Privacy Policy

1.1 We will collect and process the following Personal Data from you:

• User Account Data (Username, first name, last name, e-mail address, role, profile settings)
• Device and Access Data (IP address, session logs, browser type, operating system, device identifiers)
• Usage and Interaction Data (page visits, navigation paths, clicks, scrolling behaviour, time spent on pages, interaction patterns).
• Support and Communication Data (contact details, support tickets, email/phone logs)
• Technical and Diagnostic Data (error reports, crash logs, stack traces, and related technical data collected through monitoring tools such as Sentry, which may in limited cases include user identifiers or session-related information, as well as aggregated usage statistics collected through Google Analytics with IP anonymization enabled)

We implement measures to ensure that sensitive form fields (such as passwords and payment information) are not recorded or masked where applicable.

1.2 We collect your Personal Data through Our Platform, as well as through the provision of Our services. The collection of your Personal Data will occur when you start using the Platform. From that point you have entered into an agreement with Us, and the data will have to be collected to be able to fulfil said agreement.

2.1 We will process your Personal Data for the following purposes and associated legal bases, during the specified retention periods:

User Account Data

Purposes: To register and log on to the Platform; To send direct marketing; Account creation and management; Authentication and access control.

Legal basis: Necessary for the performance of an agreement (art. 6 (1) (b) GDPR); Consent or Soft-Opt-In.

Retention period: For a period of two years calculated as from the last login on the Platform or deletion of the account; or for a period of two years as from the end of the agreement.

Device and Access Data

Purposes: Secure access.

Legal basis: Necessary for the performance of an agreement (art. 6 (1) (b) GDPR).

Retention period: As above.

Support and Communication Data

Purposes: SLA management; Customer support; Service improvement.

Legal basis: As above.

Retention period: As above.

2.2 Your Personal Data will (only) be processed for the purposes stated in the overview above. In case We would like to process your Personal Data for other purposes than those stated above in this Privacy Policy, We will notify you without delay and you will receive all necessary information, you can also object to such use, except when it is required for HOXX to adhere to its legal obligations.

2.3 Where the processing of your Personal Data as per the above overview is necessary to perform an agreement between you and HOXX, We cannot execute the agreement if you do not provide your Personal Data to Us. In practice, this means you will no longer be able to use the Platform.

2.4Personal data will also be used for direct marketing, provided you have given consent for this (‘opt-in’). If you have already been included in Our mailing list for receiving marketing materials in paper and/or electronic form, We may use your Personal Data for sending marketing and other materials with regard to Us, Our products and/or services. Your consent can be withdrawn at any time, without justification and free of charge, for example by clicking on the appropriate unsubscribe link at the bottom of each promotional e-mail message or by sending your intention to unsubscribe by contacting us by sending a registered letter to HOXX BV, Karel Oomsstraat 37, 2018 Antwerpen, or by e-mail via gdpr@hoxx.app.

Sending direct marketing via e-mail or SMS is, in some cases, allowed without your explicit consent, for example, because We have obtained your electronic contact details in the context of the sale of products or services and because Our commercial messages relate to Our own similar products or services (‘Soft opt-in’). You can object to receiving further direct marketing messages from Us at any time by clicking on the appropriate unsubscribe link at the bottom of each promotional e-mail message or by contacting us by sending a registered letter to HOXX BV, Karel Oomsstraat 37, 2018 Antwerpen, or by e-mail via gdpr@hoxx.app.

3.1 We may disclose your Personal Data to third parties who provide services to Us, such as, but not limited to marketing offices, IT-service providers, payment service providers, group entities, logistical service providers, and sustainability advisors. These Processors may only process your personal data on explicit and written instruction from Us for Our benefit. We guarantee that all Processors are selected with due care and oblige them to observe the security and integrity of your Personal Data.

3.2 Furthermore, in the event of a complete or partial sale, reorganisation or transfer of activities of HOXX, whereby its business activities are reorganised, transferred or ceased, or if HOXX goes bankrupt, your Personal Data may be transferred wholly or partly to new entities or third parties who acquire Our business. As the case may be, We may also disclose your Personal Data to (non-)affiliated third parties including advisors involved in the process of the partial sale, reorganization or transfer.

3.4 In rare cases, it may occur that HOXX must disclose your Personal Data pursuant to a court order or to comply with other mandatory laws or regulations. HOXX will make reasonable efforts to inform you in advance of this, unless this is subject to legal restrictions.

3.5 HOXX will not sell your Personal Data, nor rent, distribute or otherwise make commercially available to third parties, except as described above or with your prior consent.

3.6 In any case, all rights and obligations embedded in this Privacy Policy will also be applicable to the third party which processes or controls your Personal Data as set forth in this Privacy Policy.

4.1 We will primarily process your Personal Data within the European Economic Area. In the event that We transfer your Personal Data to countries outside the EEA, We will ensure that the same level of protection is achieved as within the EEA. Should you have questions or want to obtain more information regarding this topic, please contact us by sending a registered letter to HOXX BV, Karel Oomsstraat 37, 2018 Antwerpen, or by e-mail via gdpr@hoxx.app.

5.1 Right to Access. You have the right to request access to your Personal Data and to obtain information on whether and how your Personal Data is being processed. Upon request, we will provide a copy of your Personal Data that we process.

5.2 Right to Rectification. You have the right to request the correction of inaccurate or incomplete Personal Data. We will respond to such requests without undue delay and ensure that the Personal Data is accurate and up to date.

5.3 Right to Erasure (Right to be Forgotten). HOXX will delete the Personal Data in line with the retention periods above in Article 2 or in other events, for instance, when the specific purpose of the respective processing activity has been achieved, when you want to withdraw your consent, exercise your right to object to the processing activity, etc. Unless one of the exceptions to this right would be applicable, HOXX will do its best efforts to delete your personal data without undue delay.

5.4 Right to Restrict Processing. You have the right to request Us to restrict the processing of your Personal Data in specific circumstances, such as when you contest the accuracy of your Personal Data.

5.5 Right to Data Portability. You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format. You also have the right to transmit that Personal Data to another data controller, where technically feasible, under the conditions laid out in the GDPR.

5.6 Right to Object. You have the right to object to the processing of your Personal Data for reasons specific to your situation. We will consider such objections and cease processing unless We can demonstrate compelling legitimate grounds for the processing.

5.7 Right not to be subject to Automated Decision-Making. You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affecting you.

5.8 Right to withdraw consent. Insofar as processing is based on your prior consent, you have the right to withdraw such consent at any moment and free of costs.

5.9 Exercising your rights. You can exercise your rights by contacting us by sending a registered letter to HOXX BV, Karel Oomsstraat 37, 2018 Antwerpen, or by e-mail via gdpr@hoxx.app. We will handle your request within a reasonable period of time, abiding by the rules set out under the GDPR.

When contacting Us, please ensure that it is always clear which of the above rights you wish to exercise. Please note that in certain cases, We may request additional documentation or information. Under certain exceptional circumstances, We have the right not to fulfil your request (e.g. if We have the legal obligation to retain your Personal Data).

5.10 Right to file a complaint. If you consider HOXX to not have processed your Personal Data in accordance with the applicable regulations, you are entitled to lodge a complaint with the Data Protection Authority through the contact information below.

This is without prejudice to a court order given by a civil court.

6.1 We have developed and implemented security measures that are technically and organisationally adapted to prevent the destruction, loss, forgery, modification or unauthorised access of Personal Data.

6.2 We also require all employees to abide by the rules embedded in this Privacy Policy.

6.3 Under no circumstances can HOXX be held liable for any direct or indirect damage resulting from the incorrect or unlawful use by a third party of your Personal Data.