Privacy
Last updated:
This page explains what personal data CastlesERP holds, why, and what you can ask us to do about it. If you are here because your business appears in our system and you never signed up for anything, the section on the business register is the one you want. If you are here from an invitation email you were not expecting, go to the section on invitations.
Who we are
CastlesERP is business software operated by Line20, based in Belgium. For most of what this page describes, we are the data controller — we decide why and how the data is used. The exception is anything an organisation using CastlesERP decides for itself: the records it keeps about its own customers and suppliers, and who it invites to join it. There we act on that organisation’s instructions, and the section on invitations explains how the two roles divide.
We run on our own servers in the European Union. Personal data described here is not transferred outside the EU/EEA.
The Belgian business register (KBO/CBE)
We keep our own copy of part of the Belgian Crossroads Bank for Enterprises, the public register of businesses published by the FPS Economy. We use it for one thing: when someone using our software types a business name or a company number, we show the registered details, so the name, number and address are entered correctly instead of typed from memory.
Most entries in that register are companies, and data-protection law does not apply to companies. But a sole trader is registered as a natural person, and a sole trader’s registered address is often a home address. So for those entries this is personal data, and the rest of this section is addressed to you.
We did not get this data from you. We took it from the public register — which is why the law requires us to tell you here, rather than write to each person individually.
- What we hold
- The registered name, the enterprise and VAT number, the registered address, the activity code, the status and the legal form.
- What we deliberately do not hold
- Directors and their private addresses, dates of birth, financial data and shareholders. The register publishes these; we do not copy them, because we do not need them to identify a business.
- Why we may do this
- Our legitimate interest in accurate business data (Article 6(1)(f)). We weighed that against your interests: the register is published by the state for exactly this kind of identification, the details concern you as a trader rather than privately, we keep only the identity minimum, and we do no profiling, scoring or enrichment.
- How long we keep it
- Our copy is replaced each time we refresh it, and we keep only the three most recent editions. If our copy goes stale beyond a set age, we stop using it rather than serve out-of-date details.
- What we never do with it
- We do not use it for marketing, we do not sell it, and we do not pass it to anyone else. The register’s own licence forbids marketing reuse of sole traders’ data, and our copy is readable by exactly one part of our software — the part that fills in a business’s details.
If you are in the register and would rather not be in our copy
You can object, and you can ask us to erase you. Because we rely on legitimate interest rather than your consent, an objection is a real right and not a request we can simply weigh up and decline at will.
When we erase you, we record it permanently, so that the next time we refresh our copy from the register your details are not silently pulled back in. That is deliberate: an erasure that undoes itself the following night would not be an erasure.
One thing we cannot do is correct the register itself. If a detail about your business is wrong, it needs correcting at the source — through the Crossroads Bank for Enterprises — and the correction reaches our copy automatically the next time we refresh it. If you tell us, we will point you to the right place, but we cannot change what the register says.
To object or ask for erasure, email us with the business name or company number. We will confirm within a month.
Checking a VAT number
When a business is added to an organisation’s records, we can check the VAT number against a live registry. We send the VAT number and nothing else — no name, no address. We ask the European Commission’s official VIES register first. If VIES cannot answer, which happens because individual countries’ systems go offline, we fall back to a free third-party service that wraps the same register.
We do not run this check when it cannot tell us anything new, so a number is not sent for the sake of it. Business names are never sent anywhere: searching by name only ever searches our own copy of the register.
If you use CastlesERP
When you sign up, we hold your name, email address, which organisations you belong to and what you are allowed to do in them. We hold it to provide the service you asked for, we keep it for as long as your account exists, and we erase it on request.
We also keep a record of significant actions — who did what, and when — so that questions about what happened in an account can be answered. That record refers to people by an internal reference, holds no content, and stops naming a person once that person is erased.
The business records you create in CastlesERP — your customers, suppliers and contacts — belong to your organisation, and your organisation decides what happens to them. For those records you are the controller and we act on your instructions. Your organisation’s administrators have tools in the app for handling access and erasure requests about them.
If someone invited you to CastlesERP
Someone can be added to an organisation on CastlesERP by being invited to it. If that happened to you, we hold your email address because the organisation that invited you typed it in — you did not give it to us, and you may not have been expecting the email at all.
We hold the address, the role you were offered, which organisation invited you, who sent it, and the times. We do not ask for your name until you accept. The link in the email is stored only as a fingerprint, never in a readable form, so holding the link is what proves the invitation is yours.
It is held for 14 days from the most recent invitation email. Sending the invitation again restarts that period, so an invitation someone keeps renewing is held for as long as that continues. If you accept, the address becomes part of your account and the section above applies instead. If nobody accepts, it is deleted.
Two different parties decide two different things here, so it is worth knowing whom to ask. The organisation decided to invite you and can withdraw the invitation — ask them, and the address is deleted straight away. We decided how long an unaccepted invitation is kept and that repeat sends to the same address are limited; write to us about those, or to object to them. You can also complain to the Belgian Data Protection Authority.
Your rights
Whoever you are, you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to erase it, ask us to restrict what we do with it, and object to processing we base on legitimate interest. Where we hold data because you asked us to provide a service, you can also ask for it in a portable form.
We will answer within one month. If you are not satisfied, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels.
Contact
For anything on this page — access, correction, erasure, objection, or a question about the business register copy — email us. Please include the business name or company number if your request is about a register entry.