Privacy policy
Translation — the French text prevails. French version. Version in force of 18 October 2026.
Version of
Who is responsible
VAGA MART (Fiplan), whose identity is given in the legal notice, is the controller of the data of its clients, their users, website visitors and prospects. Contact for your data: info@fiplan.be. Fiplan has not appointed a data protection officer (not mandatory for its activity).
What this policy does not cover
The data a firm enters about its own clients (files, contact details, shareholders) is processed by Fiplan on behalf of the firm, which is responsible for it: it falls under the data processing agreement (section 4) and the firm's own policy.
Why, on what basis, for how long
| Purpose | Data | Legal basis (GDPR, Art. 6) | Retention period |
|---|---|---|---|
| Providing the service: account, firm, files, documents, client area | identity, e-mail, password (hashed), firm, VAT number, roles, content of the files | performance of the contract | term of the contract, then 30 days; a file in the bin: 30 days |
| Payment and billing | plan, amounts, billing address, VAT number; card data remains with Stripe | contract and legal obligation | invoices and records: 10 years |
| Service e-mails (account, billing, security) and the "delivered · link opened" log | e-mail, date, click on the signed link; no open-tracking pixel | contract; legitimate interest (proof of sending) | term of the contract |
| Support and assistance | tickets, exchanges; read-only support access, authorised by the client for 48 h, logged; anonymous diagnostics | contract; legitimate interest (traceability) | tickets: 2 years after closure; diagnostics: 90 days |
| Security and abuse prevention | technical logs, IP address, login attempts | legitimate interest | the providers' periods (a few days to a few weeks) |
| Usage measurement (activity log) | pages, browser, device, language, time zone, IP hint, session | consent (banner, withdrawable at any time) | 12 months |
| Answering a contact message | name, e-mail, telephone, company, message | pre-contractual measures; legitimate interest | 1 year |
| Prospecting and news from Fiplan | professional contact details, exchanges, clicks on links | legitimate interest for existing clients (similar services) and for generic addresses (info@…) of firms set up as companies; prior consent for a personal address (firstname@…) and for a firm run by a natural person; one-click unsubscribe | 3 years after the last contact |
| Proof of consent and of acceptance of the terms | accepted version, date, banner choice | legal obligation; legitimate interest | term of the contract + 10 years |
Who receives your data
Nobody sells or rents it. It is processed by our providers, bound by contract:
| Provider | Role | Location | Transfer outside the Union |
|---|---|---|---|
| Supabase | database, authentication, files, functions | European Union (Frankfurt) | no |
| Cloudflare | delivery of the website and the application, protection | worldwide network | yes: EU–US Data Privacy Framework (certified provider); standard contractual clauses as a fallback |
| Stripe | payment | Ireland; American group | possible: same safeguards |
| Resend | sending of the service e-mails | United States | yes: same safeguards |
| Billit | issuing invoices | Belgium | no |
| one.com | mailbox | European Union | no |
| YouTube (Google) | playing a help video, only after your click | United States | yes, after the click |
Your rights
You may request access to your data, its rectification, its erasure, the restriction of processing, its portability, and object to processing based on legitimate interest or to prospecting. You withdraw your consent at any time ("Manage cookies"). Write to info@fiplan.be: we answer within one month. You may also lodge a complaint with the Data Protection Authority (dataprotectionauthority.be).
Security
Encryption of exchanges, hashed passwords, two-factor authentication, segregation of each firm's data in the database, support access on authorisation and logged, backups (details in annex 2 of section 4). In the event of a data breach involving risk, we notify the Authority within 72 hours and, if the risk is high, the persons concerned.
Miscellaneous
Fiplan takes no automated decision producing legal effects concerning you. The service is not intended for persons under 18. Any material change to this policy is announced by e-mail.
Cookies and browser storage
Fiplan places no advertising cookie and no third-party tracker. It keeps in your browser what is necessary for the service and, only if you accept it, an identifier for usage measurement.
| Item | What it is for | Type | Duration |
|---|---|---|---|
| Login session | keeping you logged in | strictly necessary | until logout |
| Your cookie choice (fp-consentement) | remembering "Accept" or "Refuse" | strictly necessary | 6 months, then the question comes back |
| Language and display preferences | showing Fiplan the way you set it | necessary for the requested service | 6 months |
| Installable application (service worker and caches), only once logged in | updating the application and loading it faster | strictly necessary | until the next version |
| Activity session identifier | linking the entries of the usage measurement | subject to your consent | end of the browser session |
| Help video (YouTube, cookie-free address) | playing the video | nothing is loaded before your click; after that, YouTube's rules | YouTube's |
Your choice. The banner offers "Accept" and "Refuse" at the same level; no box is pre-ticked and nothing is measured without an answer. You may change your mind at any time via "Manage cookies" (footer, Profile): withdrawal stops the measurement immediately. Fiplan keeps a record of your choice and of the versions of the banner.