UBLKIT

Privacy Notice

How we handle your data at UBLKIT

Last updated: 2 November 2026

1. Who we are & roles

Ulixes Consulting BV, Elegemstraat 186, 1700 Dilbeek, Belgium (KBO/BCE BE 0795.420.685) runs ublkit.be, the UBLKIT Online converter, the UBLKIT desktop app, the UBLKIT API and the licence shop.

  • Controller for the data you give us on the website: download requests, licence purchases, contact messages and API accounts.
  • Processor for invoices you send to UBLKIT Online or to the API: we process them only to convert or display them; you remain controller of their content.
  • Desktop app: the app processes your invoices locally on your own computer. It does not send documents, invoice data, VAT numbers or usage statistics to us.

2. What data we process

  • Download requests: your e-mail address, the language, the date you asked for the link, whether and when the link was opened and the download started, the chosen system (Windows, Linux), and the IP address and browser used.
  • Licence purchases: company name, VAT number(s), billing address, country, optional Peppol ID and purchase order reference, e-mail address, the licence key issued, the payment status and, for EU companies outside Belgium, the result of the VAT number check in the European Commission’s VIES system. We never see your card or bank details: payments are handled by Mollie.
  • Contact messages: name, e-mail, company, phone (optional), your message, and technical data used against spam (IP address, browser, time).
  • API accounts (by invitation only): name, e-mail, password (stored hashed), API tokens and usage counters.
  • Uploaded invoices: files sent to UBLKIT Online or to the API (UBL/XML, PDF), which may contain personal data of customers or suppliers.
  • Technical data: server logs and IP addresses for security and performance.
  • Cookies: essential cookies; analytics or marketing cookies only with your consent.

3. Why we process (lawful bases)

  • Your request / contract: sending the download link you asked for, selling and delivering a licence, running your API account, converting the files you upload.
  • Legitimate interest: knowing who actually downloads and tries UBLKIT (to support users and follow up the 30-day evaluation), preventing abuse and spam, and keeping the services secure. You can object at any time.
  • Legal obligation: invoicing, bookkeeping and VAT rules (including the VIES check that justifies reverse charge).
  • Consent: non-essential cookies; you can withdraw it via the cookie banner.

We do not use your e-mail address for newsletters or advertising, and we do not sell or share it.

4. How we use uploaded invoices

Uploaded files are processed only to produce the requested result (UBL/XML ↔ PDF) or to display them. Originals are not altered, and their content is not used for anything else: no analysis, no resale, no training.

5. Retention

  • UBLKIT Online files: deleted automatically 28 days after your last activity; you can delete them earlier yourself.
  • Download requests: 12 months, then deleted automatically. The link itself expires after 7 days and works for one download.
  • Licence purchases and invoice data: as long as Belgian accounting and tax law requires.
  • Contact messages: as long as needed to answer and follow up your question; messages filtered as spam are deleted after 30 days.
  • API accounts: until the account is closed.
  • Technical logs: a short period for security (typically up to 90 days, longer only when needed for an investigation).

6. Who processes data for us

We use the following processors, under data processing agreements:

  • Hetzner Online (Germany): hosting of the website and database.
  • Scaleway (France): storage of uploaded files and of the desktop installers.
  • Mailgun (EU region): sending e-mails such as download links and licence keys.
  • Mollie (the Netherlands): payments for licences.
  • European Commission – VIES: checking the VAT number of EU companies outside Belgium.

Data is stored and processed in the European Union. We do not sell personal data.

7. Security

  • HTTPS everywhere; passwords and personal links (download links, invitations) are stored only as hashes.
  • Access to the back office is limited and protected with two-factor authentication.
  • Files are stored under non-guessable identifiers and served through short-lived links.

8. Your rights (GDPR)

You can ask for access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interest (for example the download tracking). You may also lodge a complaint with the Belgian Data Protection Authority or your local authority.

9. Cookies & profiling

Essential cookies keep the service working (for example your session and your online upload folder). Analytics or marketing cookies run only with prior consent; you can withdraw it via the cookie banner or your browser settings. We make no automated decisions with legal effect.

10. Data breaches

We assess and contain incidents. When a personal data breach poses a risk, we notify the supervisory authority within 72 hours and inform the people concerned when required (GDPR Articles 33 and 34).

11. Children

Our services are meant for businesses and professionals, not for children.

12. Changes

We update this notice when our services change; the date at the top shows the latest version. Important changes are announced on the website or by e-mail to the people concerned.

13. Contact

Questions or requests about your data: info@ublkit.be. Supervisory authority: Belgian Data Protection Authority (https://www.dataprotectionauthority.be/).

Ulixes Consulting BV, Elegemstraat 186, 1700 Dilbeek, Belgium.