VERTEXIA

VERTEXIA PRIVACY POLICY

Document ID: VERTEXIA-PRIVACY-POLICY-v1.2 Status: Frozen for first publication Version: 1.2 Effective date: From the first public publication of this version by Vertexia, as recorded in the legal release registry. Document frozen on: 17 October 2026

1. Purpose

This Privacy Policy explains how Vertexia processes personal data in connection with:

It applies to personal data processed by Vertexia as controller.

This Policy is an informational privacy document. It is not a separate contractual acceptance instrument and does not require a separate purchase checkbox.

2. Data controller

The controller for the processing described in this Policy is:

Legal operator: Mimoun Mouhajir — sole proprietor / natural-person enterprise Commercial name: Vertexia Business address: Avenue du Scheutbosch 27, Box 2, 1080 Molenbeek-Saint-Jean, Belgium Belgian enterprise number: 1042.698.035 VAT number: BE1042.698.035 Privacy contact email: contact@vertexia.be Telephone: +32 492 21 06 70

The final identity and contact details must correspond with the Vertexia Legal Notice.

Commercial checkout must not be activated while mandatory controller-identification information remains incomplete.

3. Persons concerned

Depending on the context, Vertexia may process personal data relating to:

Urbia A2 is offered as a B2B Product and is not marketed as a consumer product.

4. Categories of personal data

Depending on the interaction, Vertexia may process the following categories.

Identity and professional data

This may include:

Contact data

This may include:

Order and licence data

This may include:

Transaction data

This may include information made available through Stripe / Link that is reasonably necessary to administer the transaction, such as:

Vertexia does not need to receive or store complete payment-card credentials merely because a purchase is processed through Managed Payments.

Contract and acceptance evidence

This may include:

Product delivery and support data

This may include:

Technical and security data

Where relevant and proportionate, this may include:

Vertexia does not seek to collect personal data merely because it is technically possible to do so.

5. Sources of personal data

Vertexia may receive personal data:

Where information is obtained from Stripe or Link, Vertexia processes only the information made available to it that is reasonably necessary for its own legitimate purposes and obligations.

Vertexia processes personal data only where an applicable legal basis exists.

Website operation and security

Vertexia may process limited technical and security information to:

The legal basis may be Vertexia's legitimate interests in operating and protecting its business and systems, subject to applicable balancing requirements.

Enquiries and pre-contractual communications

Where an individual contacts Vertexia about a possible purchase, Vertexia may process the supplied information to answer the enquiry and take requested pre-contractual steps.

Where the individual would personally become the contracting professional party, processing may be necessary to take steps at that person's request before entering into a contract.

Where the individual acts as a representative of a company or other organisation, Vertexia may rely on legitimate interests in communicating with that organisation and administering the prospective business relationship.

Orders, licences, delivery and contractual administration

Where the Customer is a natural person acting professionally, certain processing may be necessary for performance of the Product contract.

Where the Customer is a company or other legal person and the data relates to an employee, director or representative, Vertexia does not automatically treat that individual as personally being a party to the Product contract.

In that situation, processing may instead be based on Vertexia's and the Customer's legitimate interests in administering the business transaction and licence relationship.

Contractual evidence

Vertexia may retain appropriate evidence of:

This processing may be based on legitimate interests in establishing, administering and defending contractual rights and legal claims and, where applicable, on legal obligations.

Where applicable, information may be processed because Vertexia is subject to accounting, tax, business-record or other legal obligations.

The applicable basis is compliance with the relevant legal obligation.

Product Support

Support information may be processed where necessary to perform the applicable support entitlement or, in an organisational context, on the basis of legitimate interests in supporting the Customer's licensed Product.

Relevant information may be processed to:

Depending on the circumstances, the basis may include legitimate interests, compliance with legal obligations and the establishment, exercise or defence of legal claims.

Vertexia relies on consent only where consent is genuinely the appropriate legal basis.

Consent is not used merely as a generic substitute for another applicable legal basis.

Where consent is used, it must be freely given, specific, informed and capable of being withdrawn in accordance with applicable law.

Eligible Product transactions may be processed through Stripe Managed Payments / Sold through Link.

Within the commercial transaction architecture:

Those commercial roles do not mean that every party always has the same data-protection role for every processing activity.

Stripe, Link and their applicable affiliates may process transaction information for their own purposes and obligations, including payment processing, transaction administration, tax handling where applicable, fraud prevention, compliance, refunds, disputes and other activities described in their current privacy and contractual documentation.

Vertexia does not represent that all Stripe or Link processing occurs solely on Vertexia's instructions.

8. Data shared between Stripe and Vertexia

Vertexia may provide or cause to be provided to the relevant Stripe / Link systems information reasonably required to initiate and reconcile a Product transaction.

Stripe / Link may make transaction information available to Vertexia so that Vertexia can:

Vertexia does not intentionally use Stripe metadata or Checkout fields as an unrestricted storage location for personal information.

Only information that has an identified transaction or reconciliation purpose should be placed there.

9. Contract Evidence Record

For a completed purchase, Vertexia may create a Contract Evidence Record.

Depending on the transaction, this may identify:

The Contract Evidence Record is intended to provide proportionate evidence of the Product and licence relationship.

It is not intended to become an unrestricted copy of the Customer's entire Stripe profile.

Complete card details, CVC data, authentication secrets and unrelated payment-provider information must not be copied into this record.

10. Durable contractual package

Following a completed Product purchase, Vertexia may generate and provide a durable contractual package containing:

  1. the Order & License Confirmation;
  2. the exact applicable Vertexia B2B Terms & Conditions;
  3. the exact applicable Product Commercial License; and
  4. the exact incorporated End Client Limited Use Notice.

The personalised Order & License Confirmation may contain limited personal data necessary to identify the Licensee and transaction.

The contractual package is maintained separately from the mutable public website so that later website changes do not alter the record of an earlier purchase.

Failure of a delivery email does not require the underlying contractual evidence to be deleted or recreated as a different contract.

11. Service providers and recipients

The providers used for the launch architecture are:

SendOwl is not used. Cloudinary is not used for the public demonstration, whose media are served locally.

Other recipients may include professional accounting or legal advisers and competent public authorities where disclosure is required or otherwise lawfully justified. Adding or changing a provider requires the relevant privacy-role, contractual and international-transfer assessments and an update to this Policy where necessary.

12. Stripe entities and privacy roles

The Stripe entity or entities involved in a particular processing activity depend on the Customer's location, the Vertexia account configuration and the Stripe service concerned.

Vertexia therefore refers users to Stripe's current privacy information and contractual documentation for the applicable Stripe entities and roles rather than treating one Stripe entity as universally responsible for all Stripe processing.

Stripe may act as controller or processor depending on the relevant processing activity, as described in the applicable Stripe privacy and contractual framework.

13. International data transfers

The geographic location of processing depends on the actual providers and services used in the production architecture.

The providers used for the launch architecture are identified in Section 11; the location and transfer mechanisms applicable to each service follow its actual configuration and contractual framework.

Where personal data is transferred outside the European Economic Area in circumstances requiring a transfer mechanism under applicable data-protection law, Vertexia will rely on an appropriate mechanism where required, which may include:

This Section does not claim that all Vertexia providers necessarily process data only within Belgium or the European Economic Area.

14. Data minimisation

Vertexia follows the principle of data minimisation.

It seeks to collect and retain personal data that is adequate, relevant and reasonably necessary for identified purposes.

For example:

The Contract Evidence Record must be designed around evidence needs rather than maximum data collection.

15. Retention

The applicable retention schedule is:

CategoryRetention period
Accounting and tax documentsUp to 10 years according to their nature and the applicable legal obligation. Records subject to a mandatory 10-year accounting period are retained for that full period, using the legally applicable starting point.
Orders, licences and proportionate acceptance evidence10 years after the order, for contractual-claims evidence. This does not justify retaining complete payment-provider payloads or unrelated logs for the same period.
Product Support correspondence24 months after closure of the support matter.
B2B prospecting, where undertaken3 years after the last contact remaining unanswered. A minimal objection list is retained for as long as necessary to respect an objection.
Make anti-duplicate Data Store12 months; this store contains only checkout_session_id.
Make execution history30 days, corresponding to the account's standard retention.
Amazon S3 server access logsServer access logging is disabled for the production delivery bucket, as verified on 17 October 2026; no retention period is assigned to logs that this feature does not create. This statement makes no claim about other AWS logging services.
Netlify technical logsAccording to Netlify's applicable service conditions; these logs are not used by Vertexia.

Data is deleted, anonymised or removed from active retention when no applicable lawful reason remains. A narrowly justified legal hold may extend retention where required for a specific dispute, claim or legal obligation. Retaining necessary order evidence does not justify retaining every associated data item for the same period.

16. No indefinite evidence archive by default

The fact that contractual evidence can be useful does not justify indiscriminate or permanent retention of all Customer information.

Vertexia may preserve proportionate evidence for as long as an applicable legal basis, legal obligation or legal-claims need permits or requires it.

This does not authorise an indefinite archive of:

Where part of an order record must legitimately be retained, that does not mean every piece of information associated with the original transaction must be retained for the same period.

17. Data security

Vertexia takes reasonable technical and organisational measures appropriate to the nature of the personal data and relevant risks.

Depending on the system concerned, measures may include:

Where Vertexia issues a secure Product delivery link, that link is intended to expire 48 hours after issuance as an access-control measure. No internet-connected system can be represented as absolutely secure.

Vertexia therefore does not promise that a security incident is technically impossible.

18. Payment-card security

Payment-card information is handled through the applicable Stripe / Link transaction environment.

Vertexia must not intentionally collect or store:

in its Product order, support or evidence systems.

Where Stripe provides limited transaction or payment-method information needed for administration, Vertexia may process that information for the relevant purpose.

19. Product source code and End Client data

Urbia A2 is a source-code Product that may be deployed and operated independently by the Licensee or an End Client.

The fact that Vertexia created or licensed the Product does not, by itself, make Vertexia the controller or processor of personal data subsequently collected by every website or system built from that Product.

A Licensee or End Client deploying Urbia A2 is responsible for assessing its own data-protection obligations in relation to:

If Vertexia separately receives personal data from a Customer deployment — for example through Product Support or a separately agreed hosted service — the applicable privacy role must be assessed according to that actual processing activity.

This Policy does not silently create a hosted-data-processing service that is not part of the purchased Product.

20. Support submissions and Customer data

Customers should avoid sending Vertexia unnecessary personal, confidential or production data when requesting Product Support.

Where diagnostic material is necessary, the Customer should minimise, redact or anonymise information where reasonably possible.

If a Customer provides personal data relating to another person for support purposes, the Customer is responsible for having an appropriate basis to provide that information.

Vertexia will use support material for the relevant support, security or dispute purpose and will not treat support submissions as permission for unrelated use.

21. Cookies and similar technologies

Vertexia's use of cookies and similar browser technologies is described separately in the Vertexia Cookie Policy.

The intended Vertexia baseline is privacy-minimising.

Vertexia does not assume that analytics, advertising or behavioural-tracking technologies are present merely because such technologies are common on commercial websites.

The actual website must be audited before LIVE publication.

Where only technologies that are genuinely strictly necessary are used, Vertexia does not introduce a consent banner solely as a cosmetic convention.

Where a technology requiring prior consent is introduced, it must not operate before valid consent where applicable law requires that consent.

Stripe-hosted Checkout operates in a separate Stripe / Link environment and is also subject to the applicable Stripe / Link privacy and technology practices.

If Stripe scripts or embedded payment components are later executed directly on Vertexia pages, their impact must be reassessed.

22. Direct marketing

Vertexia does not treat a Product purchase or business enquiry as unrestricted permission for unrelated direct marketing.

If Vertexia introduces direct electronic marketing, it must identify and implement the applicable legal basis and any consent or opt-out requirements before that processing begins.

Where applicable law provides a right to object to direct marketing, that right must be respected.

The absence of a marketing programme does not require fictitious marketing consent controls to be added to the current checkout.

23. Automated decision-making

Vertexia does not currently intend the Product-purchase process itself to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning the individual within the meaning of applicable data-protection law.

Stripe, Link or other transaction providers may use automated systems for areas such as:

under their own applicable framework.

Vertexia does not claim control over independently operated Stripe / Link decision systems merely because the resulting transaction status is communicated to Vertexia.

If Vertexia later introduces qualifying automated decision-making of its own, this Policy and the applicable safeguards must be reassessed before use.

24. Data-subject rights

Subject to the conditions and exceptions of applicable data-protection law, individuals may have rights including:

These rights are not absolute in every circumstance.

For example, an erasure request does not necessarily require deletion of information that Vertexia remains legally required or otherwise lawfully entitled to retain.

25. Right to object

Where Vertexia relies on legitimate interests for a processing activity, the individual may have a right to object on grounds relating to their particular situation.

Vertexia will assess the objection in accordance with applicable law.

Where personal data is processed for direct marketing, the applicable right to object to that direct marketing will be respected.

Where Vertexia relies on consent as the legal basis for a processing activity, the individual may withdraw that consent.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Withdrawal of consent also does not require termination of a separate processing activity that continues to have another valid legal basis.

Vertexia must therefore not represent withdrawal of one consent as automatically deleting all business or contractual records.

27. Exercising privacy rights

Requests concerning personal data controlled by Vertexia may be sent to:

Privacy email: contact@vertexia.be

Vertexia may request information reasonably necessary to identify the requester and protect personal data against unauthorised disclosure.

Vertexia should not request disproportionate identity documents where a request can reasonably be authenticated in another way.

Requests are handled within the applicable statutory time limits.

Where a request concerns data that is independently controlled by another organisation, Vertexia may explain which organisation should receive that part of the request where it can reasonably identify the relevant organisation.

28. Stripe privacy requests

Stripe, Link or an applicable affiliate may independently control personal data processed within its own services.

Requests concerning such independently controlled processing may therefore need to be directed to the relevant Stripe / Link entity under its current privacy process.

Vertexia cannot exercise a data-subject right on behalf of Stripe where Vertexia does not control the relevant data or processing system.

Where reasonably possible, Vertexia may help identify whether the request appears to concern a Vertexia-controlled record or an independently controlled Stripe / Link record.

A deletion request handled by Stripe or Link for data in their systems does not automatically delete separate records lawfully controlled by Vertexia.

Vertexia assesses requests concerning its own records independently.

Vertexia retains personal data only where an applicable lawful basis, legal obligation or legitimate legal-claims need permits or requires retention.

Conversely, Vertexia cannot represent that deletion from its own systems necessarily causes independently controlled Stripe or Link data to be deleted.

30. Right to complain

An individual who considers that Vertexia has processed personal data unlawfully has the right to lodge a complaint with a competent data-protection supervisory authority.

For Vertexia's Belgian establishment, the relevant supervisory authority is the Belgian Data Protection Authority, known as:

Autorité de protection des données (APD) /
Gegevensbeschermingsautoriteit (GBA).

Current official contact and complaint information should be obtained from the authority's official website.

Individuals may contact Vertexia first if they wish to seek resolution directly, but doing so does not remove the right to approach a supervisory authority.

31. Children

Vertexia Products and commercial checkout are intended for professional and business users.

They are not directed at children.

Vertexia does not intentionally solicit children to purchase Urbia A2 or enter into the professional Product licence relationship.

If Vertexia becomes aware that personal data relating to a child has been improperly provided in a context where there is no lawful reason to process it, Vertexia will assess and address that information in accordance with applicable law.

Vertexia may process or disclose personal data where reasonably necessary to comply with:

Where legally permitted and appropriate, Vertexia may challenge requests that appear invalid, disproportionate or outside the requesting authority's lawful powers.

This Section does not authorise voluntary disclosure of Customer information without an appropriate legal basis.

33. Business transfer or succession

If Vertexia undergoes a genuine business transfer, restructuring, succession or other transaction affecting the operation of its Products or contractual relationships, relevant personal data may be transferred to a lawful successor where appropriate and permitted by applicable law.

Such a transfer does not allow personal data to be used for unrelated purposes merely because ownership of the business changes.

Appropriate information or notices will be provided where required.

34. Changes to this Privacy Policy

Vertexia may update this Privacy Policy to reflect:

A new Privacy Policy version applies according to its stated effective date.

Updating the public Privacy Policy does not silently rewrite historical contractual evidence or the legal documents associated with an earlier completed Product purchase.

Material changes are handled transparently where applicable law requires further notice.

35. Privacy-policy versioning

Vertexia maintains an identifiable version for each released Privacy Policy.

For the present consolidated release:

VERTEXIA-PRIVACY-POLICY-v1.2

A later substantive revision must receive a new version.

Historical versions relevant to past processing or contractual records should remain reproducible where reasonably necessary for evidence and compliance.

A released privacy file must not be silently overwritten while retaining the same integrity identifier.

The SHA-256 applicable to a production release is calculated only after the exact final file bytes exist.

END — VERTEXIA PRIVACY POLICY — v1.2