1. Who is responsible?
This privacy policy applies to the website offacto.com, the Offacto platform, and the Offacto vzw app. The data controller is Offacto, Huidevettersstraat 13/3, 2300 Turnhout, Belgium, company number BE 0698.645.666, email info@offacto.com.
For questions about your data, you can always email info@offacto.com. We respond within one month, and usually much faster.
2. What data do we process?
Contact and demo form: first name, last name, email address, company (optional), subject, your message, and the page where you filled out the form.
Platform account: name, email address, company details (name, address, company number, VAT number, IBAN), login and subscription invoice details.
Data you enter yourself into Offacto, such as customers, quotes, invoices, briefings, work hours, and documents. For this, we act as a processor on your behalf; see point 6.
Technical data: server logs with IP address, browser, and timestamp, required for security. For form spam protection, we store only an encrypted (hashed) version of your IP address for a maximum of 24 hours.
3. Why and on what legal basis?
To answer your question or demo request (pre-contractual measures and justified interest).
To provide, invoice, and support your account and subscription (performance of the contract).
To comply with legal obligations, such as the accounting retention requirement for invoices (legal obligation).
To secure the platform and website against misuse and spam (legitimate interest).
To inform you, as a customer, about important changes or new features of Offacto. You can unsubscribe with one click at any time (legitimate interest or consent).
4. How long do we retain your data?
Messages via the contact form: up to 180 days, unless a customer relationship follows.
Account data: as long as your account is active, and for an additional 12 months to allow you to export your data.
Invoices and accounting documents: 10 years, as required by law.
Security logs: up to 6 months.
5. Who do we share data with?
We never sell your data. We only work with processors who are contractually obligated to confidentiality and security:
- Hosting and backups in a data center in Amsterdam (EU);
- the email service we use to send confirmations and invoices;
- Mollie, for online payments;
- a Peppol access point, to send and receive e-invoices;
- AI and text recognition services for the AI features in Advanced. These services do not use your data to train their models.
If data is processed outside the European Economic Area, this only happens with appropriate safeguards, such as an adequacy decision or the standard contractual clauses of the European Commission.
6. Data of your customers
Data you enter into Offacto about your customers is processed exclusively on your behalf and according to your instructions. You remain the data controller for this. The agreements are outlined in our data processing agreement, which is part of the general terms and conditions.
Only you have full access to your data. Offacto employees will only access your data if you explicitly request it, for example, for support.
7. Offacto vzw (offline app)
The Offacto vzw app stores all data locally on your own computer or in a folder of your choice. Offacto does not have access to this. The app only makes a network connection for functions that require it, such as sending via Peppol or searching in the KBO, and only when you use them.
8. Security
We secure your data with encryption during transmission (HTTPS) and storage, daily backups, access management, and regular updates. Passwords are never stored in plain text.
9. Your rights
You have the right to access, rectification, erasure, restriction, portability, and objection. If you have given consent, you can withdraw it at any time. Send your request to info@offacto.com. We may ask you to confirm your identity.
If you are dissatisfied with how we handle your data, you can file a complaint with the Data Protection Authority, Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.
10. Changes
We may update this privacy policy. The latest version is always available on this page. For significant changes, we will notify customers via email.
Last updated: October 18, 2026