1. Data controller
The data controller for personal data processed through the Talos website and platform is Talos BV, Groeningenlei 74/2, 2550 Kontich, Belgium.
Company number: KBO/BCE 0XXX.XXX.XXX. VAT: BE0XXX.XXX.XXX.
For any privacy question, request or complaint, contact us at privacy@talos.be.
2. What we collect and why
We collect only what we need to run the service, respond to you, and improve the product.
| Category | Examples | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Contact data | Name, work email, phone, company, role, message content | Consent (demo requests); contract (customers) |
| Account data | Login email, hashed password, MFA settings, session tokens | Contract |
| Fleet & machine data | GPS position, engine hours, fuel level, fault codes, utilisation | Contract — processed on behalf of the customer (see DPA) |
| Usage data | Pages viewed, features used, browser type, IP address | Legitimate interest — securing and improving the service |
| Support data | Emails, chat transcripts, screenshots you share | Contract; legitimate interest |
| Billing data | Company details, billing address, VAT number, payment reference | Contract; legal obligation (accounting) |
Fleet and machine telemetry belongs to the customer. We process it as a processor under the Data Processing Agreement, not as a controller.
3. How long we keep it
- Demo and contact form submissions: up to 24 months after last contact, unless you become a customer.
- Customer account and fleet data: for the duration of the contract, then deleted or returned within 30 days of termination (see DPA).
- Billing and accounting records: 7 years, as required by Belgian tax law.
- Website analytics: 12 months maximum, aggregated where possible.
- Support tickets: 24 months after closure.
5. Where data is stored
All personal and fleet data is stored on servers located in the European Union. We do not transfer personal data outside the EU/EEA without an appropriate safeguard (Standard Contractual Clauses or an adequacy decision).
6. How we protect it
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Access controls: role-based access, single sign-on and MFA for staff.
- Least-privilege principle — production access limited to a named on-call rotation.
- Backups encrypted and tested; audit logging on all administrative actions.
- Vulnerability disclosure: security@talos.be.
7. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase data ('right to be forgotten') where the lawful basis allows.
- Restrict or object to processing.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
- Lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be) or your local supervisory authority.
To exercise a right, email privacy@talos.be. We respond within 30 days.
9. Changes to this policy
We will update this policy when the service or the law changes materially. The date at the top of this page shows the last revision. Substantial changes are announced by email to account admins.