1. Who is responsible
The controller is:
- Company
- WhileLoop BV
- Registered seat
- Hundelgemsesteenweg 722B, 9820 Merelbeke-Melle, Belgium
- Enterprise number
- 0716.802.779
- Privacy questions and requests
- Contact form, subject Privacy and your data
2. Data from public sources
Checked shows data about companies from official public sources: the KBO register, the Belgian Official Gazette and the Central Balance Sheet Office of the National Bank of Belgium. That data also contains personal data: mainly the names and roles of directors, representatives, liquidators, curators and other people named in a publication, sometimes with other data the source itself publishes, such as a date of birth. For a sole trader, the company's data coincides with a person's.
Purpose and legal basis: anyone doing business with a Belgian company must be able to check who is behind it and whether a bankruptcy or another court measure is under way. That is our legitimate interest and that of our users (article 6.1.f GDPR).
Pages about people are kept out of search engines. Data on professional bans and protection measures is not publicly available.
3. Your account data
If you create an account, we process your email address, your name if you enter it, your password (only as an irreversible hash), the companies you follow, your notifications and settings, and what is needed to keep your account secure. Legal basis: performance of our contract with you (article 6.1.b GDPR) and, for security, our legitimate interest (article 6.1.f GDPR).
We send you email about your account, such as a confirmation or a password reset, and the alerts you switch on yourself. You switch an alert off with the link in the email.
The Checked Barometer by email
If you subscribe to the Checked Barometer by email, we keep your email address, the language you choose, when you subscribed and confirmed, and which edition we last sent you. We use these only to send you each new edition. You confirm the subscription with the link in a first email; without confirmation we send nothing more and delete the address after seven days. Every edition has a link to unsubscribe with one click; we then delete your address at once. We do not measure whether you open an email or click a link. Legal basis: your consent (article 6.1.a GDPR), which you can withdraw at any time.
What we measure in aggregate
To see whether the service works, we count use of the site as daily totals, with no link to a person. For searches we also keep the text, detached from whoever typed it; text that looks like an email address, a web address or a long run of digits is not kept. Legal basis: our legitimate interest (article 6.1.f GDPR).
AI assistants and connections
You can connect an AI assistant or another program to your account through OAuth. For each connection we keep the name the app gives, the address it returns to, the permission you granted, the date of connection and of last use, and fingerprints (SHA-256) of the access keys, never the keys themselves. Each day we count the requests per connection and per function, without the content of what you ask the assistant. An access key expires after one hour, an unused connection after thirty days; a revoked connection is deleted after ninety days. You revoke a connection at any time under Apps and API keys in your account. What the assistant does with the answers falls under the privacy policy of that assistant's provider. Legal basis: performance of our contract with you (article 6.1.b GDPR).
4. Checked AI
On some pages you can ask Checked AI a question. Your question then goes, together with the public data of the dossier, to an external provider of language models, which drafts the answer. We send nothing that identifies you, and we do not store your question or the answer in our database.
5. Recipients
We do not sell personal data. Service providers that perform part of the service for us receive only what they need for it. They fall into these categories:
- hosting and storage;
- network and security: all traffic to the site passes through such a provider, and the sign-in and registration pages load a security check from the same provider;
- email delivery;
- payments, once there are paid plans;
- language models, only when you use Checked AI;
- typefaces and map imagery, which your browser fetches directly from the supplier;
- measurement of how the site is used, only with your consent (see Cookies).
We also disclose data to an authority or a court where the law requires it.
6. Transfers outside the EEA
Where a provider processes data outside the European Economic Area, this happens only with appropriate safeguards, such as an adequacy decision of the European Commission or standard contractual clauses; you can request a copy through the contact form, subject Privacy and your data.
7. Retention
We keep personal data no longer than needed for the purpose we process it for, or than the law requires:
- account data: for as long as your account exists;
- subscription to the Checked Barometer by email: until you unsubscribe, an unconfirmed subscription seven days;
- search text in the usage totals and records of failed emails: ninety days;
- accounting records: as long as the law requires;
- data from public sources: for as long as it is in the source or remains relevant to a company's history.
9. Your rights
- Access: a copy of the personal data we process about you.
- Rectification: correction of inaccurate data. If the error is in an official source, have it corrected there: at the business counter for the KBO, at the competent court registry for the Belgian Official Gazette, at the National Bank for annual accounts.
- Erasure: deletion of your account and what is attached to it.
- Objection: to processing based on our legitimate interest, such as your name appearing in a dossier. We then weigh your situation against third parties' interest in knowing who runs a company, and tell you what we decide and why.
- Restriction: a pause in processing while we check data you contest.
- Portability: the data you gave us yourself, in a common format.
- Withdrawal of consent: for measurement, with the buttons under Cookies.
Send your request through the contact form at checked.be/contact with the subject Privacy and your data; that is enough to exercise any of these rights. We answer within one month.
You can also lodge a complaint with the Belgian Data Protection Authority.
10. Scores
The scores on Checked are about companies, not people. We take no decisions about people based solely on automated processing, within the meaning of article 22 GDPR. Even for a sole trader, the score rests only on published company data.
11. Security
We protect personal data with appropriate technical and organisational measures, such as encrypted connections, passwords stored only as a hash and restricted access to the data. A data breach that poses a risk to you is reported to the Data Protection Authority and, where the risk is high, to you as well. Report a vulnerability through the contact form.
12. Changes
If this policy changes, we update this page and show the new date at the top. See also the terms of service.