In brief

Quotum is software for Belgian syndicus and VME (association of co-owners) offices. Quotum is a provisional trade and product name of Solvizen BV (in oprichting). A dedicated company for Quotum will follow at a later stage; until then, Solvizen BV (in oprichting) is the operator and, where this policy indicates so, the controller.

This policy explains which personal data we process, why, on what legal basis, with whom we share it, how long we retain it and what rights you have. We write in plain language and work in layers: first the essentials below, then the full explanation per topic.

The essentials: (1) for the data a syndicus office enters into Quotum about co-owners, tenants, suppliers and VMEs, the office is the controller and Solvizen BV (in oprichting) acts as processor; (2) for the office's and its staff's own account and user data, Solvizen BV (in oprichting) is itself the controller; (3) you have rights of access, rectification, erasure and more, and you can always lodge a complaint with the Data Protection Authority.

Who is responsible for your data

The controller for the processing operations covered by this policy is:

• Solvizen BV (in oprichting), trading under the name Quotum
• The company is being incorporated; its enterprise number and registered office will be published after incorporation
• Privacy contact point: privacy@quotum-app.be
• General contact: info@quotum-app.be
• Website: quotum-web.be, application: quotum-app.be

Data Protection Officer (DPO)

We have not currently appointed a Data Protection Officer (DPO) because, in our assessment, our processing operations do not fall under the statutory appointment obligation of Article 37 GDPR. For all your questions about data protection, you can reach our privacy contact point at privacy@quotum-app.be.

Our role: controller or processor

Quotum is used by syndicus offices to manage co-ownerships. As a result, Solvizen BV (in oprichting) wears two hats, which we keep strictly separate here:

• With respect to the personal data of co-owners, tenants, suppliers and VMEs that an office enters and manages in Quotum, the syndicus office is the controller and Solvizen BV (in oprichting) is the processor. We process that data solely on instruction and in accordance with the office's instructions, governed by a data processing agreement (Article 28 GDPR). If you are a co-owner or tenant and have questions about that data, please turn first to your syndicus office as the controller; we will refer you there on request.
• With respect to the office's and its staff's own account and user data, and that of prospects, website visitors and persons who contact us, Solvizen BV (in oprichting) is itself the controller. This policy primarily describes those processing operations.
• The co-owner portal within Quotum displays data that falls under the responsibility of the office or the VME. For that content, the privacy statement of your office or VME applies. Only the strictly technical processing of your portal account (sign-in, security, logs) falls under our own policy.

Which personal data we process

Depending on your relationship with us, we process the following categories. As a processor for an office we process these on instruction; as a controller we process them for the purposes set out below.

• Identification and contact data of parties: form of address, first name, surname, company name, display name, language, email address, telephone and mobile, full postal address (street, house number, box, postal code, municipality, country).
• Fiscal and administrative data: VAT number, CBE (KBO) number, foreign VAT number, customer number with the supplier, party number and free-text notes.
• Financial and payment data: bank account (IBAN, BIC), payment behaviour and file characteristics such as reminder blocking, payment plan, interest exemption and the Article 30bis status.
• Contact persons at a party: name, function, email, telephone, language.
• Account data of office staff: sign-in email, full name, function, telephone and mobile.
• Account data of co-owners in the portal: sign-in email.
• Bank and accounting data from imported bank statements (CODA) and payment orders: names and account numbers of counterparties, mandate data (SEPA direct debit), beneficiaries.
• Data relating to the general assembly: proxy and contact data, a frozen snapshot of persons entitled to vote (name and shares as at the date of the assembly) and voting credentials (login-less voting tokens tied to a pseudonymous device id).
• Evidentiary data when accepting terms or the privacy policy: IP address, browser characteristics (user-agent), the signed signature as an image and a generated signed PDF. This is a simple electronic signature within the meaning of Article 25 eIDAS.
• Security and support data: hashed two-factor recovery codes, support and impersonation sessions (with the operator's IP and expiry timestamp) and an audit log that records, for each change, who did what and when.
• Data about your connected devices: for each active sign-in session, the browser and device characteristic (user-agent), the IP address, an approximate location derived from that IP address (via a local database, without your IP address leaving our systems) and the time of last activity. You can review these yourself in Settings to recognise suspicious sign-ins and sign devices out.
• Documents in storage (settlements, invoices, work orders, minutes and the like) that may contain personal data.
• For a linked mailbox of an office staff member (Google or Microsoft 365): Quotum reads the messages from the addresses in the files live when the staff member opens the Inbox, and does not store them. To be able to notify the staff member, Quotum keeps of each new message from such an address only the sender, the subject, the time and the provider's message reference; never the content or the attachments. Only the staff member whose mailbox it is sees these data.
• When using the optional AI assistant Bizzy: the question typed by the staff member and the answer, which are stored in the database. A free-text question may contain personal data if the staff member types it in. Bizzy is currently not activated.

Purposes and legal bases

We process personal data only for specified purposes, each time on a legal basis from Article 6 GDPR. Each purpose has one legal basis.

• Providing the service and managing your account (creating and managing office and portal accounts, access and authentication, support): performance of the contract, Article 6(1)(b).
• Invoicing and customer administration towards the office: performance of the contract, Article 6(1)(b), and, where statutory accounting obligations are concerned, legal obligation, Article 6(1)(c).
• Complying with statutory and fiscal retention and reporting obligations: legal obligation, Article 6(1)(c).
• Security of the platform, fraud and abuse prevention, technical logs and error detection, and demonstrably retaining accepted terms: our legitimate interest in a secure and reliable service, Article 6(1)(f).
• Improvement and proper functioning of the service via aggregated, cookieless visit statistics: our legitimate interest in a well-functioning service, Article 6(1)(f).
• As a processor: performing the co-ownership tasks the office assigns to us. The legal basis for this lies with the office or the VME as controller (typically the statutory syndicus tasks and the contract) and is set out in their own privacy statement, not in this policy.
• Optional communication such as a newsletter or non-essential features, where we offer these: your consent, Article 6(1)(a). You can withdraw that consent at any time.

Do you have to provide your data

Part of the requested data is necessary to conclude a contract with us and to be able to provide the service. For instance, we need at least a name, an email address and the necessary account and invoicing data to create an account, provide the service and invoice. Other data arises from a legal obligation, for example for accounting and fiscal obligations.

If you do not provide this necessary data, we cannot conclude the contract concerned or cannot provide the service, or not in full. Data indicated as optional may be refused without consequences for the service.

Special categories of data

We do not intend to process special categories of personal data within the meaning of Article 9 GDPR (such as health data). Exceptionally, such data may nevertheless surface, for example in a damage file or a file concerning accessibility. In that case we process it solely on the office's instruction and only within that file, and not for other purposes.

Where your data comes from

When you use an account yourself or contact us, we collect your data directly from you (Article 13 GDPR).

Part of the data we process is obtained not directly from you but through a third party (Article 14 GDPR). Specifically, the syndicus office enters data about co-owners, tenants and suppliers into Quotum, and bank and counterparty data is imported from bank statements (CODA) and payment files. For that data we act as a processor; the data subject is in principle informed by their office or VME. If we process such data as a controller, we inform the data subject within a reasonable period and at the latest within one month, unless a legal exception of Article 14(5) applies.

With whom we share data: recipients and sub-processors

We never sell your data. We share it only with service providers who help us deliver the service (sub-processors), and with third parties where a law or a court decision requires it. Each sub-processor is bound by a data processing agreement and processes data only within the EU or under appropriate safeguards.

The sub-processors we engage, with their status:

• Supabase (database, authentication including two-factor, and document storage): ACTIVE, EU (Ireland).
• Vercel (application hosting): ACTIVE, EU (Dublin).
• Vercel Web Analytics (aggregated visit statistics): ACTIVE but cookieless and first-party, without tracking cookies; collects only aggregated visit statistics once Vercel Pro Analytics is enabled.
• Vercel AI Gateway: not yet activated; will only carry traffic upon activation of the Pro assistant Bizzy.
• Brevo/Sendinblue (transactional email): technically configured, used for system emails such as invitations and notifications.
• Mistral via Vercel AI Gateway (the AI assistant Bizzy): not yet activated.
• Google Document AI (OCR of scanned invoices): not yet activated.
• Peppol access point (e-invoicing): not yet activated.
• Combell (domain registrar): ACTIVE.

Transfer outside the European Economic Area

We aim to process your data within the EEA. Our active sub-processors host within the EU. Should a transfer outside the EEA nevertheless take place, it happens only to a country with an adequacy decision of the European Commission or under appropriate safeguards, such as the Commission's standard contractual clauses (SCCs). You can request a copy of the applicable safeguards at privacy@quotum-app.be.

How long we retain your data

We do not retain personal data longer than necessary for the purposes for which it is processed or than legally required. We apply the following periods:

• Accounting and fiscal records: 7 years, counting from 1 January of the year following the closure of the financial year.
• Correspondence and messages: 7 years.
• Minutes of the general assembly, contracts and insurance policies: as long as the VME concerned exists.
• Account and user data of the office and its staff: until the end of the contract plus 12 months, then deleted or anonymised.
• An account (sign-in address, password, two-step verification, passkeys and recovery codes) that no longer has any access, for example after the sale of your lot or after the end of your role at the office: erased automatically 12 months after the last access or sign-in. What shows who did what (the audit trail, the accounting records, the signed terms) remains kept for as long as a statutory retention period or a possible legal claim requires.
• Evidentiary context upon signing (IP address, user-agent, signature image and generated PDF): 10 years after the end of the contract, in line with the ordinary-law limitation period.
• Technical and security logs: 6 to 12 months.
• Header data of incoming email in a linked mailbox (sender, subject, time): 30 days, then erased automatically; when the mailbox is unlinked, within minutes.
• The accounting ledger is legally immutable (append-only): corrections are made through reversal entries, not through deletion. This data remains retained within the statutory retention period.

Your rights

Under the GDPR you have the following rights with respect to the data for which we are the controller. If you are a co-owner or tenant and the matter concerns data your office manages, please turn to that office as the controller; we support the office in handling the request.

• Right of access (Article 15): to know whether and which data we process and to obtain a copy of it.
• Right to rectification (Article 16): to have inaccurate or incomplete data corrected.
• Right to erasure (Article 17): to have your data erased, insofar as no legal retention obligation or other compelling interest opposes it.
• Right to restriction (Article 18): to have the processing temporarily suspended in certain cases.
• Right to notification (Article 19): we notify recipients of a rectification, erasure or restriction.
• Right to portability (Article 20): to receive or have transferred, in a common format, the data you provided to us and that we process by automated means on the basis of consent or contract.
• Right to object (Article 21): to object to processing based on legitimate interest. You may object to direct marketing at any time and without justification; we always honour that objection.
• Right not to be subject to a decision based solely on automated processing which produces legal effects (Article 22).
• Right to withdraw consent (Article 7(3)): where we rely on your consent, you can withdraw it at any time. The withdrawal applies for the future and does not affect the lawfulness of the earlier processing.

How to exercise your rights

You exercise your rights by sending a request to privacy@quotum-app.be. To protect your data, we may ask you to confirm your identity. We handle your request free of charge and reply, in principle, within one month. In the case of a complex or numerous request, we may extend that period by two months; we will then inform you in good time.

Data that an office deletes is first marked as deleted and only then definitively erased through an audited clean-up, whereby data that must be legally retained or that is immutable remains kept for as long as required. We erase an account without access automatically after the period above, or earlier at your request as soon as you no longer have access anywhere; every erasure is recorded. The same email address can then be invited again.

Cookies and local storage

We do not use advertising or tracking cookies. The only cookies and local storage we place are strictly necessary or functional:

• quotum_locale: remembers your language preference (functional).
• sb-*: Supabase sign-in cookies for your session (strictly necessary, httpOnly, secure, SameSite).
• Local storage on your device for theme and display density, and a device id (quotum_vote_device) that secures login-less voting at the general assembly against abuse. This remains on your device and is functional or security-related.
• Vercel Web Analytics delivers aggregated, cookieless visit statistics without personal identifiers.

Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. These include, among others, encrypted connections, mandatory two-factor authentication for users, strict access separation per customer (tenant isolation via access rules at database level), strict security headers, an audit log of changes and time-bound, audited support access.

No service can guarantee absolute security. If you identify a problem, report it via privacy@quotum-app.be. In the event of a personal data breach, we follow the statutory notification procedure, with notification to the Data Protection Authority within 72 hours where required.

Automated decision-making and profiling

We do not take decisions producing legal effects or similarly significantly affecting you that are based solely on automated processing, including profiling (Article 22 GDPR). Supporting functions such as reminder follow-up are always under human supervision and decision.

The optional AI assistant Bizzy is a tool that answers on the basis of the provided Quotum help context and does not take decisions about persons. Bizzy is currently not activated.

Complaint with the supervisory authority

If you believe we are not processing your data correctly, please contact us first via privacy@quotum-app.be, so that we can look for a solution together. You also always have the right to lodge a complaint with the Belgian supervisory authority and to bring an action before the court.

• Data Protection Authority (GBA / Autorité de protection des données)
• Drukpersstraat 35, 1000 Brussels
• contact@apd-gba.be
• www.gegevensbeschermingsautoriteit.be

Changes to this privacy policy

We may amend this privacy policy when our processing operations or the regulations change. In the event of an important change, we inform you through the usual channels (for example in the application or by email). The date and version number below indicate the version in force.

Version 1.3, 14 October 2026.