Privacy Statement

Version 1.0, applicable from the date of publication on this website

In short

This summary is not binding: only the articles below apply.

• The Software sends us nothing. There is no telemetry and no phone-home.
• The website sets no tracking cookies. We measure visitor statistics with Tracera, our own cookieless analytics, without storing IP addresses and without profiles.
• We process only the data we need to answer your questions, handle evaluations and orders, provide support and comply with the law.
• We do not sell data, do not build profiles and do not use your data to train AI models.
• You can access, correct or delete your data via privacy@arnodiqa.com.

1. Who is responsible?

1.1 The controller is GoTrust bv, Morelgem 24b, 9520 Vlierzele (Sint-Lievens-Houtem), Belgium, enterprise number 1037.576.138, VAT BE1037.576.138, RPR Gent, afdeling Oudenaarde (Register of Legal Entities, Ghent, Oudenaarde division) (GoTrust, we).

1.2 For privacy questions: privacy@arnodiqa.com or by post to the address above. GoTrust has not appointed a data protection officer, as this is not mandatory for its activities.

1.3 This statement provides the information required by art. 13 and 14 of Regulation (EU) 2016/679 (GDPR).

2. Principles

2.1 The Software processes nothing for us. The Software sends no data to GoTrust and makes no connection to GoTrust (art. 10 EULA). Log files and crash reports stay on your systems.

2.2 Support bundles are created and sent by you. For the personal data they contain, we process the data on behalf of your company, as a processor (art. 3.6).

2.3 No tracking cookies. The website does not place cookies or similar technologies for analytics, advertising or tracking. We measure visitor statistics without cookies (art. 12.2). If the website uses a cookie that is strictly necessary to provide a function you requested, such as remembering a language choice, no consent is required for it (art. 10/2 Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data). Art. 12 describes which data the website keeps locally in your browser.

2.4 We do not sell personal data, do not build profiles, do not take automated decisions within the meaning of art. 22 GDPR and do not use personal data to train AI models.

3. Which data, why and for how long

3.1 Visiting the website and downloads

• Data: IP address, date and time, requested page or file, browser and operating system (user agent), referring page.
• Purpose: delivering the website technically, detecting and preventing misuse and attacks.
• Legal basis: our legitimate interest in a secure website (art. 6(1)(f) GDPR).
• Retention: 14 days; longer only for the log entries of a specific security incident, for as long as that incident is being investigated.
• No registration is required for a download.

3.2 Contact via the contact form or by e-mail

• Data via the form: name, company, e-mail address, telephone number (optional), subject (evaluation, quotation, support or other), your message, the language of the form, and the IP address and time of sending.
• Data by e-mail: name, business e-mail address, company, job title (optional), your message.
• Purpose: answering and following up your question; for a request for an evaluation or quotation, preparing it. We use the IP address and time only to prevent misuse and spam (at most 5 messages per hour per IP address).
• Legal basis: for a request for an evaluation or quotation: steps taken at your request prior to entering into a contract (art. 6(1)(b) GDPR). For other questions and for spam protection: our legitimate interest in answering business enquiries and securing the form (art. 6(1)(f) GDPR).
• Retention: messages sent via the form 12 months after the last contact, messages sent by e-mail 24 months after the last contact, unless an evaluation (art. 3.3) or an agreement (art. 3.4) results. The IP address used for spam protection is deleted after 1 hour.
• Recipients: the form is processed on our own server in the European Union and delivered as an e-mail to our own mailbox. We use no form service, no captcha and no other third parties.

3.3 Request for an evaluation licence

• Data: name, business e-mail address, company, country, and optionally job title and intended use. Name, e-mail address, company and country are mandatory; without them we cannot provide an evaluation licence or carry out a check under the sanctions rules.
• Purpose: providing the evaluation licence, carrying out the sanctions check under art. 3.7, and contacting you during and shortly after the evaluation about your experience.
• Legal basis: our legitimate interest in handling and following up your company's request (art. 6(1)(f) GDPR). You can object to the follow-up at any time; we will then no longer contact you about the evaluation.
• Retention: 24 months after the end of the evaluation, if no purchase follows.

3.4 Quotations, orders and invoicing

• Data: name, business contact details and job title of the customer's contact persons, order and invoicing data.
• Purpose: preparing quotations, performing orders, invoicing, following up payments.
• Legal basis: our legitimate interest in performing the agreement with the contact person's company (art. 6(1)(f) GDPR), and for accounting a legal obligation (art. 6(1)(c) GDPR).
• Retention: invoices and other accounting records for 10 years, the tax retention period since the Belgian Act of 20 November 2022 containing various tax and financial provisions (including art. 60 Belgian VAT Code), counted from 1 January of the year following the year or financial year to which they relate. This also covers the 7-year accounting period (art. III.88 Belgian Code of Economic Law). Other data: for as long as the customer relationship lasts and 5 years thereafter.

3.5 Licence management

• Data: the company holding the licence, the contact person, the licence type, the licence file and, for a node-locked licence, the machine fingerprint the customer provides to us.
• Purpose: providing and replacing licence files, and processing licence transfers.
• Legal basis: our legitimate interest in managing our customers' licences (art. 6(1)(f) GDPR).
• Retention: for as long as the licence exists and 5 years thereafter, because a perpetual licence may still require a replacement licence file years later.

3.6 Support

• Data: name and business contact details of the person submitting the support request, and the content of the request.
• Purpose: handling the support request.
• Legal basis: our legitimate interest in providing support to the requester's company (art. 6(1)(f) GDPR).
• Retention: 36 months after the request is closed, to recognise recurring problems.
• Support bundles and other customer files: personal data in them (for example user names in log files) is processed by us as a processor, on the customer's instructions (Annex A to the General Terms of Sale). We delete it 90 days after the request is closed. For that data, you can also contact your employer.

3.7 Checks under the sanctions rules

• Data: company name, country and the names of the contact persons.
• Purpose: verifying whether a delivery would breach the export rules or the sanctions rules of the European Union.
• Legal basis: a legal obligation (art. 6(1)(c) GDPR), in particular the prohibitions in Regulation (EU) No 833/2014 and Regulation (EC) No 765/2006, and our legitimate interest in demonstrably complying with those rules (art. 6(1)(f) GDPR).
• Retention: 5 years after the check.

3.8 Security advisories by e-mail

• Data: business e-mail address.
• Purpose: informing you about vulnerabilities and Security Updates.
• Legal basis: for the list you sign up to yourself: your consent (art. 6(1)(a) GDPR). You can withdraw it at any time via the link in each message or via privacy@arnodiqa.com. We send a message about an actively exploited vulnerability or a severe security incident affecting your company's Software to customers' contact persons on the basis of a legal obligation (art. 6(1)(c) GDPR; art. 14(8) Regulation (EU) 2024/2847); you cannot unsubscribe from those messages.
• Retention: for the list: until you unsubscribe; for customers' contact persons: as in art. 3.5.
• We do not send newsletters or advertising without your prior consent.

3.9 Disputes. If there is a dispute, we keep the data needed for it until the dispute has been finally resolved, on the basis of our legitimate interest in defending our rights (art. 6(1)(f) GDPR).

3.10 Mandatory data. The invoicing data in art. 3.4 is required by law. You are not legally obliged to provide other data, but without the data marked as mandatory in art. 3.3, or without contact details, we cannot handle an evaluation, quotation, order, licence file or support request.

4. Source of the data

We usually obtain the data from you. Sometimes we receive it from your employer or a colleague, for example if you are named as a contact person in an order, or from a reseller selling the Software to your company. This concerns the data in art. 3.4 to 3.6.

5. Recipients

5.1 We disclose personal data only to: (a) service providers processing it for us: our e-mail service (e-mail and storage), our accounting and invoicing software (invoicing) and our Peppol service provider (sending electronic invoices); (b) our accountant and, in a dispute, our lawyer, who are bound by confidentiality; (c) a carrier, if you request delivery on a data carrier; (d) a public authority, if the law requires us to.

5.2 We have concluded a data processing agreement with each service provider under art. 5.1(a) (art. 28 GDPR).

5.3 The website runs on GoTrust's own server in the European Union. The data in art. 3.1 is processed there.

6. Transfers outside the European Economic Area

We process personal data in the European Economic Area. Any transfer to a country outside the European Economic Area takes place only on the basis of an adequacy decision of the European Commission (art. 45 GDPR) or appropriate safeguards, such as the European Commission's standard contractual clauses (art. 46 GDPR). On request, we provide a copy of those safeguards.

7. Security

We protect personal data with appropriate technical and organisational measures (art. 32 GDPR), such as encryption, access control with strong authentication and deletion of data after the retention period.

8. Your rights

8.1 You have the right of access (art. 15 GDPR), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18) and data portability (art. 20). You have the right to object to processing based on our legitimate interest (art. 21). You can withdraw consent at any time, without affecting processing before the withdrawal.

8.2 Send your request to privacy@arnodiqa.com. We respond within one month of receipt (art. 12(3) GDPR). If we have doubts about your identity, we may ask for additional information.

8.3 If the request concerns data in a support bundle or another file of your employer, your employer is the controller. We then forward your request to your employer and help it respond.

9. Complaints

You can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, GBA; Autorité de protection des données, APD), Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be (art. 77 GDPR). We would appreciate it if you contacted us first, so that we can solve the problem.

10. Changes

We update this privacy statement when our processing changes. The date of the version is shown at the top. In the event of a material change, we inform the customers with whom we have an ongoing relationship.

11. Language

This privacy statement exists in Dutch, French and English. If their meaning differs, the Dutch version prevails.

12. Cookies and local storage

12.1 The website uses no tracking cookies, no marketing cookies, no advertising and no third-party services.

12.2 Visitor statistics. To see how the website is used, we count page visits with Tracera, a cookieless analytics service that GoTrust bv develops itself and hosts in Belgium. On a page visit, Tracera receives the address of the page, the referring page, the size of the browser window, the time and clicks on links to other websites. Tracera sets no cookies, stores nothing in your browser, does not store your IP address and builds no profiles. We only see totals per page and per period. Legal basis: our legitimate interest in improving the website (art. 6.1.f GDPR). There are no other recipients.

12.3 The website stores only what is strictly necessary to remember the choices you make yourself: your language choice, your choice of a light or dark theme and your choice in the cookie banner. This data is kept in your browser's local storage (localStorage), is not sent to us and is kept for no more than 12 months. No consent is required for this storage (art. 2.3).

12.4 More details are on the Cookies page.