Politique de confidentialité
Last updated: 13 March 2026
1. Who we are (Data Controller)
KelBail (“we”, “us”, “our”) operates the KelBail platform, with registered address at Avenue Paul de Merten 14, 1090 Bruxelles, Belgium.
For all data protection matters, contact us at: [email protected].
2. What data we collect and why
We collect personal data only when you actively provide it or when it is generated by your use of the platform.
| Data category | Examples | Legal basis (RGPD art. 6) | Retention |
|---|---|---|---|
| Account data | Name, email, password (hashed) | Art. 6(1)(b) — performance of contract | Account lifetime + 30 days after deletion |
| Listing content | Title, description, photos, address | Art. 6(1)(b) — performance of contract | Account lifetime + 30 days after deletion |
| Communication data | Messages between users | Art. 6(1)(b) — performance of contract | 12 months after last conversation activity |
| Identity documents | Optional upload for trust verification | Art. 6(1)(a) — explicit consent | Deleted within 30 days of verification or account deletion |
| Usage data | Pages visited, listing views, timestamps | Art. 6(1)(f) — legitimate interest (service improvement) | 90 days (anonymised aggregates up to 2 years) |
| Cookie data | Session token (strictly necessary) | Art. 6(1)(b) — performance of contract | Session duration |
3. Cookies
We use two categories of cookies:
- Strictly necessary cookies — required for authentication. These cannot be refused without breaking the service and do not require consent under Belgian ePrivacy rules.
- Analytics cookies — we use Google Analytics and Microsoft Clarity to understand how users navigate the platform (pages visited, session duration, heatmaps). These cookies are only set after you accept the cookie banner. You may withdraw consent at any time.
You can review or withdraw consent at any time via the cookie settings banner. Withdrawing consent for strictly necessary cookies will log you out. Withdrawing analytics consent will stop new data collection but will not delete data already collected.
4. Who we share your data with
We do not sell your personal data. We share it only with the following processors under strict data processing agreements:
- Supabase Inc. (database, authentication, file storage, transactional auth emails) — USA, covered by Standard Contractual Clauses (SCCs) and Supabase DPA.
- Google LLC (Google Workspace — contact and support emails) — USA, covered by SCCs and Google DPA.
- Google LLC (Google Analytics — usage analytics) — USA, covered by SCCs and Google DPA. Only activated with your consent.
- Microsoft Corporation (Microsoft Clarity — heatmaps and session recording) — USA, covered by SCCs and Microsoft DPA. Only activated with your consent.
We may disclose data to Belgian authorities when legally required (e.g. court order, FSMA, police).
5. International transfers
Some processors (including Supabase) are based outside the EEA. All transfers are covered by the European Commission's Standard Contractual Clauses (SCCs, 2021 version) or an adequacy decision.
6. Your rights under RGPD
As a data subject, you have the following rights (articles 15–22 RGPD):
- Right of access (art. 15) — request a copy of your data
- Right to rectification (art. 16) — correct inaccurate data
- Right to erasure (art. 17) — delete your account and all associated data via Settings → Delete Account
- Right to restriction (art. 18) — pause processing in certain circumstances
- Right to portability (art. 20) — receive your data in a structured format
- Right to object (art. 21) — object to processing based on legitimate interest
- Right to withdraw consent (art. 7(3)) — withdraw any consent at any time
To exercise any right, email [email protected]. We will respond within 30 days as required by RGPD art. 12.
You also have the right to lodge a complaint with the Belgian Data Protection Authority (APD/GBA).
7. Security
We apply technical and organisational measures to protect your data: encrypted connections (TLS), hashed passwords (bcrypt via Supabase Auth), Row-Level Security on all database tables, and limited access to production systems. No system is 100% secure — in the event of a breach affecting your rights, we will notify the APD/GBA within 72 hours and affected users without undue delay (RGPD art. 33–34).
8. Children
KelBail is not directed at persons under 16 years of age. If you believe a child has created an account, contact us immediately at [email protected].
9. Changes to this policy
We may update this policy as the service evolves or legal requirements change. We will notify registered users by email and re-display the consent banner when material changes occur. The “Last updated” date at the top of this page reflects the most recent revision.