Privacy policy

The short version

ACL Software BV, in Namur, Belgium, runs Hexvan and is responsible for your account data.
Your customers’ details are yours: we only hold them for you, on your instructions.
Hexvan is hosted in the European Union. We never sell data, and there are no advertising trackers.
This website sets no cookies and runs no analytics.
You can see, correct, take away or delete your data: write to [email protected].

01 Who we are

Hexvan is a product of ACL Software BV, a private limited company (BV/SRL) under Belgian law, registered at Chaussée de Nivelles 315, 5020 Namur, Belgium, with company and VAT number BE 0798.373.841. In this policy, "we" and "us" mean ACL Software BV; "you" means the business that uses Hexvan and the people in it.

This policy covers the Hexvan app, the websites it publishes for its users, the trades directory and this website, hexvan.com. For anything about your personal data, write to [email protected].

02 Our role, and yours

The data protection rules give two roles, and we play both, for different data.

We are the controller of the data about you as our customer: your account, your business profile, your subscription, your messages to us and our technical logs. We decide why and how it is used, and this policy explains it.
You are the controller, and we are your processor, for the data you put in Hexvan about other people: your customers, suppliers and subcontractors, the people who sign your quotes, and the photos you take on the job. We hold and use it only to run Hexvan for you, on your instructions. The data processing terms in our terms of service set this out, as Article 28 of the GDPR asks.

If you are one of a Hexvan user's customers and have a question about your details, ask that business first: it decides what it keeps. We will help it answer you.

03 What we collect

Your account

Your e-mail address and name, and your password, stored only as a scrypt hash. We never see or keep the password itself.
If you sign in with Google, Microsoft or Facebook: the identifier of your account there, and the name and e-mail address it shares with us. We never get your password for those accounts.
Your role in the business (administrator or member) and when the account was created.

Your business

The business profile: its name, e-mail, phone number, address and where it is on the map, company and VAT numbers, currency and tax settings, payment terms, IBAN and invoice footer.
If you send e-invoices on Peppol: the details needed to register your business on the network (name, address, VAT or company number).

Your work

Your contacts: names, e-mail addresses, phone numbers, addresses, business names, company and VAT numbers, Peppol addresses and your notes about them.
Your reminders, quotes, invoices, credit notes and receipts, the products and services you sell, and the photos you keep with them (the job done, a paper receipt). Photos are private: only your business sees them.
Quote signatures. When a customer signs a quote, on your phone or through its private link, we keep the name they type, the signature they draw, the date and time, and the IP address it was signed from, as proof of the signature.

What you publish

Your website: its headline, services, photos, colour and phone number. Once you publish it, anyone can see it.
Your directory listing, if you choose to be listed: your trades, description, how far you travel, and your phone and e-mail if you choose to show them. Your exact address is never published: where you are based is only shown to within about a kilometre.

Your subscription

Whether you are on the free trial or subscribed, and the invoices of your subscription. Your card and billing details are entered with Stripe, our payment provider: we never see your card number.

Your messages to us

What you write to us from the app or by e-mail, with your name, your business and, if you give it, a number to call you back on.

Technical data

Like any web service, our servers log each request: the address asked for, the time, the result and the IP address it came from. We use these logs to keep Hexvan running and safe, and to stop abuse (public pages are limited to a number of requests per minute).

What we do not collect

No advertising or analytics trackers, in the app or on this website.
No selling, renting or sharing of personal data with advertisers. Ever.
No profiling, and no automated decisions with legal effects on you.

04 Why we use it, and on what basis

For the data we control, the GDPR asks us to say why we use it and on what legal basis.

What for	Legal basis
Running your account, the app, your website and directory listing	Our contract with you (Article 6(1)(b) GDPR)
Billing your subscription, and keeping its invoices	Our contract, and our accounting and tax obligations (Article 6(1)(c))
E-mails about the service: a quote signed, a payment that failed, a change to our terms	Our contract with you
Answering your messages	Our contract, and our legitimate interest in helping our users (Article 6(1)(f))
Logs, security and stopping abuse	Our legitimate interest in keeping Hexvan safe and running
Answering the authorities when the law requires it	Our legal obligations

For the data we process for you, the legal basis is yours: as the controller, you decide why you keep your customers' details (usually to carry out the job they asked for, and to meet your own tax obligations).

05 Who else handles it

We use a few providers to run Hexvan. Each gets only what it needs for its task, under a written agreement, and may not use it for anything else.

Our hosting provider: The servers and the database that run Hexvan and hold its data.; Where:European Union (Western Europe)
Stripe: Subscription payments: your card, your billing details and the invoices of your subscription.; Where:Ireland, and the United States
Google: Maps and addresses: suggestions as you type (Google Places gets what you type in an address field), placing addresses on the map (it gets the address only, never who it belongs to), and the maps themselves, which your browser loads from Google, so it sees your IP address. And signing in with Google, if you choose it.; Where:Ireland, and the United States
Microsoft, Meta (Facebook): Signing in with your Microsoft or Facebook account, if you choose it.; Where:Ireland, and the United States
Recommand: Our Peppol access point: it registers your business on Peppol and delivers your e-invoices to your business customers, if you send on Peppol.; Where:Belgium
Our e-mail provider: Sending the e-mails Hexvan sends, and receiving yours.; Where:Its name and location on request

E-invoices sent on Peppol also pass through your customer's own access point, which delivers them to their accounting software: that is how the network works.

We disclose data to the authorities only when the law compels us to, and we tell you unless we are forbidden to. We never sell data.

06 Where your data is kept

Hexvan's servers and database are in a data centre in the European Union, in Western Europe. Your data stays there.

Some of the providers above (Stripe, Google, Microsoft, Meta) are international companies that may handle data outside the European Economic Area. Where they do, they rely on the safeguards the GDPR requires: an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or the Commission's standard contractual clauses.

In the UK, the UK GDPR applies to you, and the UK recognises the European Economic Area as giving adequate protection: your data may go to the EU under UK law without further safeguards. In Canada, we handle personal information in line with PIPEDA, and it is stored in the EU, under the protection of the GDPR.

07 How long we keep it

Your account and your work: for as long as your account exists. When your free trial or subscription ends, your account stays, read-only, so that you can still read and download your documents, or subscribe again.
Deleting it all: ask us at [email protected], from the e-mail address of an administrator of the business, and we delete your account and its data within 30 days.
Backups rotate over 30 days: after that, deleted data is gone from them too.
The invoices of your subscription are kept for as long as Belgian accounting and tax law requires, even after your account is deleted.
Technical logs are kept for a short time, then deleted.

Before you ask us to delete your account, download your invoices, credit notes and receipts (the accountant's export holds them all). The tax rules usually ask you to keep them for several years; HMRC, for example, asks for six years of VAT records. Keeping them is your responsibility.

08 Cookies and local storage

We keep this simple, so there is no cookie banner.

This website, hexvan.com, sets no cookies and runs no analytics or advertising trackers. It remembers your region (UK, Ireland & Europe, or Canada) in your browser's local storage, under hexvan.region, so that prices show in your currency. It never leaves your browser.
The trades directory shows a Google map: your browser loads it from Google, which may set its own cookies.
The app sets no cookies either. When you sign in, it keeps a sign-in token in your browser's local storage, until you sign out (it expires after 30 days). While you sign in with Google, Microsoft or Facebook, it keeps a short-lived note in session storage to finish the sign-in safely.
When you subscribe, Stripe's payment form opens inside the app, and Stripe may set its own cookies to prevent fraud. The sign-in pages of Google, Microsoft and Facebook are theirs, with their own cookies.

09 How we keep it safe

Everything between your browser and Hexvan is encrypted (HTTPS).
Passwords are stored only as scrypt hashes.
Every business's data is kept apart from the others': the server checks it on every request, not just the screens.
Your photos have no public address: only your business sees them, once signed in. A quote's signing link is a long random code, sent only to your customer.
Public pages (the directory, quote links) are limited to a number of requests, against abuse.
Only the people who run Hexvan can reach its servers, and they are bound to confidentiality.

If a breach puts your data at risk, we tell you without undue delay, and the authorities when the law requires it.

10 Your rights

Under the GDPR and the UK GDPR, you have the right to:

access your personal data, and get a copy of it;
rectify it when it is wrong (you can change most of it yourself in the app);
erase it, unless the law asks us to keep it;
port it: get it in a common, machine-readable format, to take elsewhere;
object to what we do on the basis of our legitimate interests;
restrict what we do with it while a question is being settled;
withdraw your consent at any time, where we rely on it.

Write to [email protected]. We answer within one month, and it costs you nothing. We may ask you to prove who you are first.

For your customers' data, the request goes to you, as the controller: we help you answer it (find, correct, export or delete what you hold).

11 Complaints

Tell us first, and we will try to put it right. You can also complain to a data protection authority:

in Belgium, where we are established: the Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), at dataprotectionauthority.be;
in the UK: the Information Commissioner's Office (ICO), at ico.org.uk;
in Ireland or elsewhere in the EU: the authority of the country where you live or work;
in Canada: the Office of the Privacy Commissioner of Canada, at priv.gc.ca.

12 Changes to this policy

When we change this policy, we update the date at the top. If a change matters to you, we e-mail the administrators of every business at least 30 days before it takes effect.

13 Contact us

ACL Software BV, Chaussée de Nivelles 315, 5020 Namur, Belgium.
Privacy: [email protected]
Anything else: [email protected]