Privacy statement

1. Who we are

checkplicht.be is a service of Pandbeer BV, registered office at Mechelsesteenweg 360, 2500 Lier, Belgium, company number 0607.867.920, VAT BE 0607.867.920, Antwerp Enterprise Court, Mechelen division.

Pandbeer BV is the data controller for the data processed through the platform.

General questions: info@checkplicht.be or 0467 090 090. Privacy and data protection questions: privacy@checkplicht.be.

2. Data we process

We limit ourselves to the data needed to deliver the service:

• Account data: name, email address, language preference and your organisation's company details, including address and company number.
• Supplier data: the company numbers you add, together with the name, address and related public company information.
• Check results: the outcome of each check, the timestamp, the source and the stored control evidence and overviews.
• Billing data: subscription, payment status and invoices, processed through our payment provider.
• Technical data: sign-ins, error messages and logs needed for security and operation.

3. Where supplier information comes from

Checkplicht does not collect supplier data outside the official sources. We query those sources on your behalf and store the result of the query.

• The Crossroads Bank for Enterprises (CBE) for name, address, legal form, status and activities (NACE-BEL).
• The NSSO online service for withholding due to social security debts, and NISSE for the self-employed.
• FPS Finance data for withholding due to tax debts.
• The Peppol directory for electronic invoicing capability.
• Annual accounts published by the National Bank.

4. Information for people whose data we did not receive from them

For sole traders and self-employed people, company data can also be personal data. The same applies to the names of representatives listed in public registers.

We do not receive this data from the individual, but from the public and official sources listed in point 3. We process it solely to carry out the statutory withholding check our customer must perform, and to keep evidence of it.

Data subjects can exercise their rights or object via privacy@checkplicht.be. Correcting the source data itself happens with the relevant authority, because we only reflect what the official source returns at that moment.

5. Purposes and legal bases

We process data for the following purposes:

• Running the checks you request, repeating them automatically according to your settings, and generating control evidence, site certificates and monthly overviews. Legal basis: performance of the contract.
• Notifying you when withholding is established. Legal basis: performance of the contract.
• Managing your subscription and billing and meeting accounting obligations. Legal basis: contract and legal obligation.
• Securing the service, preventing abuse and fraud, detecting errors and improving the service, including through aggregated and anonymised statistics. Legal basis: our legitimate interest.
• Commercial emails about new features, if you sign up for them. Legal basis: your consent, which you can withdraw at any time.

6. Automated processing

Automatic rechecks and the red or green result display are automated processing, but not automated decision-making with legal effect under article 22 GDPR. The platform decides nothing on your behalf: you decide whether to withhold and transfer. We do not build profiles of individuals.

7. Who we share data with

We do not sell personal data. We share data only with service providers working for us under a data processing agreement, and with the official authorities we query on your behalf. Where a processor may process data outside the European Economic Area, this is based on the European Commission's standard contractual clauses.

• Supabase: database, authentication and file storage, hosted in the European Union (Ireland).
• Lovable and Cloudflare: hosting and delivery of the website and app through a European and global edge network.
• Our email service (Lovable, with Resend as sender): sending alerts and system emails, possibly processed outside the EEA under standard contractual clauses.
• Stripe Payments Europe (Ireland): subscriptions, payments and invoices.
• The official sources listed in point 3, solely to run your check.

8. Retention periods

We do not keep data longer than necessary:

• Account data: while your account is active and up to 12 months after termination.
• Check results and control evidence: 7 years, so you can demonstrate the check was performed at the time of payment.
• Billing and accounting data: 7 years, in line with statutory tax retention.
• Security and error logs: 12 months maximum.
• Backups: rolling 30 days maximum, after which they are overwritten.
• Consent for commercial emails: until withdrawal, and afterwards the proof of withdrawal for as long as needed.

9. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent. Send your request to privacy@checkplicht.be. We reply within one month, extendable by two months for complex requests. This is free of charge, unless a request is manifestly unfounded or excessive. We may verify your identity before acting on a request.

10. Security and data breaches

Access to data runs through personal accounts with role-based permissions. Traffic is encrypted and data is isolated per organisation, so you only see the suppliers and results of your own account. Administrator access is limited to those who need it and is logged.

In the event of a personal data breach, we notify the Data Protection Authority within 72 hours where required, and inform affected customers without undue delay where the risk is high.

11. Cookies

We only use cookies that are strictly necessary to run the site and the app: the session and sign-in cookie of our authentication service, a security cookie against form abuse, and a cookie that remembers your language.

There are no analytics, advertising or tracking cookies on this site and no visitor profiles are built. Strictly necessary cookies do not require consent. If we ever introduce analytics or advertising cookies, we will first show a consent banner where you can refuse.

12. Changes

We update this statement when the service or the rules change. The date at the top shows the latest version. For material changes we notify you in the app or by email.