--- title: "Privacy policy: what this website collects | Paycore" description: "What this website collects, why, how long it is kept, who else sees it, and how to exercise your GDPR rights with Paycore, a Belgian payroll bureau." url: "https://www.paycore.be/en/privacy-policy" lang: "en" --- 1. [Home](https://www.paycore.be/en) 2. Privacy policy Legal information # Privacy policy This website collects very little, and this page says exactly what, why, for how long, and what you can demand from us. Last updated on October 27, 2026 ## Contents 1. [Who is responsible](#responsable) 2. [What this policy covers](#perimetre) 3. [What this website collects](#donnees) 4. [Why, on what basis, and for how long](#finalites) 5. [Who else has access](#destinataires) 6. [How they are protected](#securite) 7. [Your rights](#droits) 8. [Lodging a complaint](#plainte) 9. [Automated decisions](#automatise) 10. [Updates to this policy](#evolution) ## Who is responsible The controller for the processing described here is Paycore, the publisher of this website. Registered name Paycore SRL Registered office Rue de Picardie 43 - 1140 Evere Enterprise number 0699.722.267 Privacy contact [contact@paycore.be](mailto:contact@paycore.be) Telephone [02 537 77 71](tel:+3225377771) A question about your data, a request for access or erasure: write to that address with « privacy » in the subject line. A person reads it, and you get an answer within a month. ## What this policy covers It covers this website and nothing else: what you read here, what you send us from these pages, and what your browser stores. It does not cover our clients' payroll data. Salaries, contracts and their employees' details are processed by Paycore as a processor, on the employer's instructions, under the service agreement and its data protection annex (article 28 GDPR). The employer is the controller there, and an employee therefore addresses requests to them. Nor does it cover the client portal, which is a separate service served on another domain, with its own terms. ## What this website collects Three things, and nothing else. No account to create, no profile, no data bought from a third party. - What you write to reach us: your name, your email address, the subject of your request chosen from a list, and if you provide them, your company, your phone number, your company's headcount band and the content of your message. The optional fields really are optional. - The server's technical logs, which any hosting produces: IP address, date and time, page requested, browser type. They keep the site standing and help us understand an outage or an attack. - One language cookie, set when you choose English, French or Dutch, so that your next visit opens in the right language. No analytics, no advertising tracker, no social media button, no font or script loaded from a third-party service. The day analytics are installed, your consent will be asked before anything at all is stored, and this page will be updated first. Never send us a national register number or data about your employees through the form or by ordinary email. Those travel through the channels agreed in your file, once it has been opened. One point of fact, while it holds true: the contact form does not deliver anything today. Its transport is not connected yet, it tells you so when you submit, and it points you to the phone and the email address. Nothing you type into it is stored or forwarded. ## Why, on what basis, and for how long __Processing carried out by this website, legal basis under the GDPR and retention period__ | Processing | Legal basis | Retention | | --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Detecting and understanding the site's technical failures | Legitimate interest in keeping the service working (article 6.1.f) | 90 days. These signals carry only an error code and the path concerned: not the contents of a form, not your IP address, which is erased on receipt | | Answering a question, a quotation request or a meeting request | Pre-contractual steps taken at your request (article 6.1.b) and legitimate interest in replying (article 6.1.f) | 12 months after the last exchange. A meeting booked online stays in our calendar, like any professional appointment, and its history follows the same period. If a contract follows, the client file takes over with its own rules | | Keeping the website running, preventing and investigating abuse | Legitimate interest in the security of the service (article 6.1.f) | 6 months at most for the server logs | | Serving the website in the language you chose | Legitimate interest in providing the service requested (article 6.1.f) | The length of the browsing session | You are under no obligation to give us any of this. Without a name and an email address, however, we have no way of knowing whom to answer, or where. ## Who else has access Nobody, apart from the people at Paycore handling your request, the company hosting the site, which runs the servers without making any use of their content, Microsoft when you book a meeting online, and Google if you choose to display the map on the contact page. - OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: hosting of the website, in a data centre located in France. - Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland: appointment calendar (Microsoft Bookings, within our Microsoft 365 subscription). When you book a slot, your name, your email address, your phone number and what you want to discuss are stored in our calendar; Microsoft is what sends you the confirmation, the calendar invitation and the reminders. - Storyblok GmbH, Peter-Behrens-Platz 2, 4020 Linz, Austria: the system holding the blog articles and the accounts of the people who write them. An Austrian company, data stored in the European Union. Nothing of yours passes through it: the site reads articles there, it sends no visitor data to it. - Functional Software, Inc., 45 Fremont Street, San Francisco, United States, trading as Sentry: monitoring of the site's technical failures. Data is stored in Frankfurt, Germany, but the company is American: transfers are covered by the standard contractual clauses in its data processing agreement. The site sends it only an error code and the path concerned, never the contents of a form. Your browser, however, may send it an automatic report when a security rule of the page is breached: that report carries the address of the page and of the blocked resource, and your IP address is erased on receipt. - Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: the map on the contact page, and only if you ask for it to be displayed. Google then receives your IP address and sets its cookies; until you click, no request leaves for Google. - No other processor to date: no email delivery service for the contact form, no analytics tool, no form service. Our Microsoft 365 data is hosted in the European Union. For certain technical or support operations, Microsoft may nonetheless access it from a third country; such access is governed by the European Commission's standard contractual clauses, carried over into Microsoft's data protection addendum. Nothing is sold, rented out, or shared for advertising purposes. Disclosure to an authority can only follow a lawful request. ## How they are protected - The website is served over HTTPS only, and browsers are instructed never to come back to it unencrypted. - The security headers forbid framing the site inside another page, redirecting where a form is submitted, and access to the camera, microphone or location. - The form asks only for what is needed, and the content of messages is written to no technical log. - No secret and no access key travels to the browser. A data breach presenting a risk to your rights would be notified to the Belgian Data Protection Authority within 72 hours, and you would be informed directly where the risk is high. ## Your rights The GDPR gives you several, and a plain email is enough to exercise them. - Find out whether we hold data about you, and obtain a copy of it. - Have anything inaccurate or incomplete corrected. - Have erased what we no longer have a reason to keep. - Ask for processing to be restricted while something is being checked. - Object to processing based on our legitimate interest. - Receive what you gave us in a machine-readable format. - Withdraw a consent at any time, without calling into question what was done before. We answer within a month. If your request is complex, that period may be extended by two months and we will tell you. Proof of identity will only be requested where there is genuine doubt about who is writing. - [Write to Paycore](https://www.paycore.be/en/contact) ## Lodging a complaint If our answer does not satisfy you, you may refer the matter to the Belgian supervisory authority. Do write to us first if you are willing: most misunderstandings are settled in one exchange. Authority Belgian Data Protection Authority (APD/GBA) Address Rue de la Presse 35, 1000 Brussels Telephone +32 (0)2 274 48 00 Email contact@apd-gba.be - [dataprotectionauthority.be (opens in a new tab)](https://www.dataprotectionauthority.be) ## Automated decisions This website takes no automated decision about you and does no profiling. Your requests are read and handled by people. ## Updates to this policy It will change when the website changes: a form that actually sends, analytics, a new provider. The date at the top of the page gives the latest revision, and earlier versions are kept in the site's source history. - [Cookie policy](https://www.paycore.be/en/cookie-policy) - [Legal notice](https://www.paycore.be/en/legal-notice)