Privacy Policy

This policy describes how Saubeo SRL (Rue Rafhay 198, 4630 Soumagne, Belgium, CBE 0704.742.612 — "we") processes personal data in connection with the Hoteo service. Privacy contact: privacy@hoteo.be (general enquiries: support@hoteo.be).

1. Who is responsible for what?

Hoteo is used by businesses (heating professionals) to manage their own clients. Two situations coexist:

• Your data as a Hoteo user (account, subscription, support): Saubeo is the data controller — that is the subject of this policy.
• Your clients' data that you enter into Hoteo (names, addresses, job sites, invoices…): you are the data controller and Saubeo is the data processor. This processing is governed by the data processing agreement (DPA), which forms part of the terms of service.

2. Data we collect

• Account and organisation: surname, first name, e-mail address, phone number, language; company identity (name, CBE/VAT number, address — where applicable pre-filled from the Belgian Crossroads Bank for Enterprises).
• Subscription and billing: chosen plan, billing history; payment card data is processed directly by Stripe and never passes through our servers.
• Identity verification (Peppol): when electronic invoicing is activated, an identity verification may be carried out by our provider Veriff.
• Usage and security data: sign-in log (timestamp, IP address, browser, approximate location), audit log of actions in the application.
• Screens opened in the application: which user opened which screen (Calendar, Invoices, Settings…) on which day — one line per screen and per day, with no time, no duration and nothing of what is done there.
• Communications: support requests, transactional e-mails and the newsletter (delivery, open and click status, measured by our e-mail routing provider).
• Form on the hoteo.be website: the name, e-mail address and request you enter there.
• Origin of the sign-up: where the account creation came from (one of our ads, a search engine, a social network, an AI, another website or a direct visit), recorded with the organisation.

3. Purposes and legal bases

Purpose	Legal basis
Providing the Service (account, features, support)	Performance of the contract
Subscription billing, accounting	Legal obligation
Identity verification for access to the Peppol network	Legal obligation / performance of the contract
Security (intrusion prevention, sign-in log, alerts)	Legitimate interest (securing the Service)
Improving the Service (technical diagnostics)	Legitimate interest
Knowing which screens of the application are used, to improve the Service	Legitimate interest (improving the Service)
Communications about the Service (news, end of trial)	Performance of the contract / legitimate interest
Monthly newsletter (product news and trade tips)	Legitimate interest (informing our business customers), with one-click unsubscribe
Audience measurement of the public website hoteo.be	Consent
Advertising: measuring our ads and showing them to visitors of the public website hoteo.be (Meta pixel, Google Ads tag)	Consent
Knowing where sign-ups come from, to measure our ads without cookies	Legitimate interest (measuring the effectiveness of our advertising)
Answering the questions asked in the field on the hoteo.be website, and improving the service	Legitimate interest
Replying to requests sent through the form on the hoteo.be website, and notifying at launch those who asked for it	Legitimate interest (replying to your request)

We make no fully automated decisions producing legal effects concerning you, and we do not sell your data.

4. AI assistant

When you use the assistant, your question and the data strictly necessary to answer it are transmitted to our AI provider — Microsoft Azure (Microsoft Ireland Operations Ltd) — which acts as a data processor, with processing within the European Union (Sweden). Your data is not used to train models. The assistant's suggestions must be verified before use.

On the hoteo.be website, the question field relies on the same provider, under the same conditions: your question is transmitted to it to produce the answer. We keep the question and the answer for six months to improve Hoteo, with nothing that could identify you: no account, no cookie, no IP address. Your IP address is used only, for the duration of the request, to compute a fingerprint of the day that limits the number of questions per visitor; it cannot be traced back to the address, changes every day and is deleted after seven days. Do not write personal data in your question.

5. Recipients and processors

Your data is accessible only to our team (logged access, least privilege) and to our processors: hosting, payment, e-mail and SMS delivery, Peppol access, bank connection, AI assistant, identity verification, push notifications for the mobile app, audience measurement and advertising of the public website. The up-to-date named list (provider, location, transfer safeguards) is published on the page /legal/sous-traitants, which is its authoritative source. Public authorities may receive data where required by law.

6. Transfers outside the European Union

Our data is hosted in the European Union. Some providers involve a transfer outside the EU — in particular Stripe (United States), certified under the EU-U.S. Data Privacy Framework and covered by standard contractual clauses as a fallback. Details per provider can be found on the page /legal/sous-traitants.

7. Retention periods

Data	Period
Account and organisation data	Duration of use of the service. Cancelling the subscription deletes nothing (back to the free plan, data kept). Voluntary deletion (account or organisation) is immediate, permanent and irreversible once confirmed via the email link
Subscription invoices issued by Saubeo	10 years (our own Belgian accounting obligations)
Sign-in and security log	12 months, deleted together with the account
Consultation log	So that, in the event of a security incident, we can establish which data was actually consulted — and therefore inform you precisely rather than having to assume the worst — we record acts of consultation: which user, at what time, what type of data and how many records were served to them. One line per consultation, never per record read, and no content of the data consulted. Kept 12 months, deleted together with the organisation. ⚠ This log concerns the users of your organisation: if you employ staff, it is for you to inform them
Screens opened in the application	Which user opened which screen on which day: one line per screen and per day, with no time or duration, and nothing of what is done there. Nothing is stored in your browser for this. Kept 12 months, deleted together with the organisation
Support communications	3 years after closure
E-mail and SMS send tracking	For each e-mail or SMS sent by Hoteo, our sending provider reports its status to us (delivered, opened, clicked, refused), with the recipient's address or number. Reports linked to your organisation (sending a quote, an invoice, a reminder): they are part of your sending history; kept as long as the organisation exists, deleted together with it. All other reports (codes, alerts, service messages): erased after 90 days. In all cases, the technical detail of the report (message subject, the recipient's browser and device type) is erased after 90 days
Peppol identity verification (Veriff)	At Hoteo: no identity document, no photo and no data extracted from the document — only the technical session reference, the verification status and, in case of failure, the reason communicated by Veriff; kept for the duration of use of the service, and erased along with the organisation. At Veriff: the identity document and the face capture are kept for 3 months and then erased, under Veriff's own retention policy. That period runs independently of your deletion with us: deleting your organisation erases everything at Hoteo, but does not shorten retention at Veriff
Questions put to the agent on the hoteo.be website	6 months, with no identifying data
Requests sent through the form on the hoteo.be website	Not kept in Hoteo: they arrive by e-mail in our info@hoteo.be mailbox, where they are kept for as long as needed to reply and to notify you at launch, 12 months at most; deleted earlier on request to privacy@hoteo.be
Residual copies in backups	Purged on backup rotation, 30 days at most after deletion; restoring a backup re-applies the deletions

Deletion is available as self-service in the application (Settings > My account for your account; Settings > My data for the whole organisation, administrators). The deletion flow enforces a prior export step (complete archive: JSON per module, invoice PDFs, attachments — right to portability, Art. 20 GDPR) and reminds you that keeping your accounting documents (10 years, Belgian obligation) is your responsibility: after deletion, Hoteo keeps no copy of your data and can no longer return anything. Your decision is timestamped (version of the accepted text, IP address) as proof.

What remains after your organisation is deleted. Erasure covers all of your data: clients, jobs, quotes, invoices, attachments, settings and user accounts are physically deleted. All that remains is a reduced record of your company, stripped of every contact detail, containing only: its name and company numbers (VAT, CBE) — legal-person data that our own subscription invoices must be able to reference under our accounting obligations; the proof of your acceptance of our terms and conditions (version of the text, date and IP address), kept for the establishment and defence of legal claims (Art. 6.1.f and 17.3.e GDPR); and the date and origin of the deletion request (including the internal identifier of the administrator who requested it — the account itself no longer exists). This record contains no address, no telephone number, no e-mail address, no bank details, no logo and no data whatsoever about your clients or your business.

Your individual account (member of an organisation) can be deleted in two ways: by yourself (Settings > My account, confirmation via e-mail link) or by an administrator of your organisation. In both cases deletion is immediate: e-mail address, first name, last name and password are erased from the account, and your current session is cut off. The only things that remain, under your organisation’s responsibility (legitimate interest, Art. 6.1.f GDPR), are your name in its operational data (for example past jobs scheduled under your name) and, for a deletion decided by the administrator, the named trace in its internal log. When you request erasure yourself, no named data remains in that log: your past actions appear there as “Deleted user”. These elements disappear when the organisation itself is deleted.

8. Your rights

You have the rights of access, rectification, erasure, restriction, portability, objection and, where applicable, withdrawal of consent. Exercise them through the application (Settings) or by e-mail to privacy@hoteo.be; we reply within one month (a period that may be extended by two months for complex or numerous requests — we would inform you within the first month). Proof of identity may be requested in case of doubt.

For the newsletter, objection is immediate and requires no procedure: every mailing carries an unsubscribe link, and the setting is also available in your organisation's Settings. E-mails necessary for the Service (invoices, sign-in codes, reminders) continue to be sent: they are not covered by this choice.

9. Complaints

You may lodge a complaint with the Belgian Data Protection Authority: Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be.

10. Security

Encryption of communications (TLS), strict segregation of data per organisation, role- and permission-based access control, anti-intrusion account lockout, audit log of write operations, support access subject to your explicit authorisation and logged, regular backups, EU hosting.

11. Cookies and local storage

Two distinct environments coexist:

• The Hoteo application (app.hoteo.app) uses no advertising cookies or audience trackers — only strictly necessary technical storage, which does not require consent.
• The public website hoteo.be uses Google Analytics 4 to measure its audience, only after your consent, given via the banner shown on your first visit: nothing is loaded or transmitted to Google before you agree, and refusing is as easy as accepting.
• With your agreement to advertising, the public website also loads the Meta pixel (Meta Platforms Ireland Ltd) and the Google Ads tag (Google Ireland Ltd), which report each page viewed (and, for Google, each click towards creating an account) to measure our ads and show them to people who have visited the website. The banner lets you accept one purpose without the other. For the collection and transmission of this data, Saubeo and Meta, like Saubeo and Google, are joint controllers; what Meta and Google then do with it is governed by their own privacy policies (Meta, Google).
• Without cookies, and whatever you choose in the banner, the public website adds the origin of your visit to the link towards creating an account (one of our ads, a search engine, a social network, an AI, another website or a direct visit), which it reads from the page address and from the page you came from. It stores nothing in your browser and sends nothing to Meta or Google. The app keeps this origin in the tab while you create your account (it disappears when you close it), then records it with the organisation.

Full details (local storage purposes, cookies involved, durations) can be found on the page /legal/cookies.

12. Updates to this policy

Each version is dated. In the event of a substantial change, we will inform you by e-mail or in the application. Previous versions are available on request.