Privacy policy

Language of this version

This English text is a translation provided for your convenience. Only the French and Dutch versions of these documents have legal force; in case of any discrepancy, divergence of interpretation, or dispute, the French or Dutch version prevails.

The articles below carry the same numbers as the French version, so that any reference remains usable. Both authoritative versions are available in the app and on kadoz.app.

Who processes your data

GM Concept SRL, registered with the Belgian Crossroads Bank for Enterprises under number 0842.900.801, with its registered office at avenue Herrmann-Debroux 40, 1160 Auderghem, is the controller within the meaning of Regulation (EU) 2016/679.

For any question concerning your data: hello@kadoz.app.

Kadoz is not required to appoint a data protection officer: the processing does not constitute regular and systematic monitoring on a large scale within the meaning of Article 37 of the Regulation.

What we collect

When the account is created: your email address and a username.

Optionally, if you provide them: a profile photograph, a telephone number, a default address, your language and your gender.

When you publish an object: the photographs, the title, the description, the category, the condition, the exact address and the corresponding coordinates.

When you exchange messages: the messages in the conversation thread, public questions and answers, reservations, and the timestamped record of address consultations.

Automatically: the date of your last sign-in, and technical events necessary for the operation and security of the service.

We collect no special category data within the meaning of Article 9 of the Regulation. Gender, which is optional, is used only in aggregate form.

On what legal basis

Performance of our contract with you, for everything that makes the service work: account, publication, search, reservation, handover, messages.

Our legitimate interest, for the safety of exchanges: the address consultation log, the handling of reports, the prevention of abuse and moderation. That interest is balanced against your rights, and is limited to what is necessary for strangers to be able to meet without unreasonable risk.

Our legitimate interest also, to produce aggregate statistics on diverted volumes for institutional partners. Those statistics contain no data allowing you to be identified.

Your consent, for the optional information in your profile and for access to your location, which you may withdraw at any time.

Compliance with legal obligations, where a competent authority addresses a well-founded request to us.

Your address, in detail

The exact address of your objects is stored separately from the rest of the listing, in a table to which access is denied by default and opened only by explicit rules.

On the map, the position displayed is randomly offset by 120 to 180 metres. That offset is computed by the server at the time of publication: the app does not know it and cannot undo it.

The exact address is accessible only to you; to the person with whom you have explicitly shared it; and to the person who received the object, for their history.

Every consultation is timestamped, attributed to its author, and visible to you.

Your photographs

The metadata of the photographs you publish is stripped before upload, including the GPS coordinates of where the picture was taken. Without that step, anyone downloading the image could deduce your address.

Photographs of objects are publicly visible: they have to be, for the object to find a taker. Avoid including people, documents, or anything that would identify your home.

For how long

Your account is kept for as long as it exists. An account inactive for three years is deleted after prior notice.

Objects withdrawn or expired are deleted after 30 days. Objects given away are kept for your history and for the statistics.

Messages are deleted 12 months after the handover or the cancellation.

The address consultation log and the technical events are deleted after 13 months.

Reports and moderation decisions are kept for 3 years, the period necessary to defend our rights and to handle any appeal.

Who else has access

Supabase, for the database, authentication and file storage. Hosted in Frankfurt, Germany.

Resend, for sending sign-in and notification emails.

The official mapping service of the Brussels-Capital Region, queried to convert an address into coordinates. That query transmits neither your identity nor your account.

Nominatim, the geocoding service of the OpenStreetMap Foundation, queried for addresses outside the Brussels-Capital Region. The query transmits only the street, the number and the postcode: not your identity, not your account, not your email address.

These providers act as processors, on instruction and with no right to use your data for their own purposes.

The data of your account and of your items is hosted in the European Union. Only the geocoding query, for an address outside Brussels, is sent to the OpenStreetMap Foundation, whose servers are located in the United Kingdom and in Germany. It contains only a postal address, with no link to your account.

The website's typeface is served from our own domain: your browser contacts no third-party server.

We do not sell, rent or exchange any data. Disclosure to an authority takes place only on a legally founded request.

What other users see

Your username, your profile photograph if you have set one, the number of objects you have given away and the date your account was created.

The objects you publish, with their blurred position and the locality.

Your public questions and answers, under your username.

Never visible: your email address, your gender, your default address. Your telephone number is passed only to the person whose request you have accepted, and only if you have provided it.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time.

Two buttons in your profile let you exercise them directly: "Export my data" hands you all of your information in a readable, reusable format, and "Delete my account" erases your personal data.

On deletion, your current listings are withdrawn, the people who had reserved them are notified, and your profile is anonymised. The volumes you diverted remain counted in your municipality's statistics, but nothing any longer leads back to you.

For any request, write to hello@kadoz.app. We reply within one month.

If you consider that your rights are not being respected, you may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), rue de la Presse 35, 1000 Brussels, or with the authority of your place of residence.

Security

Exchanges are encrypted in transit. Access to data is governed at database level by rules that deny by default and authorise only explicitly.

Authentication is passwordless, by one-time code sent by email: there is therefore no password to steal.

In the event of a data breach likely to create a risk to your rights, we will inform the Data Protection Authority within 72 hours and, if the risk is high, inform you directly.

Minors

The service is restricted to persons aged at least 16. We do not knowingly collect data concerning anyone younger.

If you notice that someone under 16 is using the service, write to us at hello@kadoz.app: the account will be deleted and the data erased.

Changes to this policy

This policy may be amended. Any substantial change will be flagged to you in the app. The date of the last update appears at the top of this document.