Privacy Policy

Version: 1 · Last amended: 2026-05-17 · Effective from: 2026-05-17

Data controller

The data controller for personal data processed through the Tavuni platform is:

  • Kata Forier (trading as Tavuni)
  • Brusselsesteenweg 124, 3090 Overijse, Belgium
  • VAT: BE0758.451.952
  • Company registry: 0758.451.952
  • Contact: hello@tavuni.com

Data Protection Officer

For any privacy-related question, contact:

Categories of personal data we process

We process the following categories of personal data, only to the extent necessary to deliver the platform:

  • Account information: Name, email address, organisation, role, password hash, MFA factors.
  • Usage metrics: Login timestamps, IP address, session metadata, audit-log entries linked to your account.
  • Billing data: Subscription plan, invoice history, payment-instrument metadata (we never see your full card number — see the Mollie sub-processor below).
  • Support tickets: Messages, attachments, and metadata exchanged with our support team.

Legal basis for processing

Account, usage, and billing data are processed on the legal basis of contract performance (GDPR Art. 6(1)(b)). Audit-log entries are also processed for our legitimate interest in platform security (GDPR Art. 6(1)(f)). Marketing communications, if any, are processed on the basis of your consent (GDPR Art. 6(1)(a)); you may withdraw consent at any time without affecting prior lawful processing.

Retention periods

Retention is governed by per-tenant policies and the retention catalogue. Account and contractual data are retained for the duration of the agreement plus the statutory archive period applicable to invoices in your jurisdiction (10 years in Belgium). Audit-log entries follow the per-tenant retention policy table; the default is 24 months. You may request earlier erasure subject to overriding legal obligations (e.g. tax archives).

Recipients and sub-processors

We engage the following sub-processors. All operate within the EU/EEA; we do not transfer personal data to third countries.

  • Hetzner Online GmbH (DE, EU/EEA) — Infrastructure (compute + storage)
    Data categories: all platform data — encrypted at rest
    Data Processing Agreement
  • Lettermint (NL, EU/EEA) — Transactional email delivery (acknowledged exception — self-hosted SMTP cannot meet deliverability)
    Data categories: recipient email address; email subject line; email body
    Data Processing Agreement
  • Mollie B.V. (NL, EU/EEA) — Payment processing
    Data categories: payer name; payer email; payment instrument metadata; transaction amount
    Data Processing Agreement

International transfers

We do not transfer personal data outside the EU/EEA. Our infrastructure runs exclusively on Hetzner servers in Germany, our email-delivery provider Lettermint is established in the Netherlands, and our payment processor Mollie is established in the Netherlands.

Your rights

Under GDPR Articles 15–22, you have the right to:

  • Access — obtain a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — request deletion, subject to overriding legal obligations.
  • Portability — receive your data in a structured, machine-readable format.
  • Restriction — limit how we process your data while a dispute is resolved.
  • Objection — object to processing based on legitimate interest.

To exercise any of these rights, contact dpo@tavuni.com.

Complaints

If you believe we have processed your personal data unlawfully, you may lodge a complaint with the supervisory authority in your country. For Belgian residents:

© 2026 Kata Forier. Version 1.