Privacy statement platform

 

Last update: 1 October 2026

1. Introduction

This privacy statement describes how Billit (hereinafter "Billit", "we", "us") collects and processes personal data on or in connection with its e-invoicing platform (the “Platform”) and in the context of our (customer) relationship.

You are typically a user of the Platform, authorized by a client, or by Billit itself.

We consider the protection of your privacy extremely important and wish to inform you (as a user of our Platform) about how we process your personal data in order to enable you to maintain control over your personal data.

Billit makes every effort to protect your personal data in accordance with Belgian and European data protection regulations, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") (together, the "Applicable Data Protection Legislation").

Please read this privacy statement carefully. It not only describes your rights, but also how to exercise them. By using our Platform, sharing your personal data, and/or agreeing to this statement, you acknowledge that you have read and agree to the way we collect and process your personal data.

2. Who are we and how can you reach us?

Billit is a public limited company incorporated and existing under Belgian law.

Company name Billit NV
Address Oktrooiplein 1 box 302, 9000 Ghent, Belgium
Company number 0563.846.944 (RPR Ghent, section Ghent)

Billit acts – depending on the processing activities it carries out under this privacy statement - as:

  • Controller: this is the party who determines the purpose and means of the processing activity; or
  • Processor: this is the party acting on behalf of and on the instructions of a controller (i.e. a client of Billit).

Billit has appointed a data protection officer whom you can contact for questions regarding this privacy statement, your privacy and how Billit processes your personal data.

Contact dpo@billit.eu

3. What categories of personal data do we collect and process?

Depending on the data you share with us and the functionalities you use on our Platform, Billit processes different categories of personal data.

If we process personal data, this may include the data below:

  • Identification and contact data (such as: first name and surname, telephone number, e-mail address, company name, job title, (company) address, company registration and VAT number (if applicable));
  • Login data (such as the details used to log in to the Platform including username and password);
  • Account data (such as data used to create an account on the Platform such as username, company name and other information uploaded to your account to personalize it, including all documents, data and other information, that you yourself or Billit’s client, upload(s), make(s) available or share on the Platform or that are generated by or result from your use of our Platform or services, e.g. by using the interactive functionalities on the Platform);
  • Payment data (such as data required to process payments for the use of our services and Platform (as applicable) and for our business administration, such as (bank) account number, IBAN/BIC, credit card details, summary of outstanding payments, payment history);
  • Professional data (such as profession, company you work for, job title, (business) address, company registration and VAT number);
  • Technical data (such as information about your computer, mobile and other devices (such as your IP address, user ID, operating system, browser type);
  • Usage data (such as information about your use of our Platform, including history, log files, date, time, location, frequency, duration of pages viewed, consent preferences, language preferences, information about consent(s) you have given (such as the date and time of your consent)); and
  • Any other categories of personal data as identified below in article 4.

In principle, the personal data we process are obtained directly from you or are automatically collected by us (in the case of technical or usage data).

We kindly request you to:

  • only upload to the Platform accounting or business-related data, files, documents and information, consistent with the intended purpose of the Platform. You shall refrain from uploading any other types of data and information (including, without limitation, data unrelated to your professional activities or household data, etc.);
  • refrain from sharing special categories of personal data (such as, but not limited to, health related data, data regarding your sexual orientation, trade union membership, religious beliefs, etc.). In case you do provide us with such personal data we understand you have the intent of manifestly making this personal data public (in accordance with Article 9.2 (e) GDPR) and we can process such personal data to carry-out the purpose of processing for which you share this personal data and as listed below.

4. For what purposes are these data used, on what basis and for how long?

4.1 General

Depending on your use of our Platform, our services, the information you share with us and our (customer) relationship, Billit processes personal data for the purposes specified in this article 4. Please note that our Platform and services may evolve and more features may be added from time to time. In that case, the overview in the tables below may also evolve and will be updated where necessary in accordance with article 16, seeking your additional consent if required.

For certain processing purposes, Billit requires your consent. The consent you give is always free and without charge, and you have the right to withdraw it at any time. You can withdraw your consent by sending an email to dpo@billit.eu. The withdrawal of your consent does not affect the processing of personal data carried out prior to such withdrawal or our processing activities based on another legal ground.

4.2 Billit as data controller

This article 4.2 describes the purposes for which we process your personal data in the capacity of data controller, such as when you use our Platform or in the context of our (customer) relationship.

The controller (i.e. in this case Billit) is the party that determines the purposes and means of the processing activities.

Billit may process your personal data as a data controller for the following purposes:

Purpose Category of personal data Legal grounds Retention period

Registering and creating a user account on the Platform, and to ensure that you can log in to the Platform via your user account and use the Platform.

For these processing activities you are typically an employee, freelancer, consultant or other representative of Billit or a client of Billit who has entered into an agreement with Billit to use the Platform and has invited you to do so.

For more information on how we process your personal data through our Platform, please refer to article 4.3 below.

Identification and contact data

Login data

Account data

Professional data

Technical data

 Performance of a contract

For as long as necessary to perform the agreement concluded between Billit and the organization on whose behalf you use the Platform.

In any case, your personal data will be deleted no later than (i) ten (10) years after the termination of the agreement with your organization; or (ii) ten (10) years after your last login to the Platform; unless personal data must be retained longer under applicable laws or cf. this privacy policy.

Please note that, in certain cases, the organization that gives you permission to use the Platform may delete your user account before the above retention periods have been observed (e.g. if you are no longer employed by this organization).
To manage the security of our Platform and systems (such as by retaining security logs for fraud detection and cybersecurity purposes).

Identification and contact data

Account data

Usage data

Technical data

Any other information stored via our logs

 Legitimate interest and legal obligation (as applicable) As long as necessary to protect the legitimate interests of Billit or as long as required under applicable laws.
To acquire analytical and statistical insights to organize and improve our services, Platform and your user experience.

Technical data

Usage Data

Any additional information you share with us while providing feedback on our Platform, systems and services

Consent (given via the cookie banner on our Website)

You are always free to decide whether or not to give your consent. You have the right to withdraw your consent free of charge at any time by sending an email to dpo@billit.eu.

The retention period ranges from the duration of a session or Platform visit, to as long as your consent is not withdrawn.

For information on the retention period of personal data processed via cookies, please refer to our cookie policy available via our Platform and on our Website.
To evaluate your feedback and improve your customer experience and our service offering (e.g. by responding to surveys after using our services).

Identification and contact details

Any feedback you share with us.

 Legitimate interest As long as necessary to protect the legitimate interests of Billit.
Performance of Billit’s accounting and (business) administration (including tracking payments and outstanding balances) as well as managing our (customer) relationship and handling any complaints.

Identification and contact data

Payment data

Any additional information you share with us (in connection with a query, complaint or dispute)

 Performance of a contract or legitimate interest (as applicable)

Up to ten (10) years after the end or termination of our (customer) relationship; or

For as long as necessary to pursue the legitimate interests of Billit.
To comply with our legal obligations (including responding to requests from data subjects, respecting your (consent) preferences, complying with our anti-money laundering and know-your-customer obligations and protecting the rights of others).

Identification and contact data

Usage data

Payment data

Technical data

Any additional information you share with us in connection with a query, complaint or dispute

Other personal data (this depends on the relevant legal obligation)

 Legal obligation

Up to ten (10) years after the expiry or termination of our relationship; or

As long as required by law.
For strategic and organizational decision-making (such as optimization of business processes, reorganizations, mergers, acquisitions, restructuring).

Identification and contact data

Professional data

Payment data

Technical data

Usage information

Other personal data (depending on the strategic decision), in any event in accordance with the principle of data minimization.

 Legitimate interest Up to five (5) years after the expiry or termination of our (client) relationship, unless a longer retention term is necessary to achieve our legitimate interests

For direct marketing purposes (such as sending promotional emails about our services, features, special offers, events, and other information we think may be of interest to you) and for sending newsletters (if you have subscribed to them).

You have the right to object, at any time and free of charge, to the processing of your personal data for direct marketing purposes, including profiling insofar as it relates to such direct marketing, by sending an email to dpo@billit.eu.

Identification and contact data

Professional data

Technical data

Usage information

Consent or legitimate interest (as applicable)

The consent you give is always voluntary

As long as your consent is not withdrawn

Your personal data will in any case be deleted as soon as we determine that your contact details are no longer in use

For information about the retention period of personal data processed via cookies, please refer to our cookie policy.

For more information about the specific retention period, you can always contact us by email to: dpo@billit.eu.

4.3 Billit as processor

This article 4.3 describes the purposes for which we process your personal data in the capacity of processor when you use our Platform at the invitation of Billit or a client of Billit.

Billit primarily processes personal data through the Platform as a processor, as determined by and under the instructions of Billit’s clients. The processor (i.e. in this case Billit) is the party that acts on behalf of and under the instructions of a controller (i.e. in this case Billit’s clients).

In this scenario, you are typically a user of the Platform authorized by a client of Billit to use the Platform, such as an employee, independent service provider, or other representative of a Billit client.

The processing activities that take place through the Platform depend on the functionalities and features included in the license purchased by Billit’s client who authorized you to use the Platform. This may differ for different Billit’s clients to suit their internal operations. This article therefore only describes in a generic way the personal data that might be processed through the Platform. For more information about the specific processing activities, we recommend you to contact Billit’s client who authorized you to use the Platform directly. The relevant Billit client is obliged to inform you in more detail about the processing activities they carry out through the Platform.

Billit may process your personal data as a processor for the following purposes:

Purpose Category of personal data Legal grounds Retention period

For the provision, operation and use of the Platform and for executing the agreement with the organization granting you access to the Platform, such as:

  • to create, grant access to and login to the correct user accounts;
  • for management of user accounts;
  • to make use of the e-invoicing, billing and other functionalities available in the Platform.

    Depending on the usage of the (interactive) functionalities and functions different personal data may be processed, e.g. for:

    1. collecting and storing client’s customer, vendor and transaction details in a digital format for e-invoicing;
    2. generating, validating and sending e-invoices to client recipients;
    3. exchanging invoices with other systems or stakeholders upon the client’s request (e.g. accountants, clients, etc.); and
    4. to integrate invoicing systems and software with the PEPPOL network and other e-invoicing networks (via the Billit access point PEPPOL) to send and receive e-invoices.
    5. sending, answering and completing service and information requests to/from other users of the Platform;
    6. facilitating and coordinating interaction between different Platform Users, including managing the creation of, sending and payment of digital invoices;
    7. etc.

As part of these activities, personal data may be shared with other users of the Platform.

If you would like more information on which personal data are processed and for what purposes when using a particular feature, please contact dpo@billit.eu.

Identification and contact data

Account data

Professional data

Usage data

Payment data

Technical data

Any other information or data you provide/upload or that are generated as a result of your use of the Platform

 Performance of a contract

The retention period varies from as long as the duration of a Platform visit, to as long as necessary for the performance of the agreement concluded between Billit and the organization on whose behalf you use the Platform.

In any case, your personal data will be deleted no later than (i) ten (10) years after the termination of the agreement with your organization or (ii) ten (10) years after your last login to the Platform unless personal data must be retained longer under applicable laws or cf. this privacy policy.

Please note that, in certain cases, the organization that gives you permission to use the Platform may delete your user account before the above retention periods have been observed (e.g. if you are no longer employed by this organization).
Provision of assistance and support, and to answer questions related to (the use of) the Platform, in order to provide you with information and enable communication with you.

Identification and contact data

Account data

Professional data

Any other personal data shared or provided during our contact and/or provision of the support services

 Performance of a contract

For as long as necessary to contact you and/or to provide support services.

In any case, your personal data will be deleted no later than ten (10) years after the termination of the agreement with the organization authorizing you to use the Platform or ten (10) years after our last contact, unless personal data must be retained longer under applicable laws or cf. this privacy policy.
To provide you with information about how to use the Platform and to enable communication with you.

Identification and contact data

Account data

Professional data

Any other personal data shared or provided during our contact

 Performance of a contract

For as long as necessary to contact you, unless a longer retention term applies under applicable laws.

In any case, your personal data will be deleted no later than ten (10) years after the termination of the agreement with the organization authorizing you to use the Platform or ten (10) years after our last contact, unless personal data must be retained longer under applicable laws or cf. this privacy policy.

For more information about the specific retention period, you can always contact us by email at: dpo@billit.eu.

In relation to the above processing activities, we process your personal data on the legal ground determined by the organization that authorized your use of our Platform and on whose behalf you use the Platform, including to enable us to fulfil our contractual obligations under the commercial license agreement entered into with the aforementioned organization. The applicable legal ground is determined by your organization. If you would like more information on the legal grounds for processing, we recommend that you contact your organization directly, which as the data controller, is responsible for including such legal grounds in its own privacy statement.

5. Personal data of third parties

When you share personal data of third parties with us, you guarantee that you have informed those third parties and have obtained their consent, or that you have another legal ground to share that third party's personal data with us.

6. Cookies

Our Platform uses cookies and similar technologies. For more information, please refer to our cookie statement on our Platform.

7. Who do we share your personal data with?

To fulfil the purposes described above in article 4, it is sometimes necessary for us to share your personal data with the following third parties:

  • Service providers (who are responsible for hosting our Platform, our IT infrastructure and security, payment services, e-mail and communication providers, etc.);
  • Other users of the Platform with whom you wish to connect;
  • Our professional advisers (such as lawyers, accountants, insurers, and auditors);
  • Consultants, freelancers, independent service providers and other subcontractors generally engaged by Billit to provide services to Billit in connection with its Platform;
  • Supervisory authorities (upon request of the relevant entity);
  • Affiliated entities; and/or
  • Third parties to whom we wish to sell, transfer or merge (parts of) our shares, business or assets.

A more detailed list of engaged sub-processors can be found on https://www.billit.eu/en-int/subprocessors/ (as may be updated from time to time).

Upon request, we will inform you as soon as possible about the third parties with whom your personal data have been shared by providing you with a more detailed list.

In addition, we may disclose your personal data if required by law, or if we determine in good faith that such disclosure is necessary during a legal dispute or to protect our rights.

Our processors and subprocessors always act under our responsibility. If we engage subprocessors, this will always be done in accordance with a data processing agreement that meets the requirements of the Applicable Data Protection Legislation and protects your personal data in the best possible way. If we share your personal data as described above, we will provide appropriate safeguards to protect its integrity and confidentiality.

Your personal data will only be provided to (sub)processors, employees and other third parties on a need-to-know basis, limited to the extent necessary for the performance of their services.

8. International transfers to countries outside the European Economic Area

In principle, we do not transfer your personal data to third countries outside the European Economic Area ("EEA"), unless you are located outside the EEA and visit our Platform outside the EEA. We may also transfer your personal data to countries outside the EEA via our processors or subprocessors. In that case, we will only transfer your personal data outside the EEA in compliance with the Applicable Data Protection Legislation and subject to appropriate safeguards.

Please contact us if you would like more information about the specific mechanisms we use for transferring personal data to countries outside the EEA.

9. Retention of personal data

We retain personal data only for as long as reasonably necessary to fulfil the purposes and in accordance with the retention periods set out in article 4 of this privacy statement, including to comply with legal, regulatory, tax, accounting or reporting obligations. We may retain personal data for a longer period in the event of a complaint or if we reasonably believe that a legal dispute is likely to arise regarding our relationship.

After that, personal data may still be present in our backups or archives, but will no longer be actively processed in a file. Such backups or archives are deleted in accordance with our backup and archiving policy.

The applicable retention periods are listed in the table under article 4.

10. Personal data security

We have implemented appropriate technical and organizational measures, safeguards and guarantees to protect your personal data in accordance with the Applicable Data Protection Legislation, in particular to protect your personal data from loss, misuse, or unauthorized alteration or destruction.

If you would like more information about the specific measures we have implemented, please contact us by sending an email to: dpo@billit.eu.

Despite the measures we take, you should be aware that there are always risks associated with sending personal data over the internet. The security and protection of your personal data can never be fully guaranteed, nor can we guarantee that unauthorized third parties will never be able to bypass these measures or use your personal data for improper purposes.

11. What are your rights and how can you exercise them?

Within the limits of the Applicable Data Protection Legislation, you have the following rights:

  • Right of access and information: you have the right to obtain confirmation from us as to whether or not we process your personal data and to access the personal data we hold about you, and to request a copy.
  • Right to rectification: if you notice that we process incorrect or incomplete personal data about you, you have the right to request that they be rectified or completed.
  • Right to erasure (or "right to be forgotten"): in certain cases, you have the right to obtain erasure of your personal data (e.g. if your personal data are no longer necessary for the purposes for which we collected them).
  • Right to object: in certain cases, you have the right to object to the processing of your personal data.
  • Right to restriction of processing: in certain cases, you can ask us to restrict the processing of your personal data (e.g. while we verify the accuracy of your personal data and amend them if necessary).
  • Right to data portability: in certain cases, you have the right to obtain your personal data in a structured, commonly used and machine-readable form, and to transfer it (or have it transferred) to another data controller.

Exercising your rights is, in principle, free of charge. Only in case of unreasonable or repeated requests we reserve the right to charge a reasonable administrative fee or reject your request. We always inform you of the amount before we charge it.

You can exercise your rights by contacting us at: dpo@billit.eu.

To help you as efficiently as possible, we always ask you to specify which right you wish to exercise and to describe your request as clearly as possible. Please note that in some cases we will request additional information to make sure we deliver the information to the right person.

If you contact us to exercise your rights, we will reply within one month. Exceptionally, this period may be extended (up to a maximum of (3) three months), but we will inform you of the reasons why within one month.

12. Your right to lodge a complaint with the supervisory authority

If you believe that our processing of your personal data does not comply with the Applicable Data Protection Legislation, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you habitually reside, work or where the alleged breach of the Applicable Data Protection Legislation occurred.

In Belgium, the Data Protection Authority is the competent supervisory authority:

www.gegevensbeschermingsautoriteit.be

Drukpersstraat 35, 1000 Brussels, Belgium

+32 (0)2 274 48 00

contact@apd-gba.be.

However, we would appreciate the opportunity to resolve your concerns before you contact the Data Protection Authority. We therefore kindly ask that you contact us at dpo@billit.eu.

13. Third-party links

Our Platform may contain links to third-party applications and websites. If you are redirected to another website, platform or application via our Platform, different terms and conditions, privacy and cookie statements may apply. Billit is not responsible for the content of these applications and websites and is not responsible for the privacy standards and practices of such third parties. We recommend that you read the relevant privacy and cookie statements of these third parties before accepting their cookies and visiting their applications and/or websites, to ensure that your personal data is adequately protected.

14. Liability

If we have lawfully transferred your personal data to a third party (who is not one of our (sub)processors), we are not liable for any unlawful processing or use by that third party.

In any case, Billit is only liable for the damage caused by the processing of personal data if it failed to comply with the specific obligations of the Applicable Data Protection Legislation. Under no circumstances shall Billit be liable for any special, incidental, indirect or consequential damages or losses.

To the maximum extent permitted under applicable law, Billit's liability under this privacy policy is limited to the amounts actually paid out under its professional liability insurance for the event causing the damage.

You agree, to the maximum extent permitted under applicable law, not to hold Billit's directors, contractors, subcontractors, representatives, appointees, employees, and other agents personally or directly liable for or in connection with the usage of the Platform or related services. In this regard, you waive any non-contractual claims against the aforementioned persons. Any (liability) claim for or in connection with the performance of the services, your use of the Platform, or the processing of your personal data (including any non-contractual liability claim) shall only be brought against Billit.

15. Amendments to this privacy statement

We may update this privacy statement at any time. Any changes we make will be announced on our Platform (e.g. via a “pop-up”). The date of the most recent version is visible at top of this privacy statement. Please review this statement regularly to be aware of any changes that may affect you.

Amended versions of this privacy statement will come into force fourteen (14) calendar days after publication on the Platform and will, if necessary, always be submitted for approval. If amendments are required to comply with a legal obligation, such amendments will take effect immediately.

16. Applicable law and jurisdiction

This privacy statement is governed by, interpreted and enforced in accordance with Belgian law.

The courts of Antwerp, section Antwerp have exclusive jurisdiction to adjudicate any dispute that might arise from the interpretation or implementation of this privacy statement, without prejudice to the consumer's right to bring a dispute before a competent court on the basis of a mandatory legal provision.

Billit cookies logo

Choose your cookies!

Billit uses technologies such as cookies on its website. Functional cookies are necessary for the proper functioning of the website and cannot be refused. Billit also uses cookies to improve this website and for other purposes such as personalized advertising on partner channels if you give your consent. In that case, certain personal data (such as information about your use of our website, IP address, etc.) will be processed as described in our cookie policy. You can withdraw your consent at any time via the cookie management tool at the bottom of our website.

Strictly necessary technical cookies arrow up

It is not possible to refuse these cookies. They are used to enable certain essential functions (such as logging in). Without these cookies, there would be no website...

Strictly necessary functional cookies arrow up

These cookies are used to enable user functionalities like your language choice or whether a menu has been opened. These cookies can’t be refused. 

Analytical cookies arrow up

These cookies are used to analyse our website. This helps us see what does and does not work and offer you an even better browsing experience. 

Marketing cookies arrow up

These cookies analyze visitors’ browsing behavior and are used for marketing purposes and personalized advertising. They ensure that ads better match your interests. Depending on your settings, you may see both personalized and general (non-personalized) ads.