Privacy statement
Version 2.0 · 15 October 2026
Who is responsible?
LOOTVOET BV, Groenestraat 37/C, 8691 Alveringem, company and VAT number BE 0800.934.047, RLE Ghent, Veurne division, is responsible for processing your data on this website, for the waitlist and for your account in the Hopfact app. You can reach us at info@hopfact.be.
Whoever uses Hopfact also puts other people's data into it: their clients, those clients' contact persons and whoever signs a timesheet. For that data, the user is responsible. We only process it on their behalf, under the data processing agreement. What we do with it is also described below.
What we process, and why
Website, waitlist and verification page
| What | Data | Legal basis | Retention |
|---|---|---|---|
| Visiting the website | IP address and technical request data, processed by Microsoft Azure hosting | Legitimate interest | No access logs of our own |
| Visitor statistics (Plausible) | Page, referring site, country, device type, browser and operating system. IP address and browser data only hashed, with a salt that changes every 24 hours | Legitimate interest | Anonymised totals only |
| Waitlist | Email address, language, time and version of your consent, time of your confirmation. Purpose: the confirmation email, launch news and an invitation to the beta | Consent | Unconfirmed: 30 days. Confirmed: until you unsubscribe, at most 24 months |
| Waitlist abuse protection | IP address, in server memory only | Legitimate interest | Not stored |
| Beta invitation | Email address and language, when we invited you, whether and when you created an organisation with that address, and whether we had a feedback call. Your address goes on the list of addresses allowed to create an organisation | Consent for the invitation. Legitimate interest for following up the beta | Until the end of the beta |
| Day-rate calculator | None: everything happens in your browser | Not applicable | Nothing stored |
| Checking a signed timesheet | Only the fingerprint (SHA-256) of the file: the file itself never leaves your computer. Your IP address, in server memory only, to slow down abuse | Legitimate interest | Not stored |
When you use Hopfact
You use Hopfact when you created an organisation with an invitation and sign in to the app.
| What | Data | Legal basis | Retention |
|---|---|---|---|
| Account and signing in | Your email address, the name of your sign-in account, the unique code Microsoft gives your account, and the language of the app. You sign in with a one-time code by email, with Google or with a personal Microsoft account. If you choose Google or a Microsoft account, that service passes on your name and email address | Contract | For as long as your account exists |
| Your organisation | Name, legal form, address, VAT number, enterprise court, contact person with phone and email address, IBAN, BIC, bank, logo, the email address of your accounting tool and your settings | Contract | For as long as your account exists. What appears on an issued invoice: 10 years |
| Your work | Assignments and rates, days and hours worked, day notes, time-tracking blocks with their description, the figures of previous years you enter yourself, and your signature: drawn strokes or your name in handwriting | Contract | For as long as your account exists. What appears in a sent timesheet or an issued invoice: 10 years |
| Invoices and timesheets | For each issued invoice, the PDF and the UBL. For each sent timesheet, the PDF, the signed PDF, the audit trail and the data it was created from | Contract. The period follows your legal retention obligation | 10 years, even if you delete your account. No one can delete them sooner, not even us |
| Your actions in the audit trail | When you sign or send a timesheet, revoke a link or choose another signer: the time, your name and email address, your IP address and your browser | Legitimate interest: being able to prove who did what | 10 years, like the timesheet |
| Peppol | If you activate Peppol, the name, address, company number and VAT number of your business go to Recommand, Hopfact's Peppol access point. Your identity is verified on Recommand's site: we do not see that data | Contract | For as long as your account exists |
| Agreement to the terms | Which version of the beta terms and the data processing agreement you accepted, which version of this statement you read, when, and with which account | Legitimate interest: being able to show what you agreed to | For as long as your account exists |
| Emails and notifications to you | Your organisation's contact address, the content of the notification or email, and whether the email arrived | Contract | For as long as your account exists |
| Feedback and support | Your message. The feedback button in the app sends it as an email to info@hopfact.be, with the page you were on, your language, your organisation and your email address, so we can reply. Once the email has left, we delete the message from the app | Legitimate interest: helping you and improving Hopfact | Only in our mailbox, at most 2 years |
| Technical logs | Which feature was used at what time, how long it took, error messages and technical codes. Never an email address, IBAN or link with a token. Your IP address is not kept in the logs | Legitimate interest: keeping the app secure and working | 30 days |
"For as long as your account exists" means: until 30 days after you deleted your account (see "Your rights").
When a user puts your data into Hopfact
This is about a user's clients, their contact persons, whoever signs a timesheet and whoever receives a timesheet or invoice. The user is responsible for that data. They also decide why they process it: usually to perform a contract with you or your employer, or to be able to prove that a timesheet was approved. We process it on their behalf.
| What | Data | Purpose | Retention |
|---|---|---|---|
| Clients and contact persons | Name, address, VAT number and logo of the company, and the email addresses for invoices and timesheets. Name, email address, job title and language of a contact person | Creating and sending timesheets and invoices | For as long as the user keeps them. What appears on an issued invoice: 10 years |
| Signing request | Name, email address and language of the signer, when the request and each reminder were sent, and whether the email arrived | Getting the timesheet approved | 10 years, like the timesheet |
| Approving or declining | What you did and when, the name you typed or the signature you drew (as strokes, not as an image), and your reason if you declined | Recording the approval | 10 years, like the timesheet |
| Audit trail | For every action on the signing page (opening, downloading, approving or declining): the time, your IP address and your browser. Opening counts at most once a day | Being able to prove who did what, and when | 10 years, like the timesheet |
| Signing page abuse protection | IP address, in server memory only | Slowing down too many attempts | Not stored |
The audit trail is a PDF the user always receives. They can also have it sent along to you and to the invoiced party. For each step it shows the time and who acted, with name and email address. Your IP address and browser are not on it: they stay only in our database, as evidence.
Emails about a timesheet are sent from our address, but on behalf of the user: your reply goes to them. The signing page loads nothing from other sites.
Who receives your data?
Microsoft Ireland Operations Ltd provides the hosting of the website and the app, the database, document storage, email through Azure Communication Services, logs and signing in through Microsoft Entra External ID. The app and its data are in Sweden, in the Azure region Sweden Central. Microsoft processes email in Europe.
Recommand (BRBX BV, Nieuwdorp 5, 3990 Peer, company number 1012.081.766) is Hopfact's Peppol access point. Recommand receives your business's details if you activate Peppol, and every invoice you send through Peppol. To check whether a client can receive invoices through Peppol, Recommand receives that client's company number.
Plausible Insights OÜ provides the website's visitor statistics, with servers in Germany. The app uses no statistics.
We check a VAT number you enter in the app with VIES, the European Commission's service. If you sign in with Google or with a personal Microsoft account, that service knows you do so at Hopfact. Email you send to info@hopfact.be passes through Cloudflare, which forwards it to our mailbox at Gmail, a Google service.
What a user sends goes to whoever they choose: their client, the signer, their client's Peppol address or their own accounting tool.
We do not sell your data and do not pass it on for marketing. During support by Microsoft, a transfer outside the European Economic Area is possible, under the European Commission's standard contractual clauses. Cloudflare is an American company: there too, transfers happen under those standard contractual clauses. For a few services, Recommand relies on companies outside the European Economic Area, also under those standard contractual clauses. Google may also process the email in our mailbox outside the European Economic Area.
Cookies
This website uses no cookies or similar techniques. That is also why there is no cookie banner.
The app only uses cookies it needs to work: a session cookie that keeps you signed in for 8 hours, two short-lived cookies that secure signing in, and a cookie that remembers your language for 1 year. Microsoft's sign-in page sets its own cookies to sign you in. There are no cookies for statistics or advertising, so the app has no cookie banner either. The signing page and the verification page set no cookies.
How do we protect your data?
Everything travels encrypted over the internet and is stored encrypted. Each organisation only sees its own data. Hopfact has no passwords: you sign in with a one-time code, with Google or with a personal Microsoft account. Of a signing link we only keep a fingerprint, and logs never contain an email address, IBAN or token. Only whoever runs Hopfact can access the database. They only look into it when that is needed for support or to fix an error. More is in the data processing agreement.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection.
If you use Hopfact, you view and correct most data yourself in the app, and you download every invoice and timesheet.
You delete your account yourself, with a button in the app. 30 days later we delete your organisation's data and your sign-in. Within those 30 days you can still cancel. Issued invoices, sent timesheets and their audit trail stay in the locked storage until their 10 years have passed: no one can delete them sooner, and you are legally required to keep them for 10 years. No one opens them, and we provide them on request. After those 10 years we delete them. So best download them first.
If a user put your data into Hopfact, contact them. If you email us, we pass your request on to them and help them answer it.
You can withdraw your consent for the waitlist at any time through the unsubscribe link in every email. For everything else, you can reach us at info@hopfact.be. We answer within one month.
A complaint?
You can lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be.
Other
We make no automated decisions and do no profiling. Hopfact is not aimed at children under 16. If this statement changes substantially, we tell everyone who is confirmed on the waitlist. Users see the new version the next time they sign in.
Questions about your data? info@hopfact.be