Privacy policy

Translation provided for information. Only the French version is binding.

Last updated: 3 October 2026

1. Who are we?

BizKick is a service published by Cabinet Comptable et Fiscal Vandenryt (CCFV), a private limited company under Belgian law, registered with the Crossroads Bank for Enterprises under number 0734.689.183 (VAT BE 0734.689.183), with its registered office at Chaussée Brunehaut 171, 4450 Juprelle (Belgium).

CCFV is the controller of your data. For any question about this policy or your data: contact@bizkick.be.

As a firm that is a member of the ITAA, CCFV is also bound by professional secrecy; your data and files are handled with the confidentiality this requires.

2. What data do we collect?

Account and authentication: your email address; the authentication method used (magic link, Google or Microsoft); the technical identifier provided by the identity provider; your first and last name when the identity provider provides them and you allow it. We collect only the information needed to create and secure your account.
Files: the content of the financial plans you create (figures, assumptions, notes).
Collaboration: when you invite someone to work on a file, the email address you enter, the role you assign and the status of the invitation (pending, accepted); when they accept, their access to the file. To prevent abuse, we also keep a log of invitations sent, which does not contain the invited person's address: only the inviting account, the file and the date sent.
If you were invited: your email address was given to us by the user inviting you, for the sole purpose of sending you their invitation and giving you access to the file concerned.
Technical data: information strictly necessary for the operation and security of the service.
Payments: when you make a purchase (one-time purchase or subscription), billing data (name, address, VAT number) is processed through our payment and invoicing providers. For each payment, we keep its amount, the product bought and the proof that you accepted the terms of sale (version and language of the accepted text, reference of the payment session); we send you the confirmation by email. BizKick stores no bank card data.
Advertising measurement: only if you accept it, the information described in Article 10.

3. Why, and on what basis?

We process this data to: provide the service (performance of the contract), secure accounts (legitimate interest), enable collaboration on a file, including sending invitations and preventing abuse (legitimate interest of the inviting user and of BizKick), invoice your purchases and keep proof that you accepted the terms of sale (legal obligation, performance of the contract and legitimate interest), and, if you accept it, measure the effectiveness of our advertising (consent, which you may withdraw at any time).

Your files and the data you enter in them are never sold, used for advertising or commercial profiling, nor used to train artificial intelligence models. When a feature uses automated processing, it serves only to provide the service you requested.

4. Where is the data hosted and who processes it for us?

Your accounts and files are hosted on Supabase infrastructure, in a data centre located in the European Union (Central EU — Frankfurt, Germany), with encryption in transit (HTTPS) and separation by user: each user can only access their own files and the files another user has shared with them, with the role they were given.

We use the following processors, strictly for the operation of the service:

Supabase — database and authentication (hosted in the EU);
Vercel — hosting of the application (the website);
Resend — sending the service's emails: sign-in links, collaboration invitations, review completion notices, purchase confirmations, and the summary of each payment sent to our invoicing department, which states the customer's email address (the recipient's address is passed to it to deliver the message);
Stripe Payments Europe Ltd — payment processing and subscription management;
Odoo — issuing and managing invoices;
OVH — domain name and routing of contact emails.

If you accept advertising measurement (Article 10), Google Ireland Limited receives the information described there, as an independent controller: its processing is governed by its own privacy policy. No data from your files is passed to it.

Some of our providers may belong to groups established outside the European Economic Area or use processors located in third countries. Where personal data may be transferred outside the European Union, such transfers are governed in accordance with the GDPR, in particular by: the Standard Contractual Clauses approved by the European Commission; an adequacy decision of the European Commission where one exists (including the EU–US Data Privacy Framework for providers certified under it); or any other appropriate safeguard provided for by the GDPR. You can obtain more information about these safeguards by contacting us at the address given in this policy.

5. Third-party authentication

When you choose to sign in with Google or Microsoft, these providers send us certain identification information from your account (such as your email address, your name or a unique identifier), in accordance with the permissions you grant them. Google Ireland Limited and Microsoft Ireland Operations Limited act in this respect as independent controllers: their processing is governed by their own privacy policies.

BizKick never accesses your emails, files, contacts, calendars or other data of your Google or Microsoft account and requests no permissions other than those strictly necessary for authentication.

6. Data security

The security and confidentiality of your data are a priority. We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction or accidental disclosure, in particular:

encryption of communications via HTTPS/TLS;
access control and user authentication;
separation of data between users;
regular data backups;
monitoring and logging of security events;
regular updates of the components and infrastructure used.

Despite these measures, no computer system can guarantee absolute security.

7. How long?

We keep your personal data for as long as necessary to provide the service and meet our legal obligations.

Data relating to your account and your files is kept as long as your account remains active. An account that has been inactive for a long period may be deleted after prior notice.
If your account is deleted (at your request via contact@bizkick.be), your files and associated data are deleted or anonymised within a maximum of 30 days, unless a legal obligation requires otherwise. Your data may remain temporarily in our backups, which are deleted according to their normal rotation cycle.
Billing data and accounting documents are kept for the period required by the applicable tax and accounting legislation (currently up to 10 years in Belgium). Proof that you accepted the terms of sale is kept with them.
Your choice regarding advertising measurement is kept in your browser until you change it or clear the site's data.
A collaboration invitation that has not been accepted expires after 7 days; it is deleted 30 days after it expires. An accepted invitation is kept as long as the invited person has access to the file; it is deleted no later than the day after that access ends (removal by the owner or departure of the invited person). A file's invitations are deleted with it. The log of invitations sent is kept for 30 days.
Technical and security logs are kept for a limited period, strictly necessary for the security of the service and the resolution of incidents.

8. Your rights (GDPR)

You have the rights of access, rectification, erasure, portability, restriction and objection, and may withdraw any consent given at any time (Article 10), without affecting what was done before. Send your request to contact@bizkick.be. You may also lodge a complaint with the Belgian Data Protection Authority (Rue de la Presse 35, 1000 Brussels).

9. Data protection officer

BizKick is not currently required by law to appoint a data protection officer (DPO). For any question about the processing of your personal data or the exercise of your rights, you can contact us directly at: contact@bizkick.be.

10. Cookies, local storage and advertising measurement

The service uses your browser's local storage (“localStorage”) to operate: your sign-in session, your display preferences, the backup copy of a file whose saving failed, and your choice regarding advertising measurement; if you accept it, two technical markers of that measurement are added (the value of a purchase in progress, a sign-up already reported). This data stays in your browser; the backup copy is cleared when you sign out (“Sign out”).

Advertising measurement (Google Ads). We measure the effectiveness of our Google Ads advertisements: a sign-up, or a purchase and its value, is reported to Google. This measurement only works with your consent: until you have clicked “Accept” in the banner, no Google script is loaded and nothing is sent to it. If you accept, Google places advertising cookies and receives, among other things, your IP address, information about your browser and the address of the page visited, as an independent controller (Article 4).

Declining is as easy as accepting. You can change your mind at any time using the “Cookies” link, at the bottom of the website's home page and in your account badge, at the top right of the application. When advertising measurement is not active, no banner is shown and nothing is sent.

11. Changes

This policy may be updated; the date at the top of the page shows the latest version. In the event of a significant change, we will inform you by appropriate means.

12. Language

This policy is drawn up in French. This English translation is provided for information: only the French version is binding, including when the service is used in another language.