Version 1.3 | Effective date: 2026-06-10
1. Who we are
Maarnyka BV (enterprise number 0783.288.064), registered at Ganzeplas 23, 9880 Aalter, Belgium, operates the belsimple service. We are the data processor for personal data entered into belsimple by your organisation. Your organisation (the tenant) is the data controller.
For questions about this policy or your personal data, contact us at legal@belsimple.be.
2. What personal data we collect
We collect and process the following personal data:
| Data | Purpose | Source |
|---|---|---|
| Name and email address | Account creation, login, communication | Provided by your organisation’s manager when inviting you |
| Password (hashed) | Authentication | Set by you during account setup |
| Time entries (hours, dates, task descriptions) | Core service functionality | Entered by you |
| Classification data linked to time entries | R&D reporting and compliance documentation | Entered by you or assigned by your manager |
| Uploaded documents (CVs, diplomas, certifications, grant proposals) | R&D compliance filing packages | Uploaded by your organisation’s manager |
| Work schedule configuration (daily time targets per user) | Completeness checking and compliance reporting | Configured by your organisation’s manager |
| Session identifiers | Maintaining your login session | Generated automatically |
| Timestamps of actions | Audit trail and service integrity | Generated automatically |
We do not collect:
- Location data
- Device fingerprints
- Browsing history
- Data from third-party sources
- Data for advertising or profiling purposes
3. Why we process your data
We process personal data for the following purposes, each with its legal basis under GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the belsimple service | Performance of a contract (Art. 6(1)(b)) |
| Assembling regulatory filing packages (e.g. Belspo, VLAIO) containing time reports and uploaded documents | Performance of a contract (Art. 6(1)(b)) |
| Maintaining an audit trail of actions during the subscription | Legitimate interest (Art. 6(1)(f)) — ensuring data integrity and a tamper-evident record |
| Retaining time entries, classifications, and the audit trail as substantiation for R&D tax claims | Legal obligation (Art. 6(1)(c)) — your organisation’s Belgian tax and accounting record-keeping duties, which we support as processor |
| Sending service-related communications | Performance of a contract (Art. 6(1)(b)) |
| Complying with our own legal obligations (e.g. invoicing and accounting records) | Legal obligation (Art. 6(1)(c)) |
We do not process your data for marketing, profiling, automated decision-making, or any purpose unrelated to delivering the belsimple service.
4. Where your data is stored
All data is stored and processed in Belgium, on Google Cloud Platform infrastructure in the europe-west1 region (St-Ghislain). Data leaves Belgium only in transit — encrypted over TLS — when you or your users access the service.
5. Who has access to your data
Within your organisation:
- Managers can see all time entries, uploaded documents, and user data within your tenant
- Employees can see their own time entries
- No user can access data from other tenants
Regulatory filing packages:
belsimple can generate filing packages (ZIP files) containing personal data — time reports, team rosters, and uploaded employee documents — for submission to regulatory bodies such as Belspo or VLAIO. These packages are downloaded by your organisation’s manager. Your organisation, as data controller, is responsible for reviewing the contents and for any onward sharing with third parties.
Service providers (sub-processors):
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Infrastructure hosting, database, storage | Belgium (europe-west1) |
We do not sell, rent, or share your personal data with any other third parties.
6. How long we keep your data
- During your organisation’s subscription: All data — including time entries, uploaded documents, and configuration — is retained for the duration of the service.
- After the subscription ends — whether by cancellation, non-renewal, or non-payment: your organisation can export its data for a minimum of 30 days. After that window, all tenant data is deleted from live systems, and backups are purged within 90 days. This includes records your organisation may be legally required to keep, such as tax-substantiation records (see below) — your organisation must export these before the window closes.
- After a deletion request: All tenant data is removed from live systems promptly, and backups are purged within 90 days. The same applies here: your organisation must export any records it is legally required to keep before requesting deletion.
- Tax-substantiation records: Time entries, classification data, and the audit trail can constitute evidence supporting your organisation’s R&D tax claims (e.g. Belspo / bedrijfsvoorheffing). Belgian law requires the controller (your organisation) — not belsimple — to keep such records, currently understood to be up to 7 years, extended while an audit or dispute is pending. belsimple does not retain these records on your organisation’s behalf after the export window (unless separately agreed in writing). Meeting the retention obligation is your organisation’s responsibility, using belsimple’s export features before the subscription ends or before requesting deletion.
- Uploaded documents: Documents are retained for the duration of your organisation’s subscription. They are deleted together with all other tenant data after the export window or upon a deletion request.
- Our accounting records: Our own invoicing data may be retained for up to 7 years as required by Belgian law.
7. How we protect your data
- Encryption in transit (TLS) and at rest
- Passwords hashed using Argon2
- Role-based access control with tenant isolation at the database level
- Automated backups with point-in-time recovery
- Regular vulnerability scanning of our infrastructure
For more detail, see our security policy.
8. Your rights under GDPR
As a user of belsimple, you have the following rights under GDPR:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your personal data. This right is limited where we or your organisation must retain data to comply with a legal obligation or to establish, exercise, or defend legal claims (Art. 17(3)) — for example, time entries and audit-trail entries kept as substantiation for an R&D tax claim during the statutory retention period.
- Portability — receive your data in a structured, machine-readable format
- Restriction — request that we limit processing of your data
- Objection — object to processing based on legitimate interest
How to exercise your rights: Since your organisation is the data controller, rights requests should first be directed to your organisation’s manager, who can use belsimple’s built-in features (user management, data export) to fulfil most requests. You may also contact us directly at legal@belsimple.be, and we will coordinate with your organisation.
We will respond to rights requests within one month, as required by GDPR.
9. Children
belsimple is a workplace tool. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor’s data has been entered into the system, contact us at legal@belsimple.be and we will delete it promptly.
10. Cookies
belsimple uses a single session cookie required for the service to function. We do not use advertising, analytics, or third-party cookies. For details, see our cookie policy.
11. Changes to this policy
We may update this policy from time to time. The current version is always available within the belsimple application.
Maarnyka BV — Ganzeplas 23, 9880 Aalter, Belgium — KBO 0783.288.064
Contact: legal@belsimple.be