Privacy Policy
Last updated: 14 October 2026
1. Controller
This policy explains how personal data is processed through the SensorHub website and client platform, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). The controller is:
SensorHub
2. Data we process
- Contact requests: full name, job title, company name, activity, business email, company website, project description, the language of the form, and the IP address and time of submission.
- Client accounts: name, business email, company details, login history and verification codes.
- Platform data: sensor readings, device identifiers, site locations and descriptions, actions and notes entered by users. This data mainly concerns sites, environments and equipment; it may relate to an identifiable person when linked to a client or user.
- Occupancy and people-flow data: where a project measures presence or footfall, the sensor setup and the data collected are defined per project with the client, who is responsible for informing the people concerned. The client is the controller of that data and SensorHub acts as processor under a data processing agreement.
- Technical data: server logs (IP address, date, requested page) needed to operate and secure the service.
- Anti-robot check: the contact form asks your browser to solve a short computing task on our own server to block automated spam. No third-party service, cookie or tracking is used, and no personal data is collected by this check.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Answer contact requests and prepare proposals | Steps prior to a contract at your request (6.1.b); legitimate interest in business development (6.1.f) |
| Provide the Platform, accounts and support | Performance of a contract (6.1.b) |
| Secure the website and Platform, prevent abuse | Legitimate interest (6.1.f) |
| Invoicing and accounting | Legal obligation (6.1.c) |
We do not sell personal data, and we do not use it for automated decisions that produce legal effects for you.
4. Recipients
Personal data is accessible only to authorised SensorHub staff and to the following categories of service providers acting on our instructions:
- hosting and database providers;
- email delivery provider (verification codes, account and contact emails);
- sensor connectivity and data storage providers (Platform data);
- an AI service provider (OpenAI), used to generate written interpretations of sensor data inside the Platform. Only the technical data needed for the interpretation is sent;
- a weather data provider (Open-Meteo), which receives site coordinates only, to return weather history and forecasts.
Data may be disclosed to authorities where required by law.
5. Transfers outside the EEA
Some providers may process data outside the European Economic Area. In that case, transfers rely on an adequacy decision of the European Commission or on the Standard Contractual Clauses, with additional safeguards where needed.
6. Retention
- Contact requests: 24 months after the last exchange, unless a contract follows.
- Client account and Platform data: for the duration of the contract, then deleted or returned within 90 days, unless a longer period is agreed in writing.
- Accounting records: for the period required by law.
- Server logs: up to 12 months.
7. Security
We apply technical and organisational measures appropriate to the risk, including encrypted connections, access restricted per role, verification codes at login and hashed passwords.
8. Cookies
The public website does not use analytics, advertising or tracking cookies. When you sign in to the Platform, one strictly necessary session cookie (connect.sid) is set to keep you logged in. It expires after 24 hours or when you log out. No consent is required for this cookie.
9. Your rights
You have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. Where processing is based on consent, you may withdraw it at any time. To exercise your rights, contact the contact form. We reply within one month.
You may also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, or with the supervisory authority of your country of residence.
10. Changes
We may update this policy. The current version is always published on this page with its date.