Privacy Policy

Version 1.0

This Privacy Policy explains how Adure BV collects and uses personal data through its websites and in the course of its business. It is available in English and Dutch. In the event of any discrepancy between the two versions, the English version prevails.

1. Who we are

Adure BV, having its registered address at Kleitstraat 24A, 9930 Lievegem, Belgium, registered with the Crossroads Bank for Enterprises under number BE1030 018 353 ("Adure", "we", "us"), is the controller of the personal data described in this Policy.

For any question about this Policy or about your personal data, contact us at [privacy@adure.io].

We have not appointed a Data Protection Officer. Our activities do not require one under Article 37 GDPR: we do not carry out large-scale regular and systematic monitoring of individuals, and we do not process special categories of personal data on a large scale.

2. What this Policy covers

This Policy applies to our websites and to the personal data we handle when you contact us, subscribe to our mailing list, or use our applications.

Where we act as processor instead of controller. If you use an Adure application that your employer or another organisation has bought, that organisation decides why and how your data is processed within the application. It is the controller and we act on its instructions as processor. This Policy does not govern that processing — direct requests about it to the organisation that gave you access. Section 7 explains the limited data we control ourselves in connection with an account.

3. Tracking on our websites, and your choice

Nothing that tracks you loads until you choose. When you first visit, no analytics or marketing script runs. A banner asks you to decide, and we load only what you allow. There are two separate choices:

If you accept neither, the sites work in full.

Marketing tracking builds a profile. If you allow marketing cookies, Pardot keeps a record of your browsing on our sites over time and associates it with your contact record once you identify yourself, for example by submitting a form. We use that to judge which of our material is relevant to you. It does not produce any legal effect for you and we do not use it to make automated decisions about you — see Section 10.

Changing your mind. You can change or withdraw either choice at any time through the cookie settings link in the footer of each site. Withdrawing marketing consent instructs Pardot to revoke its tracking consent for your browser. Withdrawal does not affect anything done before you withdrew. Your choice is stored in your browser's local storage, separately for each of our sites, so a choice made on one site does not carry to another.

Cookies and similar technologies

Where first-party tracking is enabled, Pardot cookies are set on a subdomain of ours rather than by a third-party domain. They remain marketing cookies and still require your consent.

You can also delete cookies and local storage at any time in your browser settings.

4. What we collect, why, and on what basis

Giving us your data is voluntary. If you do not complete a contact form we cannot reply to you.

Forms. When you submit a form, we send its contents from our server to Salesforce Account Engagement so that your enquiry reaches the right person and is recorded against your contact history. This happens whether or not you accepted marketing cookies — it is how we handle what you deliberately sent us, not tracking.

5. Marketing email

If you subscribe, we send you the updates you asked for. Every message carries an unsubscribe link, and you can also unsubscribe by writing to us. We do not sell or rent your address, and we do not send you material on behalf of anyone else.

Where you are already our customer and we email you about products similar to those you bought, we may rely on Article XIII.3 of the Belgian Code of Economic Law, which permits this to existing customers. You may object at any time, and every message will still carry an unsubscribe link.

6. Who we share data with

We do not sell personal data.

We engage service providers who process personal data on our instructions and under a written agreement, for hosting, email, customer records, marketing automation, payment processing, invoicing and support. The current list, with what each does and where it processes data, is published at https://adure.io/sub-processors. The providers involved in website tracking are named in Section 3.

We may also disclose personal data to our accountant, insurer or professional advisers where necessary, and to a public authority or court where the law requires it.

7. Accounts and applications

If your organisation buys an Adure application, we hold limited data about the people who administer, use or pay for that account: name, business email address, telephone number, job title and employer.

We process that data as processor on your organisation's behalf for account administration, support and licensing, under our data processing agreement with that organisation.

We process the same data as controller where we are legally or commercially obliged to: issuing and keeping invoices, meeting accounting and tax obligations, evidencing who signed a contract, and defending legal claims. The legal bases are compliance with a legal obligation (Article 6(1)(c) GDPR) and our legitimate interest in managing and defending our business (Article 6(1)(f) GDPR). Accounting records are kept for seven years, as Belgian law requires. Contract records are kept for ten years after the contract ends, being the limitation period for contractual claims under Belgian law.

8. Transfers outside the European Economic Area

We aim to keep personal data within the European Economic Area, and the providers listed in Section 6 are established there.

Some of them use infrastructure or support teams outside the EEA — this applies in particular to Google and Salesforce, including Account Engagement. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or another safeguard permitted by Chapter V GDPR, together with the additional measures those providers apply. You can ask us for a copy of the safeguard that applies to a particular transfer.

9. Your rights

You have the right to:

• access the personal data we hold about you, and receive a copy;
• rectify data that is inaccurate or incomplete;
• erase your data, where one of the grounds in Article 17 GDPR applies;
• restrict our processing while a dispute about accuracy or lawfulness is resolved;
• portability — receive data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller, where processing is based on consent or a contract and is automated;
• object to processing based on our legitimate interest, on grounds relating to your particular situation, and to object at any time to direct marketing, including the profiling described in Section 3; and
• withdraw consent at any time, where processing is based on consent.

To exercise any of these, write to [privacy@adure.io]. We reply within one month. If your request is complex we may extend that by two months and will tell you why. We may ask you to confirm your identity before we act.

If you are not satisfied with how we have handled your data, you may lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be. You may also complain to the supervisory authority where you live or work.

10. Automated decision-making

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you. The marketing profiling described in Section 3 informs which material we send you; it does not decide whether you can buy from us, on what terms, or at what price.

11. How we protect your data

We apply appropriate technical and organisational measures, including encryption in transit, access control on a need-to-know basis, multi-factor authentication for administrative access, patching and monitoring, and regular backups. Our staff and contractors are bound by confidentiality obligations.

If a personal data breach is likely to result in a high risk to your rights, we will inform you without undue delay.

12. Changes to this Policy

We may update this Policy. The version in force is the one published on our websites. Where a change materially affects you, we will draw it to your attention by a notice on our websites or, where we have your email address and the change concerns you directly, by email.

Version history