Version 0.1 · Last updated: October 01, 2026

1. Who we are

Fluxeye is the water monitoring and sampling management application of iFLUX. The data controller for the personal data described in this policy is:

iFLUX NV
Galileilaan 18
2845 Niel
BE0683854156

For all questions about privacy or this policy you can contact us at dpo@iflux.be .

2. Scope

This policy applies to the Fluxeye web application and its public quotation pages. It describes how we process personal data of the people who use Fluxeye (our employees, our customers and their contacts) and of visitors of its public pages.

Fluxeye processes quotations, projects and water monitoring and sampling data. Where we process data on behalf of a customer as part of a monitoring project, we act as a processor on the customer's instructions, as laid down in the agreement with that customer. In that case the customer's privacy policy applies as well.

3. Which personal data we process

• Account data: e-mail address, name, phone number, the organisation and projects you have access to, and your roles and permissions.
• Authentication and security data: your password (only stored as a secure hash), password history, failed login attempts and account lock status.
• Customer and quotation data: company name, address, VAT number, contact names, e-mail addresses, phone numbers and quotation details.
• Content you upload: documents, photos and attachments. Photos of installations may incidentally show people or private property.
• Location data: the coordinates and addresses of installation locations. These can relate to a person when an installation is located on private property.
• Technical data: when you visit Fluxeye our servers process your IP address, browser type and the requested pages in server logs.

4. Why we process your data and on which legal basis

Purpose	Legal basis (GDPR art. 6)
Giving you access to Fluxeye and providing the services agreed with your organisation	Performance of a contract
Securing the platform: authentication, preventing abuse, investigating security incidents	Legitimate interest (information security) and legal obligation
Sending service e-mails (password reset, account notifications, quotations)	Performance of a contract

We do not use your data for marketing, we do not sell it and we do not use it for automated decision-making or profiling.

5. Cookies

Fluxeye only uses cookies that are strictly necessary for the application to work:

• a session cookie that keeps you logged in until you log out;
• a security token to protect forms against cross-site request forgery.

We do not use analytics, advertising or tracking cookies. Because these cookies are strictly necessary, no consent is required.

6. Who we share data with

We only share personal data with service providers that help us operate Fluxeye, and only to the extent needed. They process the data on our behalf under a data processing agreement:

• Amazon Web Services (hosting, region Frankfurt, Germany)
• Mailgun (delivery of service e-mails)
• HubSpot (customer and contact details used in quotations)
• Teamleader (synchronisation of customer, quotation and project details)

When calculating travel distances and times for a quotation, our server sends the origin and destination addresses to Google Maps.

Measurement data may be forwarded to external systems (for example of the customer or a public authority) when the customer has asked us to do so. We may also disclose data when required by law or by a court order.

7. Transfers outside the European Economic Area

We store Fluxeye data within the European Economic Area. Some of the providers listed above are established outside the EEA or may process data outside it. In that case we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on the Standard Contractual Clauses of the European Commission.

8. How long we keep your data

• Account data: as long as your account is active. After your account has been closed we delete or anonymise it within 5 business days.
• Quotations, project data, measurement data, documents and photos: for the retention period agreed with the customer for the project.
• Server logs: two years

9. How we protect your data

iFLUX operates an information security management system following ISO/IEC 27001. Among other measures:

• all traffic to Fluxeye is encrypted (HTTPS);
• passwords are stored as secure hashes and must meet strength and renewal requirements;
• accounts are locked after repeated failed login attempts;
• access to data is limited on a need-to-know basis using roles and permissions;

10. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have your data erased, unless we still need it for one of the purposes above or are legally required to keep it;
• restrict the processing or object to processing based on our legitimate interest;
• receive your data in a structured, machine-readable format (data portability).

To exercise these rights, contact us at dpo@iflux.be . We will answer within one month. We may ask you to confirm your identity first.

If you are not satisfied with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be).

11. Changes to this policy

We may update this policy, for example when we add new features or providers. The version number and date at the top of this page show when it was last changed. We will inform users by e-mail or in the application about significant changes.