Privacy statement

Version 1.1 · updated 30 September 2026 (v1.1: cookie policy added)

Who is responsible for your data

Paxbase is the platform of Exsited BV, registered at Patrijsstraat 1, 8540 Deerlijk, Belgium, registered in the Crossroads Bank for Enterprises under number 0533.883.644, VAT BE 0533.883.644. Where this statement refers to "Paxbase", "we" or "us", this means Exsited BV. For everything in this statement, Exsited BV is the controller within the meaning of the General Data Protection Regulation. You can reach us at hello@paxbase.be.

What this statement covers, and what it does not

This statement covers the data we process for ourselves: the data of our customers and of the administrators of their environment, the data of companies we approach as potential customers, and the data we collect when you visit our website paxbase.be.

It does not cover the personal data you process using Paxbase — the data of your clients, travellers, participants, guides and suppliers. That data is in your environment, you decide about it, and we process it solely for you and on your instruction. For that data you are the controller and we are your processor. The division of roles is set out on GDPR & data protection; the binding commitments are in article 8 of our terms and conditions.

If we approach you as a potential customer and you want to know which data we use for that purpose, see the page on prospect data (available in Dutch only).

If you visit our website and want to know which cookies we use, for what purpose and for how long, see our cookie statement. You can update your preferences at any time via the cookie banner at the bottom of the page.

What data we process

As controller we process:

• your identification and contact data and those of your contact persons: name, role, email address and telephone number;
• your billing data: billing address, company number, VAT number and the details of your payments;
• the login credentials of the administrators of your environment;
• technical data about the use of the platform: server and activity logs and logs of requests to our programming interface;
• the messages you send us and our replies;
• if you visit our website and consent to it: anonymised visit statistics via Google Analytics 4 (pages visited, duration of visit, source of your visit). Further details are in the cookie statement.

For what purposes and on what basis

• To perform the agreement with you — creating and managing your environment, administering your subscription, supporting you with questions. Basis: article 6(1)(b) of the Regulation.
• To comply with our legal obligations — invoicing, accounting and VAT. Basis: article 6(1)(c) of the Regulation.
• To secure the platform and detect misuse — for this we use the logs. Basis: article 6(1)(f) of the Regulation, the legitimate interest being the security of the platform and the data of our customers.
• To analyse and improve our website — only after your consent via the cookie banner. Basis: article 6(1)(a) of the Regulation.

We do not use this data for other purposes and we do not sell it.

How long we retain it

We retain your contact and account data for as long as your subscription runs. After termination you retain access to your environment for thirty calendar days to export your data; article 7 of the terms and conditions describes what happens to your environment after that.

We retain billing and accounting data for as long as the statutory retention obligation runs. That period is determined by accounting and VAT legislation and is at least seven years.

We retain logs for as long as they are needed to secure the platform and to investigate incidents and misuse.

Website statistics via Google Analytics 4 are retained for a maximum of thirteen months, in accordance with the standard retention period of Google Analytics 4.

To whom we pass on data

We pass on your data to the parties we need to deliver the service and fulfil our obligations: our hosting partner, parties that provide us with supporting technical services, our accountant, and public authorities when the law requires us to do so. We conclude a processing agreement with the parties that process personal data on our behalf. An up-to-date list of our sub-processors is available on request.

We do not sell your data and we do not pass it on for the commercial purposes of third parties.

Transfer outside the European Economic Area

If personal data are processed outside the European Economic Area, this takes place only by means of a transfer mechanism permitted by the Regulation, such as an adequacy decision or the standard contractual clauses of the European Commission. Google LLC processes data in the United States via Google Analytics 4 on the basis of the adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795) and, where that framework does not apply, on the basis of the standard contractual clauses.

Your rights

You have the right to request access to the data we process about you, to have it corrected or erased, to have the processing restricted, to object to a processing that is based on our legitimate interest, and to receive the data you have provided to us in a common format.

You exercise those rights via hello@paxbase.be. We respond within one month of your request. If we need more time, we will let you know within that month, with the reason.

Erasure is not always possible: what we must retain by law, in particular billing and accounting data, cannot be deleted while the retention obligation runs.

If you are not satisfied with how we handle your data, you can lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be. We appreciate it if you contact us first so that we can put things right.

Changes to this statement

If this statement changes, we will place the new version on this page with the date on which it was updated. The applicable version is always the one on this page.

Contact

Questions about your data or about this statement? Email hello@paxbase.be.