Privacy policy

1. Who processes your data

Dérard - Valmondier Belgium SRL, Avenue Louise 480, floor 18, 1050 Ixelles, Belgium, enterprise number BE 0683.571.965, is the controller for data about website visitors and people who contact it.

For the data our customers put into the platform, the customer is the controller: we act as processor, on its instructions, under a data processing agreement.

For any question: [email protected].

2. What we collect

• Contact or demonstration form: name, company, email address, telephone, country, number of units managed and the message you write.
• User account: email address, name, language, organisation, role, sign in dates.
• Server technical logs: IP address, date and time, page requested, browser type. They serve security and diagnosis.
• Business data put into the platform by our customers: properties, mandates, leases, tenants, financial movements. We are only the processor for these.

3. Why, and on what basis

• Answering a contact or demonstration request: steps taken at your request before a contract, and legitimate interest in following up professional enquiries.
• Supplying the platform, opening and maintaining access, invoicing: performance of the contract.
• Security, abuse prevention, technical logs: legitimate interest in protecting the service.
• Accounting and tax obligations: legal obligation.
• Sending commercial information to an existing customer about similar services: legitimate interest, with an unsubscribe link in every message.
• Newsletter to a non customer: consent, which can be withdrawn at any time.

4. For how long

• Contact requests with no follow up: three years from the last exchange.
• Accounts and platform data: for the duration of the subscription, then thirty days for export, then deletion from production environments and from backups according to the rotation cycle.
• Accounting records: seven years, the statutory retention period in Belgium.
• Technical logs: twelve months at most.

5. Who has access

Your data is never sold, rented or exchanged.

It is accessible to our teams, strictly as their duties require, and to the technical providers that let us supply the service:

• OVH SAS, France: hosting of the website and application server.
• Database hosting provider, Paris: database and authentication.
• Cloudflare: traffic delivery and protection.
• Resend: transactional email.

6. Where your data is

Data is hosted in the European Union. Where a provider may access it from a third country, that access is framed by the European Commission’s standard contractual clauses and by additional technical measures.

The current list of subprocessors is available on request at [email protected].

7. Your rights

Under the General Data Protection Regulation you have the following rights, subject to its conditions:

• access to your data and a copy of it;
• rectification of inaccurate or incomplete data;
• erasure, where retention is no longer justified;
• restriction of processing, and objection, in particular to direct marketing;
• portability of the data you provided to us;
• withdrawal of your consent at any time, without affecting what was done before.

8. How to exercise them

Write to [email protected]. We answer within one month. If your request concerns data placed in the platform by one of our customers, we pass it to that customer, who is the controller, and we assist them.

You may lodge a complaint with the Belgian Data Protection Authority, rue de la Presse 35, 1000 Brussels, or with the authority of your country of residence.

9. Security

• End to end encryption of traffic with TLS, on the website and on the platform.
• Strict isolation between organisations, enforced by the database itself and not by application code alone.
• Named accounts, differentiated roles, two factor authentication recommended for administration accounts.
• An append only log of sensitive actions.
• Notification of personal data breaches without undue delay, to the authority and, where the risk requires it, to the individuals concerned.

10. Automated decisions

No decision producing legal effects concerning you is taken solely on the basis of automated processing. The platform’s assistance features suggest; they do not decide in the user’s place.

11. Changes

This policy may change. The version in force is dated at the top of the page. Any substantial change is notified to customers before it takes effect.