Privacy Policy

← Back to Passeport Maison

This Privacy Policy explains how Eighty6 SRL ("we", "us", "our") collects, uses, and protects your personal data when you use the Passeport Maison mobile application (the "App"). We take your privacy seriously and comply with the EU General Data Protection Regulation (GDPR) and applicable Belgian law.

1. Data controller

Company

Eighty6 SRL

Address

Ch. de Nivelles 337, 6238 Liberchies, Belgium

Business number

BE0662541276

Privacy contact

privacy@eighty6.be

2. What data we collect

2.1 Account data

When you create an account, we collect:

• Your email address
• A securely hashed password (we never store your password in plain text)
• An optional display name

2.2 Content you upload

Documents and files you choose to upload to the App (for example: purchase deeds, energy certificates, invoices, photographs of your property), along with any metadata you attach to them (titles, categories, tags, dates).

2.3 Technical data

When you use the App, our servers may automatically log technical information such as IP address, device type, operating-system version, App version, and timestamps of requests. This is used for security and troubleshooting purposes only.

2.4 Data we do not collect

• We do not use third-party advertising trackers.
• We do not sell your data — ever.
• We do not profile you for commercial purposes.

3. Why we process your data (legal basis)

To provide the service (Article 6(1)(b) GDPR — performance of a contract)

Managing your account and storing the documents you upload.

Security and abuse prevention (Article 6(1)(f) — legitimate interest)

Keeping technical logs, detecting fraud or unauthorised access.

Legal obligations (Article 6(1)(c))

Retaining data where required by law (e.g. accounting records).

4. Where your data is stored

Your account data and uploaded documents are stored on infrastructure provided by Supabase, located in the European Union (Frankfurt, Germany — eu-central-1 region). Access to your documents is strictly isolated per user through Row Level Security (RLS).

Supabase Inc. is a company incorporated in the United States. Although your data is physically stored within the EU, we disclose this relationship in the interest of full transparency. Supabase acts as our data processor under a Data Processing Agreement (DPA).

5. Who has access to your data (processors)

Supabase Inc.

Database and file storage (hosting region: EU — Frankfurt).

Apple Inc. / Google LLC

App distribution through the App Store and Google Play. Apple and Google may collect technical analytics relating to app downloads and crashes, under their own policies.

Eighty6 SRL staff

Only authorised personnel may access production systems, for maintenance and support purposes, under strict confidentiality.

We do not share your data with advertisers, data brokers, or any party not listed above.

6. International transfers

Your data remains in the European Union. Where a processor is based outside the EU (e.g. Supabase Inc. for administrative purposes), transfers are governed by the European Commission's Standard Contractual Clauses or equivalent safeguards.

7. How long we keep your data

Account and documents

For as long as your account is active.

After account deletion

All account data and uploaded documents are permanently deleted within 30 days of the deletion request. Backups are purged on rolling cycles of up to 90 days.

Technical logs

Retained for a maximum of 12 months.

8. Your rights under GDPR

As a data subject, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your account and data (see Delete my account).
• Restriction — ask us to limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent.

To exercise any of these rights, contact privacy@eighty6.be. We will respond within 30 days.

9. Supervisory authority

If you believe we have mishandled your data, you have the right to lodge a complaint with the Belgian Data Protection Authority:

10. Security

We apply industry-standard technical and organisational measures to protect your data, including encrypted connections (TLS), per-user access controls (RLS), password hashing, and restricted administrative access. Despite our efforts, no system is completely secure; we will notify you and the supervisory authority in the event of a data breach, as required by GDPR.

11. Children

Passeport Maison is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us so we can delete it.

12. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will always indicate the latest version. For significant changes, we will notify you through the App or by email.

13. Contact

For any privacy-related question: privacy@eighty6.be.
For general support: support@eighty6.be.