Privacy Statement
O27

This statement describes the personal data O27 processes, why it processes it, with whom it is shared, how long it is kept, and the rights you have.

It covers O27's websites, the platform it operates and the products that platform carries, in particular Paraphe (shared inbox) and Havre (platform for Belgian out-of-school care operators).

O27 SRL is due to be incorporated in October 2026. The transfer of processing to that entity will be notified in advance.

No data protection officer is appointed to date. The question is reviewed at each annual review of this statement.

O27 acts sometimes as controller, sometimes as processor. The distinction determines your rights and whom to address them to.

For data processed as a processor, the controller is the customer organisation: your employer, your care operator, or the entity that opened your access. O27 processes that data only on their instructions and forwards any request to them.

No decision producing legal effects is taken on the sole basis of automated processing.

Where a customer organisation uses the platform, O27 processes on its behalf:

• the content of messages synchronised from the connected mailbox: headers, bodies, attachments, threads;
• the contact details contained in those messages: senders, recipients, signatures;
• the case records entered in the product concerned, including, for Havre, data relating to minors and their legal guardians.

This data is used only to provide the service. It is not used to train models, and is neither sold, transferred, nor used for advertising or profiling.

Paraphe connects to the mailbox you designate using OAuth 2.0. You authenticate with your provider; O27 neither receives nor stores your password.

Data is disclosed only to the providers necessary to operate the service, bound by a processing agreement under Article 28 GDPR.

The sub-processor register is kept up to date and provided to customers on request. Any addition or replacement is notified to them before it goes into service.

Your own mail provider is not an O27 sub-processor: the mailbox stays with them, under their contract with you.

Data may also be disclosed to an authority where a legal obligation requires it.

Hosting, storage and backups are located in the European Union. No transfer to a third country is in place as at the date of this statement. Should a model provider located outside the Union be retained, the customers concerned would be informed in advance, together with the applicable transfer mechanism.

At the end of the contractual relationship, the customer organisation's space is purged, backups included once their cycle expires.

Encryption in transit and at rest, named accounts, multi-factor authentication, separate spaces per customer organisation, access logging, backups whose restoration is exercised.

The full description is provided to customers and prospects on request, at the contact address above. Vulnerabilities are reported to that same address.

O27's public websites are static and set no cookies.

The application sets only the cookies necessary for it to work: authenticated session and cross-site request forgery protection. No advertising cookies, no third-party analytics trackers.

Under the conditions of Articles 15 to 22 GDPR you have the right of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.

• For processing where O27 is the controller, address your request to the contact above. It is answered within one month, extendable by two months where the request is complex.
• For data processed as a processor, address the customer organisation. A request received by O27 is forwarded to them without delay.

You may lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be.

Any substantial change is communicated to customer organisations before it takes effect. The date of last update and the corresponding commit appear in the document control block of this page.