryption in transit and at rest, access control based on need to know, two-factor authentication, logging and monitoring, and regular backups. DocNaut and our other activities are operated under Eaglessoft BV’s information security management system. Eaglessoft BV holds ISO/IEC 27001:2022 certification (certificate 1754-01, valid until 19 November 2028) and ISO/IEC 27701 certification (certificate 1754-02, valid until 27 January 2029), issued by BBS A.Ş., for software development, data processing, system integration and customer/personal data protection processes. If a personal data breach occurs, we notify the Data Protection Authority within 72 hours where the law requires it, and inform the people affected where the risk to them is high.
If you use DocNaut, you are responsible for keeping your login details and API credentials confidential.
Automated decision-making
We do not take decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22 GDPR). In verification, automated tools check identifier formats, look up registers and match names against sanctions lists, but every decision to approve or refuse is taken by a staff member and reviewed by a second person.
Your rights
You have the right to:
- access your personal data and receive a copy;
- rectify inaccurate or incomplete data;
- erasure of your data;
- restriction of processing;
- data portability for data you provided to us under a contract or your consent;
- object to processing based on legitimate interest, and at any time to direct marketing (see below);
- withdraw your consent at any time, without affecting processing that took place before. For cookies, use the Cookie settings link at the bottom of every page of the website concerned; for the newsletter, use the unsubscribe link in each e-mail.
Right to object
You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. We will then stop that processing unless we have compelling legitimate grounds that override your interests, or need the data for legal claims. You may object to direct marketing at any time, without giving reasons, and we will then stop it.
How to exercise your rights
To exercise your rights, e-mail [email protected], or write to the address in section 2. If you use DocNaut, you can also change most account data yourself in the portal. We may ask you to confirm your identity. We reply within 1 month. For complex or numerous requests, we may extend this by 2 months and will tell you why. Exercising your rights is free.
Some rights have limits. For example, we keep verification and accounting records for the periods in section 5 even if you ask for erasure, because the law requires it or because we need them for legal claims. We will always tell you why we cannot meet a request.
If your request concerns documents processed for one of our customers, we will pass it to that customer (section 3).
Right to complain
If you are not satisfied with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données):
Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, Belgium
You may also complain to the supervisory authority in the EU country where you live or work, or where the infringement took place.
Children
The Websites and the Services are intended for businesses and professionals and are not directed at children. We do not knowingly collect personal data from children.
Third-party services and links
Our Websites contain links to other websites and services, including our product websites, our pages on LinkedIn, X, Instagram and YouTube, YouTube videos, Google Maps directions, WhatsApp and Microsoft Bookings. When you follow such a link, the other website’s own privacy policy applies. If you sign in to DocNaut with Google or Microsoft, their own terms and privacy policies also apply. We are not responsible for the privacy practices of these third parties.
Changes to this policy
We may update this policy when our Websites, our Services, our activities or the law change. Each version has a version number and an effective date, shown at the top of this page. Earlier versions are kept and are available on request. We will inform DocNaut users and customers of material changes by e-mail or in the portal before they take effect. If a change requires your consent, we will ask for it.
Related documents
Questions about your personal data?
Do not hesitate to contact our team. We are happy to help you with any questions about privacy and the protection of your personal data.
[email protected]