Data protection and your rights

Last updated: 15 October 2026

TresBizz serves business customers worldwide. We apply one high privacy standard to every customer, and we follow the data protection law of each country or region where we operate. This page explains our principles, your rights, the rules per region and how to make a request. Full details of what we collect and why are in our privacy policy.

Our principles

Modern data protection laws around the world share the same core principles. We build them into how we sell, deliver and support software and how we develop software and websites for customers.

Our commitments

• We only collect data we need to sell, deliver and support your software and services.
• We never sell personal data.
• Analytics and marketing cookies are used with your consent where the law requires it.
• Every service provider that processes data for us is bound by a data processing agreement.
• International transfers are protected with the safeguards your local law requires.
• Access to customer data is limited to staff who need it for their work and who are bound by confidentiality.
• We keep a record of our processing activities and assess new tools and projects for privacy risks before we use them.
• We report data breaches to authorities and affected customers within the deadlines set by local law.

Who is responsible

The website is operated by TresBizz BV, Avenue Louise 231, 1050 Brussels, Belgium (VAT BE1033718409, BCE/KBO 1033718409). Every order comes with an official VAT invoice from the TresBizz company named at checkout and on your order confirmation. That company is responsible for your order data. Where the law requires a local representative or a data protection officer, for example in the EU or the UK, their details are available on request at info@tresbizz.com.

Your rights explained

Your exact rights depend on the law of your country. Most customers worldwide can use the rights below. Some rights have limits, for example when we must keep data to comply with tax law.

Right of access

You can ask whether we process personal data about you and receive a copy, together with information about the purposes, the categories of data, the recipients, the retention period and the source of the data.

Right to correction

You can ask us to correct inaccurate data and to complete incomplete data. Many details you can also change yourself in your customer account.

Right to deletion

You can ask us to delete your data, for example when it is no longer needed or when you withdraw your consent. We may keep data that we must keep by law, such as invoices, or that we need to establish or defend legal claims. In that case we restrict its use.

Right to restriction

You can ask us to temporarily limit the use of your data, for example while we check a correction request or an objection.

Right to data portability

You can ask us to give you the data you provided to us in a structured, common, machine-readable format, or to send it directly to another company where this is technically possible.

Right to object

You can object to processing based on our legitimate interest. We then stop, unless we have compelling reasons that outweigh your interests or we need the data for legal claims. You can always object to direct marketing, and we will stop immediately.

Right to withdraw consent

Where we use your data based on consent, for example for the newsletter or analytics cookies, you can withdraw your consent at any time. This does not affect processing that took place before.

Rights about automated decisions

You have the right not to be subject to a decision based solely on automated processing that significantly affects you. If a payment is refused by automated fraud checks, you can ask for a human review.

Rights in the United States

Residents of California and other US states with privacy laws can ask what categories and specific pieces of personal information we collected, use and disclose, request deletion and correction, opt out of the sale or sharing of personal information and of targeted advertising, limit the use of sensitive personal information and appeal our decision on a request. We do not sell personal data or share it for cross-context behavioural advertising, and we do not discriminate against anyone who uses these rights.

Rules by region

Where several laws apply, we follow the one that gives you the most protection.

How to make a request

1. Email info@tresbizz.com with the subject "Data request".
2. Tell us the country you live in, the right you want to use and, if possible, the email address you used with us and any order or customer number.
3. We confirm receipt and may ask you to verify your identity, for example by replying from the email address linked to your account. We only ask for what we need to verify you and delete this information afterwards.
4. We respond within the deadline of your local law, as shown above. If we need more time for a complex request, we tell you why and how long it will take.

Requests through an agent

You may use an authorised agent to make a request on your behalf where your local law allows this. We will ask for proof that the agent is authorised and may still ask you to verify your identity directly.

Costs

Requests are free of charge. We may charge a reasonable fee or refuse a request only when it is clearly unfounded or excessive, for example when the same request is repeated many times, and we will explain why.

If we cannot fully comply

If we cannot fully meet your request, for example because the law requires us to keep certain data, we explain the reasons and tell you how you can challenge our decision. In US states that provide a right to appeal, you can appeal by replying to our decision with the subject "Appeal". We answer an appeal within the deadline set by your state law.

For business customers

When you buy licences or subscriptions, TresBizz is responsible for the contact and order data of your company and its contact persons, as an independent controller.

When we build or maintain software or websites for you and process personal data on your behalf, we act as your processor. We then sign a data processing agreement that meets the law that applies to you, for example article 28 GDPR. Our standard agreement covers:

• processing only on your documented instructions;
• confidentiality of all staff and contractors who work on your project;
• appropriate technical and organisational security measures;
• the use of sub-processors only with your prior authorisation and under the same obligations;
• support with data subject requests, security incidents and impact assessments;
• notification of personal data breaches without undue delay;
• deletion or return of personal data at the end of the project;
• information and audit rights to show compliance.

Ask us for our standard agreement or a list of current sub-processors at info@tresbizz.com.

Our main service providers

These service providers process personal data for us or alongside us. Each is bound by a data processing agreement or acts as an independent controller under its own privacy policy.

We may change service providers over time. Business customers who need a current list for their own records can request it from us.

Sensitive data

We do not ask for sensitive personal data, such as data about health, religion, political opinions, ethnic origin or biometric data, and we ask you not to send it to us. If such data is part of a custom software project, we only process it as your processor under strict additional safeguards agreed in writing.

Requests from authorities

We only disclose personal data to courts, regulators, tax authorities or law enforcement when we are legally required to do so. We check every request for a valid legal basis, disclose no more than necessary and, where the law allows, inform the affected customer.

Privacy by design in our projects

When we develop custom software and websites, we consider privacy from the start. We collect only the data a feature needs, limit access by role, use encrypted connections, keep test data separate from live data where possible and document how personal data flows through the system. We advise you on cookie consent, privacy notices and retention settings for your own website or application.

Data breaches

If a security incident affects personal data, we act immediately to contain it, investigate what happened and limit the impact. Where required, we notify the competent data protection authorities within the deadlines of the applicable law, for example within 72 hours under the GDPR, and we inform affected people without undue delay when there is a high risk to their rights. Business customers for whom we act as processor are informed without undue delay so they can meet their own obligations.

Complaints

If you are not satisfied with our answer, you can contact the data protection authority in your country, for example a national authority in the EU, the Information Commissioner's Office in the UK or the UAE Data Office. We would appreciate the chance to resolve your concern first, so please contact us before you file a complaint.

See also: Privacy policy · Cookie policy · Security