Privacy & Cookies

Below is the fully updated Privacy & Cookie Policy, including an embedded, enterprise-grade Data Processing Addendum (DPA), and structured for B2B SaaS and mobile apps. It complies with GDPR and reflects best practices such as Teamleader’s approach, including a reference to the subprocessor list available in-tool (account area).

Equicty Privacy & Cookie Policy

Last updated: 01/08/2025
Equicty NV, Holstraat 87 bus 11, B-8790 Waregem (Belgium)
VAT: BE 0642.995.182 | Email: hello@equicty.com

1. Privacy Statement

1.1 General

Equicty NV (“Equicty”, “we”, “us”) respects your privacy and complies with the Belgian Data Protection Act and the General Data Protection Regulation (EU) 2016/679 (“GDPR”). This policy applies to our website, mobile apps, and SaaS platform.

By creating a (trial) account or using our services, you accept this Privacy Policy.

1.2 Personal Data We Process

We collect and process the following types of personal data:

• Identity: name, email, phone number, VAT number (for billing), company name
• Authentication: username, password
• Communication: support tickets, email, chat
• Usage: browser type, pages visited, actions in the platform
• App data: device information, session logs
• Horse-related data: stable information, user-generated input

We also gather information via cookies (see section 2).

1.3 Why We Process Your Data

We use your data to:

• Provide and maintain our platform and services
• Communicate with you regarding support, updates, or marketing
• Facilitate user onboarding, trial activation, and customer success
• Improve our platform through analytics and AI insights (with zero data retention)
• Fulfill contractual and legal obligations

1.4 Legal Bases

We process your data based on:

• Contractual necessity
• Legitimate interest (e.g. security, fraud prevention)
• Legal obligations
• Consent (where required, e.g. marketing)

1.5 Who Has Access to Your Data

We only share your data when strictly necessary:

• With cloud service providers (GCP, Firebase)
• With subprocessors listed in your account under Settings > Subprocessors
• With legal or public authorities, if required

All subprocessors are bound by data processing agreements ensuring GDPR compliance.

1.6 International Data Transfers

All personal data is hosted in the EU. If transferred outside the EEA, appropriate safeguards such as Standard Contractual Clauses (SCCs) will apply.

1.7 Data Retention

• Active accounts: data is retained for the duration of the contract
• End of contract: data is soft-deleted after 90 days, permanently deleted within 180 days
• AI data: no data is retained (zero retention policy)
• Legal/accounting data may be kept for 7 years as required

1.8 Your Rights

You may request to:

• Access, rectify, or delete your personal data
• Restrict or object to processing
• Export your data (data portability)
• Withdraw your consent (where applicable)

Send requests to privacy@equicty.com. Proof of identity may be required.

2. Cookie Policy

2.1 What Are Cookies?

Cookies are small files stored on your device to track usage and improve user experience. You can manage or disable cookies via your browser settings.

2.2 Types of Cookies We Use

2.3 Managing Cookies

You can disable or delete cookies through your browser settings. This may affect functionality.

3. Data Processing Addendum (DPA)

This DPA forms part of the Privacy Policy and Terms of Service. It governs the processing of personal data Equicty performs on behalf of its business clients.

3.1 Roles

• Controller: You, the business customer
• Processor: Equicty NV

3.2 Scope of Processing

3.3 Subprocessors

Equicty may use subprocessors for hosting, analytics, or integrations.
📍 You can view the latest subprocessor list within your account at:
Account Settings > Compliance > Subprocessors

You will be notified of any material changes. You have 10 days to raise objections.

3.4 Transfers Outside EEA

Transfers outside EEA, if any, are subject to Standard Contractual Clauses (SCCs) or adequacy decisions.

3.5 Security Measures

Equicty implements technical and organizational measures including:

• EU-based hosting (GCP)
• Encryption in transit
• Access control & audit logs
• Backup & disaster recovery
• DDoS & vulnerability monitoring

For details, see Schedule 2 (available upon request).

3.6 Data Subject Assistance

Equicty assists Controllers in handling requests from data subjects (access, erasure, etc.).

3.7 Breach Notification

In case of a personal data breach, Equicty will:

• Notify the Controller without undue delay
• Provide incident reports and support mitigation

3.8 Audit Rights

You may audit Equicty’s compliance once per year with reasonable notice. Equicty may charge for excessive requests.

3.9 End of Processing

Upon termination, Equicty will:

• Retain data for 90 days (soft delete)
• Permanently delete data within 180 days
• Retain anonymized data (if applicable) for analytics

4. Updates

We may update this policy periodically. You will be notified of material changes via email or in-app notice. Please review this page regularly.

If you have any questions or concerns, contact us at privacy@equicty.com or by mail:

Equicty NV
Holstraat 87 bus 11
B-8790 Waregem, Belgium