How we handle personal data
This privacy statement explains which personal data BIQS IT BV processes when you visit our website, request a trial period or a demo, are a BIQSDRIVE customer or contact our support, why we do so, how long we keep the data and what rights you have.
1. Who are we?
BIQSDRIVE is a product of BIQS IT BV, Kolmen 35 box 1, 3980 Tessenderlo-Ham, enterprise number and VAT BE 0899.469.023, RLE Antwerp, Hasselt division (hereinafter BIQSDRIVE, we or us).
For all questions about privacy and to exercise your rights: privacy@biqsdrive.com. We have not appointed a data protection officer, because we are not required to do so.
2. Two roles: controller and processor
| Role | For which data | Who decides |
|---|---|---|
| Controller | Data of website visitors, prospects and webinar participants, customer contact persons, users of the Platform (their account, support and communication) and billing data | BIQSDRIVE. This privacy statement covers this data. |
| Processor | Data that driving schools and training centres enter in BIQSDRIVE 27 about their students, trainees, instructors and business customers, and payment data, such as the amount, date, payment reference, and the name and account number of the payer | The driving school or the training centre. We only process that data on their behalf, in accordance with the Data Processing Agreement (Annex C to the Subscription Agreement). |
Are you a student or a trainee? Then please address your questions about your data first to your driving school or training centre. If you send us a request, we will forward it to them within five working days and help them to answer it. If you pay through a payment link or a terminal, Pay. processes your payment data; Pay. itself is responsible for executing the payment.
3. What data, for what purpose and for how long?
| Situation | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Visiting the website | IP address, browser and device data, pages visited, time; cookies as described in our cookie policy; your cookie choice (with a random code, without IP address) | Operation and security of the website; proof of your cookie choice; with your consent, also statistics and marketing | Legitimate interest (operation, security and proof of your choice); consent (non-essential cookies) | Server logs: 12 months. Cookies: see the cookie policy. Your cookie choice: for as long as it applies and then up to 3 years |
| Contact form, demo request or waiting list | Name, organisation, job title, email address, phone number, your question or message | Answering your question, organising the demo, informing you about the launch | Steps taken at your request before entering into a contract; legitimate interest | 2 years after the last contact |
| Registering for a webinar | First name, surname, email address, organisation, whether you are already a customer, your question for the Q&A session | Organising the webinar and sending you the link to the recording afterwards, also if you could not attend. If you cancel your registration, we do not send you the recording. | Steps taken at your request before entering into a contract; legitimate interest | 2 years after the last contact |
| Trial period and order | Contact details of the applicant, company details, chosen subscription, record of the acceptance (time, IP address, version of the terms, who accepted, the text of the checkbox and the statement about the national register number) | Concluding and performing the agreement; proof of the acceptance | Performance of the contract (if you are the customer yourself); otherwise our legitimate interest, also for the proof | Duration of the agreement and 10 years thereafter. Trial period not activated: contact details of the applicant 2 years after the end of the trial; we erase the data in the trial environment in accordance with Article 3.10 of the Subscription Agreement. |
| Customer relationship and user accounts | Name, email address, phone number, job title and role of contact persons and users; login data | Account management, access to the Platform, communication about the service | Performance of the contract (if you are the customer yourself); otherwise our legitimate interest | Contact persons: duration of the agreement and 10 years thereafter. User accounts and logins: until the account is deleted, at the latest at the erasure after the retrieval period |
| Billing and payment | Billing and company details, invoices, payment status, details of the payment instrument (stored as a token by our payment service provider) | Billing, collection, accounting | Performance of the contract; legal obligation (accounting and VAT legislation) | 10 years (accounting and VAT legislation) |
| Signing up for a Pay. account | Company and contact details of your organisation needed to apply for a payment account | At your organisation's request, we provide Pay. with the company and contact details needed to apply for a payment account | Performance of the contract (if you are the customer yourself); otherwise our legitimate interest | Like the data of the customer relationship: duration of the agreement and 10 years thereafter. Pay. keeps the data it receives in accordance with its own privacy statement |
| Support: tickets and AI support agent | Name and email address of the user, content of the question, the conversation and attachments | Providing support, solving problems, improving the quality of support | Performance of the contract (if you are the customer yourself); otherwise our legitimate interest | Tickets: 3 years after closure. Conversations with the AI support agent: 12 months (at Anthropic, up to 30 days by default, and up to 2 years if abuse is flagged). Data of students or trainees in tickets or conversations: at the latest until the end of the customer's retrieval period |
| Security of the Platform | IP address, login attempts, user activity logs | Security, fraud prevention, evidence in the event of incidents | Legitimate interest | 12 months, longer in the event of an ongoing incident |
| Newsletter and commercial messages | Name, email address, organisation, whether you open or click a message | Informing you about new features, webinars and offers | Consent; for customer contact persons, our legitimate interest for similar services | Until you unsubscribe; click and open data: 2 years |
Legal bases. Performance of the contract is the legal basis when you are our customer yourself. If you are a contact person or user at a customer, we rely on our legitimate interest to conclude and perform the agreement with your organisation, to secure the Platform, to provide support, to keep proof of the acceptance and to inform our customers about similar services. We receive the data of users from the organisation that creates their account.
Do you have to provide this data? We need the data marked as mandatory to answer your question, to conclude and perform the agreement with your organisation, to give you access to the Platform and to comply with our legal obligations. Without that data, we cannot do so. You provide any other data voluntarily.
We do not use your data for automated decision-making that has legal effects or similarly significant effects on you, and we do not sell it.
4. The AI agents
BIQSDRIVE 27 works with AI agents: the support agent, the admin agent and the planning agent. They use artificial intelligence (language models from Anthropic). So when you chat with an agent, you are talking to an AI and not to a member of staff. The support agent answers questions about using BIQSDRIVE and looks up data for this within your permissions; the admin agent and the planning agent flag issues and make suggestions. The agents do not make decisions about you: a member of staff decides. If you want to speak to a member of staff, create a support ticket.
For your questions to the support agent and its answers, together with your name and email address, we are the controller (see section 3, support). We process the data of students, trainees and business customers that the agents look up in the Platform to answer a question or make a suggestion as a processor on behalf of the driving school or the training centre (see section 2). Anthropic is our sub-processor for this: see www.biqsdrive.com/en/sub-processors.
- Anthropic does not use the conversations to train its models.
- The conversations are processed in the United States, with the standard contractual clauses of the European Commission as a safeguard (see section 6).
- Do not share any data in a conversation that is not needed for your question, and certainly no sensitive data about students or trainees.
5. Who do we share data with?
We only share personal data where this is necessary for the purposes above, with parties that are contractually bound to protect it:
| Recipient | Purpose | Location |
|---|---|---|
| Level 27 BV (Hasselt) | Hosting of the Platform | Belgium |
| Odoo SA (Grand-Rosière) | Customer management, helpdesk and billing | Belgium and France; backups in France, the Netherlands and Sweden |
| Anthropic Ireland, Limited, with Anthropic PBC | AI support agent | United States |
| Our payment service provider (named on the payment page of the Account) | Collection of payments | European Economic Area |
| Isabel NV (Ponto), Brussels | The bank connection for the payment automation of driving schools and training centres, as a sub-processor, and the tasks Isabel NV performs itself as a payment institution | See the Isabel NV privacy statement |
| Pay. (TinTel B.V.), Spijkenisse | Your organisation's application for a payment account; online payments, SoftPOS and payment terminals for driving schools and training centres, as a sub-processor, and the tasks Pay. performs itself as a payment institution | See the Pay. privacy statement |
| Intuit Mailchimp | Sending newsletters and invitations | United States |
| Microsoft (Teams) | Organising webinars | European Union and United States |
| Adobe (Adobe Fonts) | Delivering the website's typeface: Adobe receives your IP address to deliver the typeface, does not store it and does not place cookies | United States |
| Suppliers of statistics and marketing services (such as Google) | Only with your consent, once we use such services; the current list is in our cookie policy | United States and European Economic Area |
| LinkedIn Ireland Unlimited Company (Dublin), with LinkedIn Corporation | Once we use the LinkedIn Insight Tag, and only if you give consent for LinkedIn (marketing cookies) in the cookie settings: the LinkedIn Insight Tag on our website measures whether our advertisements on LinkedIn lead to a visit or request and lets us show advertisements to visitors of our website. For this, LinkedIn receives, among other things, the web address of the page visited, the page you came from, your IP address, data about your device and your browser, the time and your actions on the page (such as clicking buttons and submitting forms). We are jointly responsible with LinkedIn for collecting and transmitting that data through our website; for what LinkedIn then does with the data, including for its own purposes, LinkedIn Ireland Unlimited Company is itself the controller, in accordance with its privacy policy. LinkedIn deletes data that directly identifies members within seven days and the remaining, pseudonymised data within 180 days. We only receive reports from LinkedIn that do not identify you. | United States |
| Our accountant, lawyers and other advisers | Accounting, legal advice | Belgium |
| Government authorities and judicial bodies | Only where the law requires us to | Belgium |
The suppliers that process data of students and trainees on behalf of driving schools and training centres are listed at www.biqsdrive.com/en/sub-processors.
6. Transfers outside the European Economic Area
Some recipients process data in the United States (see section 5). We only do this with appropriate safeguards under the GDPR: for Anthropic, the standard contractual clauses of the European Commission; for Intuit Mailchimp, Microsoft and Adobe, their certification under the EU-U.S. Data Privacy Framework; and for LinkedIn, once we use the LinkedIn Insight Tag, the certification of LinkedIn Corporation under the EU-U.S. Data Privacy Framework and the standard contractual clauses of the European Commission. For suppliers of statistics and marketing cookies, the cookie policy states the safeguard that applies. You can request a copy of those safeguards at privacy@biqsdrive.com.
For the location of the processing by Isabel NV and Pay. and any transfer outside the European Economic Area, we refer to their own privacy statements: the Isabel NV privacy statement and the Pay. privacy statement.
7. Security
We protect personal data with appropriate technical and organisational measures, such as encrypted connections (TLS), encryption of databases and backups, personal access rights with multi-factor authentication for administrators, logging, regular updates and backups at a separate location. If you notice a security problem, please report it to privacy@biqsdrive.com.
8. Your rights
You have the right to:
- access your data and obtain a copy of it;
- have incorrect data rectified;
- have your data erased, unless we are required to keep it (for example invoices);
- have the processing restricted;
- receive your data in a commonly used format or have it transmitted to another party (data portability);
- object to processing based on our legitimate interest, and always to direct marketing;
- withdraw your consent at any time, without this making the earlier processing unlawful.
Send your request to privacy@biqsdrive.com. We will reply within one month; for complex requests, this period may be extended by two months, in which case we will let you know. We may ask you to prove your identity. You can also unsubscribe from the newsletter using the link at the bottom of every email.
If you are not satisfied, you can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.
9. Cookies
We use strictly necessary cookies and similar technologies to make the website work. We only place statistics and marketing cookies with your prior consent, through the cookie banner that appears once we use such cookies. Refusing is as easy as accepting. Once we use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company (see section 5), we only load it if you give consent for LinkedIn in the cookie settings. LinkedIn then places cookies on our domain and on its own domain (linkedin.com). If you withdraw your consent for LinkedIn, we no longer load the Insight Tag and we remove the LinkedIn cookies on our domain; you can remove the cookies on the LinkedIn domain in your browser. If you are a LinkedIn member, you can also decide how LinkedIn uses your data for advertising in your advertising preferences on LinkedIn; without a LinkedIn account, you can do so through the LinkedIn settings for guests. Which cookies we use, for what purpose and for how long is explained in our cookie policy at www.biqsdrive.com/en/cookie-policy. The cookies that Pay. places on the payment page built into the BIQSDRIVE 27 portals are also described in the cookie policy. You can change or withdraw your choice at any time through "Cookie settings" at the bottom of every page.
10. Minors
Our website and our commercial communication are aimed at businesses and not at minors. We only process data of students who are minors on behalf of their driving school or training centre, as a processor (see section 2).
11. Changes
We may amend this privacy statement, for example when we add a new service or a new supplier. The date of the latest version is shown at the top. We notify customers of significant changes by email.
Contact
Privacy questions: privacy@biqsdrive.com. Other questions: info@biqsdrive.com. BIQS IT BV, Kolmen 35 box 1, 3980 Tessenderlo-Ham, enterprise number and VAT BE 0899.469.023, RLE Antwerp, Hasselt division.