1.Who we are

Spinfoam VOF (hereafter "we", "us", "docs.realestate") operates the docs.realestate service from Belgium. We are the data controller for the personal data described in this policy.

You can reach our privacy team at privacy@docs.realestate for any question about how your data is handled.

2.Personal data we collect

Account information you provide

• Name (first name, last name) and email address, used to identify you and contact you about your account.
• Phone number, when you choose to provide one.
• Password, stored only as a bcrypt hash — we never see or store your password in readable form.
• If your organisation has a business account: VAT number, billing email, and postal address for invoicing purposes.

Content you upload

• Details of buildings and units you manage: address, unit name, notes.
• Documents you upload (PDF, images, plans) and any categories you attach to them.
• QR-code identifiers you generate for physical stickers.

Technical data we collect automatically

• IP address, browser type and version, operating system, and device model (for security, abuse prevention, and diagnosing errors).
• Timestamps of sign-in events and document access, retained in a limited access log.
• Approximate location derived from IP address (never GPS-precise).

3.Why we process your data (legal basis)

Under the GDPR we must have a valid legal basis to process personal data. We rely on the following bases:

• Contract (art. 6(1)(b) GDPR) — most processing is necessary to deliver the service you signed up for: creating an account, storing your documents, sending you notifications about changes.
• Legitimate interests (art. 6(1)(f) GDPR) — for security (detecting brute-force sign-ins, malicious uploads), abuse prevention, and limited service improvement analytics that never identify individuals.
• Legal obligation (art. 6(1)(c) GDPR) — for retaining invoicing records for the period required by Belgian tax law.
• Consent (art. 6(1)(a) GDPR) — for optional cookies used for analytics or the mobile-app installation prompt. You can withdraw consent at any time from the cookie banner.

4.Who has access to your data

Content you upload to docs.realestate is visible only to:

• You, as the person who uploaded it or as a member of the account it belongs to.
• Other members of the same account whom an account administrator has explicitly invited, with the role and access level the admin chose.
• A limited number of Spinfoam VOF engineers, on request, for support or diagnostic purposes. Every such access is logged.

Sub-processors we use

To deliver the service we work with the following providers, who each act as sub-processors under a data-processing agreement:

• Hosting — servers physically located in the European Union.
• Transactional email — for sign-up confirmations, invites, password resets, and account notifications.
• Payment processing — used only when you subscribe to a paid plan; we never see full card numbers.
• Translation service — Google Translate is used at build time only, to auto-translate our own interface labels into additional languages. Your content is never sent to translation services.

We never share data with advertising networks, data brokers, or affiliate partners. Data is disclosed to authorities only when compelled by a valid legal order applicable in Belgium.

5.How long we keep your data

• Account and content data — kept for as long as your account is active. After you delete your account (or your account is deleted for prolonged inactivity), we retain content for 30 days in a recovery window, then permanently delete it.
• Access logs and security telemetry — 12 months.
• Invoices and payment records — 7 years (Belgian accounting law).
• Backups — encrypted backups may retain data for up to 90 days after primary deletion before they roll off; we do not restore individual deleted content from backups.

6.Your rights under the GDPR

Regardless of where you live, if we process your personal data you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct data that is inaccurate.
• Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention requirements.
• Right to data portability — receive your data in a structured, machine-readable format. Every docs.realestate account can export its content as a ZIP archive containing files plus a JSON manifest.
• Right to restrict processing — ask us to stop processing while a dispute is resolved.
• Right to object — object to processing based on our legitimate interests.
• Right to withdraw consent — for anything processed on the basis of consent.
• Right to lodge a complaint — with the Belgian Data Protection Authority ( dataprotectionauthority.be).

To exercise any of these rights, email privacy@docs.realestate. We reply within 30 days.

7.Cookies

docs.realestate uses a limited set of cookies:

• Strictly necessary cookies — required for signing in, keeping your session, and CSRF protection. These do not require consent.
• Preference cookies — remember your language and interface choices.
• Analytics cookies — used only if you consent via the cookie banner. Analytics data is aggregated and cannot be used to identify individual users.

You can review and change your cookie preferences at any time using the cookie banner or via your browser settings.

8.International data transfers

Our servers and primary storage are located in the European Union. Where a sub-processor is based outside the EEA, we rely on European Commission adequacy decisions or Standard Contractual Clauses (SCCs), together with technical safeguards such as encryption in transit and at rest, to protect your data.

9.Security

We take security seriously. Measures include:

• HTTPS/TLS for all data in transit.
• Encrypted-at-rest storage for uploaded documents.
• Time-limited signed URLs (30-minute expiry) for document downloads, so that leaked links go stale quickly.
• Password hashing with bcrypt; passwords are never logged or transmitted in plain form.
• Optional two-factor authentication on every account.
• Role-based access control per account, and per-account isolation of content in our database.
• Regular security patches, dependency scanning, and periodic penetration testing.

No system is perfectly secure. If you become aware of a vulnerability, please email security@docs.realestate — we welcome responsible disclosure.

10.Children

docs.realestate is a professional real-estate documentation service and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11.Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or via an in-app notice at least 14 days before the change takes effect. The "Effective" date at the top of this page always reflects the current version. Previous versions are available on request.