Privacy Policy

This Privacy Policy explains how LOBI-SYSTEMS SRL (“Lobi Systems”, “we”, “us”), the company behind senga, processes personal data when you visit senga.lobi-systems.com, sign up for an account, or use the senga product (collectively, the “Services”).

LOBI-SYSTEMS is a Belgian company headquartered at Mons, Belgium. For questions about this policy or to exercise your rights, write to [email protected].

When you operate a senga instance to process data about your own customers, employees, or business contacts, you are the data controller for that data and we act as your data processor. The terms governing that relationship live in our Data Processing Agreement.

We collect the minimum data needed to run the Services:

• Account data - name, work email, role, company, and authentication credentials.
• Billing data - billing address, VAT number, and invoice history. We invoice by bank transfer and do not collect card numbers.
• Technical data - server logs and error reports (time, page, browser, IP address) used to keep the Services running and secure. We do not use analytics or tracking tools, and error reports do not include the content of your documents.
• Communications - emails, support chats, contact form submissions, and any other messages you send us.
• Cookies - only the first-party cookies needed to sign in and keep your session secure. Cloudflare may set a strictly necessary security cookie. No analytics or advertising cookies, no cross-site tracking.

We use personal data to:

• Operate, secure, and improve the Services.
• Authenticate you and protect your account.
• Bill you for the Services you use.
• Respond to your support requests.
• Send you operational updates (security advisories, billing notices, important changes to the Services). You cannot opt out of these because they are necessary for the contract.
• Send you product updates if you have opted in. You can unsubscribe at any time from any product email.
• Comply with our legal obligations.

We process personal data on the following bases:

• Contract (Art. 6(1)(b) GDPR) - to provide the Services to you.
• Legitimate interests (Art. 6(1)(f) GDPR) - to keep the Services secure, prevent abuse, and improve the product.
• Legal obligation (Art. 6(1)(c) GDPR) - to comply with tax, accounting, and other applicable laws.
• Consent (Art. 6(1)(a) GDPR) - for product update emails and any optional data we ask for explicitly.

We keep personal data only as long as needed for the purpose it was collected for:

• Account data: while your account is active, plus 30 days after deletion.
• Billing data: ten (10) years, as required by Belgian accounting law.
• Technical data: server logs and error reports 30 days; sign-in history 90 days.
• Support messages: 36 months from last reply.
• Backups: encrypted, kept up to 35 days.

We do not sell personal data. We share it only with:

• Subprocessors we rely on to deliver the Services (hosting, traffic delivery, error monitoring, e-invoicing). The current list is published in our DPA.
• Authorities when compelled by a binding legal order. We notify the affected user before complying unless doing so is unlawful.
• Successors in the event of a merger or acquisition, under strict confidentiality and with prior notice to you.

The Services run inside the European Union. We do not transfer personal data outside the EU/EEA except where a subprocessor we engage is established outside it. Cloudflare and Sentry are US companies: the transfer is covered by the EU-US Data Privacy Framework where the company is certified, and otherwise by the European Commission's Standard Contractual Clauses.

We protect data with encryption in transit (TLS 1.2 or higher), encrypted file storage and backups (AES-256), encryption keys kept in a secrets manager separate from the data, access based on roles and permissions, a sign-in history, protection against password guessing, and security checks on every code change and on the software we depend on. Database backups allow recovery to a point in time, and a restore is tested every month. Incident response procedures align with GDPR Art. 33 - we notify the affected supervisory authority within 72 hours and you without undue delay if we detect a breach affecting your data.

Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. You can exercise these rights at any time by writing to [email protected]. We respond within 30 days. We do not take decisions about you based solely on automated processing.

A short version of these rights with how to use them lives at our GDPR rights page.

If you believe we have not met our obligations, you can lodge a complaint with the Belgian Data Protection Authority or your local supervisory authority.

We may update this Privacy Policy from time to time. Material changes are announced 30 days in advance via email and a banner on the Services. The effective date appears at the top of this page.

For any privacy-related question: [email protected].

For postal mail: LOBI-SYSTEMS SRL, Mons, Belgium.