GDPR & DATA PROTECTION
Your data, your rights.
Badex acts as a controller for its own customer relationships and as a processor for the data customers handle in our products. We process personal data lawfully, fairly and transparently.
Data Residency
EU (Germany)
Production servers at Contabo, Germany. Backups in the EU.
Data Protection Contact
BADEX
dpo@badex.app
Supervisory Authority
Belgian APD/GBA
www.dataprotectionauthority.be
What we collect
Account Data
Name, email, company name, billing address, VAT number
Authentication Data
Hashed passwords and OAuth tokens for Microsoft 365 (stored encrypted)
Email Metadata
Recipient addresses and send timestamps needed to apply signatures. Email body content is only processed where required to apply the signature.
Technical Data
IP addresses and browser information in server and security logs
Payment Data
Not stored by Badex. Card payments are processed by Stripe.
Your GDPR rights
Right to Access
Request a copy of the personal data we hold about you (Article 15).
Right to Rectification
Correct inaccurate or incomplete personal data (Article 16).
Right to Erasure
Ask us to delete your personal data (Article 17).
Right to Restriction
Limit the processing of your personal data (Article 18).
Right to Portability
Receive your data in a machine-readable format (Article 20).
Right to Object
Object to processing based on legitimate interest (Article 21).
Right to Lodge a Complaint
File a complaint with the Belgian APD/GBA or your local data protection authority.
Data retention
| Category | Retention |
|---|---|
| Account data (active customer) | Duration of the contract + 30 days after termination |
| Billing records (legal obligation) | 7 years (Belgian tax law) |
| Server and security logs | As long as needed for security and troubleshooting, then deleted |
| Backups | Overwritten on a rolling basis; deleted data disappears from backups as they rotate |
Exercise your rights
We answer GDPR requests within one month (Article 12). We may ask you to verify your identity to prevent fraudulent requests. A Data Processing Agreement (Article 28) is available for business customers on request.