1. Introduction
This privacy policy applies to the website belgiumholidayhomes.be (referred to as "the website"). We respect the privacy of all users of our website and ensure that the personal information you provide is treated confidentially. This policy has been drawn up in accordance with the General Data Protection Regulation (GDPR).
2. What data do we collect?
We may collect the following data when you visit our website, create an account or contact us:
- Contact details you voluntarily provide (name, email address, phone number) when you send us a message or create an account
- Account and billing data of owners: company name, VAT number, billing address and home address (required for annual invoicing of listings)
- Verification documents uploaded by owners (voluntary): rental permit, energy performance certificate, property tax assessment, notarial deed, recent utility bill. Used solely to verify ownership or management of the property. Stored in private cloud storage (Supabase Storage) with strictly limited access, only our admin team can view them. Automatic deletion after 90 days.
- Tariff sheets uploaded by owners (voluntary, via "Import prices from document"): processed temporarily to extract pricing, not stored permanently.
- Property information and photos that owners add themselves
- Technical data such as IP address, browser type and operating system for analytical purposes
- An unreadable fingerprint of your email address and IP address when you request a new password. We do not keep the address itself, only an irreversible fingerprint we can count but from which nobody can derive the address. It serves only to spot someone abusing that request to flood mailboxes.
- Cookies and similar technologies to improve how the website functions
3. How do we use your data?
We use your data solely for the following purposes:
- To respond to your questions or requests
- To improve the operation and usability of our website
- To give owners access to their dashboard
- To track anonymous statistics about website usage
- To prevent abuse of the form for requesting a new password
4. Sharing with third parties (processors)
We do not sell, trade or rent your personal data to third parties for commercial purposes. For the operation of the platform, we do work with a few technical processors who are contractually bound to strict data protection obligations (GDPR-compliant).
ℹ️ The list below reflects our current partnerships as of May 2026. This list may change in the future when we switch suppliers or add new services. Please check this page for the current version. In the event of significant changes, we will notify you by email or via a dashboard notification.
- Supabase Inc., database and storage of verification documents (EU region Frankfurt)
- Vercel Inc., website hosting (global CDN with EU primary)
- Anthropic Inc., AI document extraction (USA, with Standard Contractual Clauses)
- Resend, sending transactional emails (EU)
- Cloudflare R2, storage of property photos (global CDN)
- Google Maps Platform, geocoding of addresses (USA, with Standard Contractual Clauses)
- VIES (European Commission), validation of Belgian VAT numbers (EU)
For transfers outside the European Economic Area we apply the Standard Contractual Clauses of the European Commission. These third parties may process your data only on our instructions and for the purposes for which we engage them.
5. AI-assisted processing
For one specific feature we use an AI service (Anthropic Claude) to read documents automatically:
- Tariff extraction (voluntary): when an owner uploads a tariff sheet via "Import prices from document" to have prices filled in automatically on the dashboard, this document is temporarily sent to Anthropic to read the rates.
Anthropic does not use this data to train AI models (per the Anthropic Privacy Policy and their API Data Usage Policy). Documents are not stored permanently at Anthropic.
This processing is based on the explicit consent of the owner (by choosing to upload a document). You can refuse this AI processing by simply not uploading any document, manual entry of prices remains available at all times.
6. Retention periods
We do not retain your personal data longer than necessary for the purposes for which it was collected, in line with the GDPR storage limitation principle (art. 5(1)(e)):
- Verification documents: the file itself is automatically deleted from cloud storage within 90 days of upload, whether approved or rejected. At the same time we erase the file name, the data read from the document and the review note from our database. All that remains is the record of the review itself: what kind of document it was, when it was reviewed and with what outcome. That record holds nothing from the document itself and accounts for why a property carries the verified badge.
- Requests for a new password: the irreversible fingerprint of address and IP is erased automatically after 7 days.
- Account and property data: as long as you have an active account on the platform. Upon a deletion request (by email to vakantiewoningeninbelgie@gmail.com), we delete the data manually within 30 days.
- Invoicing and accounting documents: 7 years, statutory retention period under the Belgian VAT Code (art. 60).
- Emails and booking requests: kept as long as useful for support or evidence in case of disputes, in line with the GDPR storage limitation principle. Removable on request to the extent that no ongoing dispute or statutory retention duty applies.
- Cookies: see our cookie policy for the specific durations.
You have the right at any time to access, correct or delete your data, see section 9 about your rights.
7. Cookies
Our website uses cookies to improve your experience. Cookies are small text files stored on your computer. You can disable cookies through your browser settings, though this may limit certain functions of the website.
We also keep an unfinished form in the local storage of your own browser, so that you do not lose anything if you reload or accidentally close the page. This applies to the registration form and to editing your property. That data stays on your own device and is not sent to us. Your password and your agreements are never stored this way. You can erase it yourself with the “Start over” button on the restore prompt; otherwise it disappears as soon as your registration or your change has been saved, and at the latest seven days later when you reopen the form.
8. Security
We take appropriate technical and organisational measures to protect your personal data against loss, misuse or unauthorised access. All data transfers use encrypted connections (SSL/HTTPS). In the event of a data breach, we will notify you as quickly as possible and within 72 hours at the latest.
9. Your rights
Under the GDPR, you have the right to:
- Request access to your personal data
- Request correction or deletion of your data
- Object to the processing of your data
- Lodge a complaint with the Data Protection Authority
11. Changes
We reserve the right to update this privacy policy. Changes will be published on this page. We recommend checking back regularly.
Last updated: May 2026