In brief

Quotum places only strictly necessary cookies and uses strictly necessary local storage on your device. These are the cookies and data needed to sign you in, secure your session and remember your preferences (language, theme, display density). We place no advertising, marketing, profiling or social-media cookies, and at this time no tracker that follows your behaviour is running.

Because we use only strictly necessary cookies and storage, we are not legally required to ask for your prior consent and therefore do not show a cookie banner. This policy explains in a layered way what we place, why, for how long and with which rights. The first blocks give the essential overview; the later blocks contain the full technical and legal details.

• No consent banner needed, because there are no non-essential trackers.
• Only session, security and preference cookies or local storage.
• No advertising, no profiling, no reselling of data.
• Questions? privacy@quotum-app.be. Complaints can be filed with the Data Protection Authority (DPA).

Who is responsible for this policy

The Quotum application and the accompanying website are operated by Solvizen BV (in oprichting); its company number and registered office will be published after incorporation. "Quotum" is for now a trade name and product name of Solvizen BV (in oprichting). A separate company for Quotum will be incorporated at a later stage; until then, Solvizen BV (in oprichting) remains the operator.

For the cookies and local storage used on the website (quotum-web.be) and in the application (quotum-app.be), Solvizen BV (in oprichting) acts as controller. For the personal data that the syndic offices process in the application about co-owners, tenants, suppliers and VMEs, the syndic office is the controller and Quotum/Solvizen BV (in oprichting) is the processor. For the office's own account and user data of the office and its staff, Quotum/Solvizen BV (in oprichting) is itself the controller. This distinction is explained further in our privacy statement.

• Operator and party responsible for this cookie policy: Solvizen BV (in oprichting).
• The company is being incorporated; its company number and registered office will be published after incorporation.
• Privacy contact point: privacy@quotum-app.be. General contact: info@quotum-app.be.
• Website: quotum-web.be. Application: quotum-app.be.

What are cookies and similar techniques

A cookie is a small text file that a website places on your device and can read again later. Besides classic cookies there are similar techniques that store or read information on your device, such as local storage and session storage in your browser, tracking pixels and device identification (fingerprinting). The Belgian rules treat all these techniques in the same way: what matters is not the technique, but the purpose for which the storage takes place.

This means that data we keep in your browser's local storage is assessed in the same way as cookies. For Quotum these are exclusively preferences and security data that are strictly necessary to deliver the service you yourself have requested.

Legal framework

The placing and reading of cookies and similar techniques falls in Belgium under two complementary layers. The first layer is the ePrivacy rule, originally article 129 of the Act of 13 June 2005 on electronic communications, which since the Act of 21 December 2021 has moved to article 10/2 of the Act of 30 July 2018 (the framework act), together with the ePrivacy Directive 2002/58/EC. That rule determines when storage on your device is permitted without consent.

The second layer is the General Data Protection Regulation (GDPR). It sets the quality requirements for consent where consent is indeed required, and enshrines your rights as a data subject. For strictly necessary cookies no prior consent is required; for all other cookies a free, specific, informed and unambiguous opt-in is mandatory.

• ePrivacy layer: article 10/2 of the framework act (Act of 30 July 2018, ex-article 129 EC Act) and the ePrivacy Directive 2002/58/EC.
• GDPR layer: Regulation 2016/679, in particular the requirements for consent and the data-subject rights.
• Supervisory authority: the Data Protection Authority (DPA) / Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD).

Categories we use

The DPA distinguishes two categories that do not require prior consent. The first are strictly necessary technical cookies, which serve only to carry out a communication over an electronic network. The second are strictly necessary functional cookies, which are strictly necessary to deliver a service you have expressly requested, such as signing in, securing your session or remembering your language choice.

Quotum uses exclusively cookies and local storage from these two exempted categories. We use no analytical, statistical, marketing, advertising, profiling or social-media cookies. Those would after all be subject to consent, and we do not ask for them because we do not place them.

Overview of the cookies Quotum places

The cookies below are all strictly necessary. Without these cookies you cannot sign in securely or the service you requested does not work correctly.

• sb-* (Supabase authentication): keeps and secures your sign-in and session. Strictly necessary. Properties: httpOnly, secure and SameSite. Retention period: for the duration of your session, managed by the authentication service. Recipient: Supabase (on our behalf).
• quotum_locale: remembers your chosen language so the interface appears in the right language. Strictly necessary (functional). Retention period: until you change the language or delete the cookie. Recipient: Quotum only (first-party).

Overview of the local storage Quotum uses

Besides cookies, Quotum keeps a limited number of preferences in your browser's local storage. This data stays on your device and serves only to remember your own choices. It is not used to track or profile you.

The theme and display preferences are additionally kept as a durable copy with your account data, so that your preference also travels to another device when you are signed in.

• quotum-theme: remembers your theme (light or dark). Functional, per device.
• quotum-density: remembers your chosen display density. Functional, per device.
• quotum_vote_device: a stable device identification number for the sign-in-free voting application at a general assembly, linked to your voting token to prevent repeated or fraudulent voting. Pseudonymous identifier with a security purpose, no tracking.

Why you see no cookie banner

A consent banner is only mandatory as soon as a website wants to place one or more non-strictly-necessary cookies or trackers. Because Quotum uses only strictly necessary cookies and storage, a consent banner is not required. We do, however, inform you transparently through this cookie policy, as the rules prescribe.

We place no cookie before you are signed in, except the data needed to make that sign-in and security possible. No analytics or marketing tracker fires when the page loads, for the simple reason that none is present on our site or in our application.

Analytics and future changes

In our application the Vercel Web Analytics component is technically present, but it is cookieless and first-party: it places no tracking cookies and uses no persistent identifiers. This component moreover collects only aggregated visit statistics once the paid Vercel Pro analytics is enabled; until then it is inactive. Even were it to become active, that happens without cookies.

Should Quotum in the future nonetheless wish to deploy non-essential trackers, for example analytics that are not cookieless, or marketing pixels on our website, we will provide a full consent banner beforehand. That banner will show a "Reject all" button at the same level as "Accept all", allow a choice per purpose, and load the scripts concerned only after your explicit consent. This policy will then be updated.

Recipients and processors

To deliver the service we rely on a number of service providers that act as processors. All the parties below are EU-/GDPR-compliant. Only the parties involved with the strictly necessary cookies and storage process data in that context; the others are listed here for completeness and are described further in our privacy statement.

• Supabase (database, authentication, storage) — ACTIVE, EU (Ireland). Manages among other things the sb-* session cookies.
• Vercel (application hosting) — ACTIVE, EU (Dublin).
• Vercel Web Analytics — ACTIVE but COOKIELESS and first-party; no tracking cookies; collects only aggregated visit statistics once Vercel Pro analytics is enabled.
• Vercel AI Gateway — not yet activated; only carries traffic upon activation of the Pro assistant Bizzy.
• Brevo/Sendinblue (transactional email) — technically configured, used for system emails.
• Mistral via Vercel AI Gateway (Bizzy) — not yet activated.
• Google Document AI (OCR) — not yet activated.
• Peppol access point (e-invoicing) — not yet activated.
• Combell (domain registrar) — ACTIVE.

How long we keep the data

The cookies and local storage themselves are kept for the duration indicated per item, or until you delete them. The periods mentioned below concern the broader data retention in the application and apply identically in our privacy statement and processing agreement. What an office deletes is first marked as deleted (soft-delete) and then definitively deleted or anonymised through a manual, audited cleanup. Only what the privacy statement says so is erased automatically: an account without any access after the period stated there, and the header data of incoming e-mail.

• Session cookies (sb-*): for the duration of your session.
• Language preference (quotum_locale) and local preferences (theme, density): until you change or delete them.
• Accounting and tax records: 7 years, from 1 January of the year following the close of the financial year.
• Correspondence and messages: 7 years.
• Minutes of general assemblies, contracts and insurance policies: for as long as the VME concerned exists.
• Account and user data of the office and its staff: until the end of the agreement plus 12 months, then deleted or anonymised.
• Evidentiary context at signing (IP address, user-agent, signature PNG, generated PDF): 10 years after the end of the agreement.
• Technical and security logs: 6 to 12 months.

Managing your cookie preferences

Because Quotum uses only strictly necessary cookies and storage, there is no settings panel to switch non-essential cookies on or off; there simply are none. You can always manage or delete the cookies and local storage present through your browser's settings. Bear in mind that deleting the session or language cookie means you will have to sign in again or choose your language again, and that some parts of the application do not work correctly without these cookies.

In every common browser you can view, block or clear cookies through the privacy or security settings menu. You can clear local storage through those same settings under the management of website data.

Your rights

You have the rights that the GDPR grants you over the personal data processed via cookies or the application. Where it concerns data that a syndic office processes as controller, you address that office in the first instance; we support the office in this as processor. For the office's own account and user data for which Quotum is controller, you can address us directly.

• Right of access, rectification and erasure of your data (articles 15 to 17 GDPR).
• Right to restriction of and objection to the processing (articles 18 and 21 GDPR).
• Right to data portability (article 20 GDPR).
• Right to lodge a complaint with the Data Protection Authority.

Filing a complaint with the supervisory authority

If you believe that the processing of your personal data is not in accordance with the law, you can file a complaint with the Belgian Data Protection Authority. We would appreciate it if you contact us first via privacy@quotum-app.be, so that we can try to address your concern.

• Data Protection Authority (DPA) / Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD).
• Drukpersstraat 35, 1000 Brussels.
• contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be.

Changes to this cookie policy

We may adjust this cookie policy from time to time, for example when we add new functionality or when the regulations change. We keep the previous versions and provide each policy with a version number and a date. In case of an important change, such as the introduction of non-essential cookies, we inform you actively.

Version 1.3 — 14 October 2026.