Privacy policy
Draft: machine translation, not yet reviewed by a lawyer. The Dutch and French texts are binding.
Version 2026-10-21 — English translation provided for convenience; the Dutch version is binding.
1. Who is responsible?
Advoca is operated by [COMPANY NAME], company number [COMPANY NUMBER], Ottergemstraat 58, 9570 Lierde, Belgium. For questions about this policy or to exercise your rights, email info@advoca.be. We are not required to appoint a data protection officer; the address above is the central point of contact for data protection.
2. Two roles: controller and processor
Advoca acts in two capacities:
- Controller for the data of website visitors and of account holders and users of the firms that use Advoca (name, email address, login, firm details, billing details, usage and security logs). This policy describes that processing.
- Processor for all data a firm enters into the application (matters, clients, parties, documents, time entries, invoices). The firm is the controller for that data; we process it only on the firm's behalf, under the data processing agreement annexed to our terms and conditions. If you are a client or party in a matter of a firm that uses Advoca, please contact that firm to exercise your rights.
3. What data we process and why
| Who | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visitors | IP address (truncated in server logs), browser and time of visit | Security, troubleshooting, abuse prevention | Legitimate interest (Art. 6(1)(f) GDPR) |
| Website visitors | First source of the visit (cookie lcm_attrib) | Knowing through which channel a firm found us | Legitimate interest |
| Website visitors (with consent) | Usage statistics via Google Analytics 4 | Measuring and improving the website | Consent (Art. 6(1)(a) GDPR), via the cookie banner |
| Account holders and users | Name, email address, password (hashed), role, firm | Creating accounts, signing in, managing access | Performance of the contract (Art. 6(1)(b)) |
| Account holders | Firm name, address, company and VAT number, invoice and payment details | Invoicing the subscription, accounting | Contract and legal obligation (Art. 6(1)(c)) |
| Users | Sign-ins, IP address, time, actions performed (audit trail) | Security, accountability, support | Legitimate interest and contract |
| Contacts | Emails and messages you send us | Answering your question | Legitimate interest / pre-contractual steps |
We do not use your data for automated decision-making or profiling, and we never sell it.
Calendar connection (Google Calendar and Microsoft Outlook)
A user can choose to connect a Google Calendar or a Microsoft Outlook calendar. For this, Advoca requests access only to calendar events (Google: calendar.events; Microsoft: Calendars.ReadWrite) and to the email address of that account. Advoca uses this access solely to create, update and delete that user's hearings, deadlines and tasks in the chosen calendar, and to take over into Advoca a date or time the user moves in that calendar for those events. Advoca does not read or store any other events in the calendar. The access token is stored encrypted. Disconnecting in Advoca, or revoking access at Google or Microsoft, ends the access immediately; on disconnecting, Advoca removes the events it created from the calendar. Legal basis: performance of the contract, at the user's request. Advoca's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it and do not use it to train AI models.
4. Cookies
Advoca uses a minimum of cookies:
lcm_session— functional; a signed session cookie that keeps you signed in to the application. Expires when you sign out or when the session ends. No consent required.lcm_attrib— stores for 7 days the first source of your visit (e.g. a search engine or campaign), so we know through which channel a new firm found us. Contains no identifying data.- Consent cookie and Google Analytics 4 — only after you agree in the cookie banner. Without consent, no analytics cookies are set and your IP address is not used for analysis.
More details, and how to change your choice, can be found in our cookie policy.
5. Who we share data with
We share data only with service providers working for us, under a data processing agreement:
- netcup GmbH (Germany) — hosting of the servers and databases.
- Amazon Web Services EMEA SARL, Frankfurt region — sending emails, secrets management and encrypted backups.
- Autumn / Stripe — invoicing and payment of the firm's subscription.
- Google Ireland Ltd. — Google Analytics 4, only with your consent.
All hosting and storage takes place within the European Union. Where a service provider (such as Google or Stripe) may process data outside the EEA, this is done on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We may also disclose data where required by law or a court order.
6. How long we keep data
- Server logs and security logs: at most 90 days.
- Cookie
lcm_attrib: 7 days; Google Analytics data: 14 months. - Accounts that never completed registration: automatically deleted 30 days after creation.
- Account data: as long as the firm is a customer, and then 30 days for export, after which it is deleted.
- Invoices and accounting records: 7 years (statutory retention obligation).
- Record of acceptance of our terms (version, language, checksum, time): up to 10 years after the end of the agreement (evidence).
- Firms' matter data: in accordance with the data processing agreement — export for 30 days after termination, then deletion; backups expire within 90 days.
7. Security
All connections are encrypted (TLS). Passwords are stored only in hashed form. Every firm works in its own environment, isolated at database level (row-level security). Backups are encrypted and stored immutably with object lock. Access to production systems is limited to what is strictly necessary and is logged. Where required, we report a personal data breach within 72 hours to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) and within 48 hours to the firms affected.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent at any time without affecting the lawfulness of processing before its withdrawal. Send your request to info@advoca.be; we will reply within one month. You can also lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.
9. Changes
We may amend this policy. The date at the top indicates the current version; in the event of material changes we will notify account holders by email.
10. Contact
[COMPANY NAME] — Ottergemstraat 58, 9570 Lierde, Belgium — company number [COMPANY NUMBER] — info@advoca.be.