Scope — B2B SaaS, not telecom
Proximus NXT is a B2B SaaS platform (BusinessTV / Digital Media). It does none of the telecom-consumer processing in the general Proximus notice (no call/traffic/location records, no advertising joint-controllers, no device trade-in). Those sections do not apply here.
Who we are (controller)
The data controller is Proximus NV/SA, Boulevard du Roi Albert II 27, 1030 Brussels, Belgium (enterprise / VAT BE 0202.239.951). For any privacy request or question, use our contact form. No Data Protection Officer is appointed; privacy matters are handled through that channel.
Scope / who this covers
Applies to the Proximus NXT platform (digitalmedianova / digitalmedialuna / digitalmediaterra) and its public pages. Data subjects:
- Staff users (Proximus NXT internal staff),
- Partner users (Luna) and reseller users (Terra),
- Customer users (Nova customer-portal accounts),
- Public website visitors (marketing pages, brochures, status, this notice).
Personal data we process
| Category | Examples | Source |
|---|---|---|
| Account / identity | name, email, role, realm, organisation | provided at invite/sign-up |
| Authentication | Identity Platform / Firebase session, MFA enrolment | generated at sign-in |
| Workspace content | quotes, documents, channels, release notes the user authors/views | provided in use |
| Usage / audit logs | actions, timestamps, IP, user-agent (ISO 27001 audit trail) | generated in use |
| Support / comms | emails sent (invitation, quote-ready, MFA, digest), contact-form leads | provided/generated |
| Preferences | language, theme, layout, density (cookies) | set by the user |
We do not process special-category data, and the platform accesses workspace content only as needed to provide the service. Public-site analytics (Cloudflare Web Analytics) is cookieless and collects no personal data.
Why we process it & legal bases (GDPR Art. 6)
- Contract performance — Art. 6(1)(b): providing the workspace, quotes, documents, channels, and customer portal to account holders.
- Legitimate interest — Art. 6(1)(f): platform security, audit logging, rate-limiting, fraud/abuse prevention, aggregate service improvement, and cookieless analytics.
- Legal obligation — Art. 6(1)(c): retention required by law (e.g. accounting records).
- Consent — Art. 6(1)(a): not currently relied upon — no marketing emails to non-customers, no non-essential cookies, no tracking. Transactional emails are sent on the contract / legitimate-interest basis.
Cookies
We use only strictly-necessary and user-set functional cookies; no advertising or third-party tracking cookies, so no consent banner is required (ePrivacy consent-exemption). Full detail — categories, per-cookie table and how to manage them — is in the cookie policy.
International transfers
All processing and storage is within the EU (GCP europe-west1; Resend EU; Cloudflare EU). No transfers outside the EEA are intended.
Retention
We keep personal data only as long as needed for the purpose, then delete or anonymise it:
| Data class | Retention |
|---|---|
| Customer + customer-user records | Contract end + 7 years (accounting/tax) |
| Staff-user records | Employment end + 5 years |
| Quote data (incl. context) | Quote close + 7 years |
| Audit logs (action, IP, user-agent) | 7 years (ISO 27001); IP/UA nulled at 12 months |
| Session tokens | ~15 minutes (auto-expire; no persistent session store) |
| Application logs | 30 days |
| Preference cookies | 365 days |
The seven-year window reflects the Belgian accounting/tax retention obligation. Where the law requires longer retention of specific records, we keep those for the period required.
Your rights (GDPR Art. 15–22)
You have the right of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where applicable. You can exercise the access, portability and erasure rights from your account, or through our contact form. We respond within the one-month statutory window. You may lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).
Changes
We update this notice as the platform evolves; material changes will be dated and surfaced on this page.
Talk to a human.
For access, correction, erasure or any question about this document, reach us through our contact form — we respond within one month.
© 2026 Proximus NV/SA · Boulevard du Roi Albert II 27, 1030 Brussels, Belgium · VAT BE 0202.239.951. This document is governed by Belgian law.