La version française de ce document est en préparation. En attendant, voici la version anglaise, qui fait foi en cas de divergence entre les langues.
COBIQO Privacy Policy
Version 1.0 · Effective from 26 October 2026
1. Introduction
This Privacy Policy explains how Cobofam South SL ("Cobiqo", part of the Cobofam Group) collects, uses and protects personal data in connection with the COBIQO platform (app.cobiqo.com), the website cobiqo.com and related services (the "Service").
Cobiqo processes personal data in accordance with the General Data Protection Regulation (GDPR) and applicable national law.
2. Controller and processor
Cobiqo is the controller for personal data it processes for its own purposes, including:
- account management and sign-in;
- invoicing of subscriptions;
- platform security;
- support;
- product improvement and analytics;
- sales and marketing via cobiqo.com.
For personal data that customers process in the Service, Cobiqo acts as processor. This includes, for example, their customers, suppliers, contacts and staff. The customer is the controller for that data; see the Data Processing Agreement. If you have questions about data that a Cobiqo customer keeps about you, please contact that customer first.
3. Personal data we collect
3.1 Account and sign-in data
- name, email address, phone number, language;
- company details (name, address, VAT number);
- credentials (the password only as an encrypted hash);
- two-step verification and trusted device data (device, IP address, time).
3.2 Usage and security data
- logs of sign-ins, account switches and refused access;
- IP address, browser and device information;
- interactions with the Service and usage (documents, AI scans).
3.3 Data in the Service (on behalf of our customers)
Depending on what the customer uses:
- invoices, quotes, orders and accounting data, with names and contact details of customers, suppliers and contacts;
- bank transactions and account numbers;
- personnel and payroll data, such as identification numbers (e.g. national register number), address, contract, salary, benefits, absences and vehicles;
- documents the customer uploads or has read;
- tasks, time tracking and notes;
- support messages.
3.4 Communication data
- emails and support interactions;
- feedback and messages;
- for those who start a trial via cobiqo.com: the data from the form and the follow-up.
4. Purposes of processing
We process personal data for:
- providing and operating the Service;
- managing logins, accounts and permissions;
- invoicing and payment processing;
- security, fraud prevention and investigating incidents;
- customer support, including Support Access: a support employee views the account as the user sees it, with a logged reason (see article 16 of the Terms and Conditions);
- improving and developing the Service, using aggregated and anonymised data;
- monitoring usage and costs, including AI costs per account;
- compliance with legal obligations, including accounting and tax retention.
5. Legal basis
We process personal data on the basis of:
- the performance of a contract (providing the Service);
- legal obligations (e.g. accounting, invoicing, retention);
- legitimate interests (security, support, improving the Service, sales to business customers);
- consent, where required (e.g. certain cookies).
6. Sharing of data
6.1 Service providers (sub-processors)
We share personal data only with service providers we need to provide the Service. The current list is in annex 2 of the Data Processing Agreement. It includes:
- hosting and storage;
- email;
- the Peppol network;
- AI providers for reading documents and for checks and suggestions;
- payments.
6.2 Connected services
When the customer connects external services, such as a bank or a webshop, data is exchanged with those services on the customer's instructions.
6.3 Statutory transmissions and authorities
Invoices are sent via Peppol on the customer's instructions. Spanish invoice registrations go to the tax authority (VeriFactu). We also share data with authorities where the law requires it, or to protect rights in legal proceedings.
7. International transfers
We store the data of the Service in the European Economic Area: the application and databases run in the Benelux, files are stored with Google Cloud in Belgium and an encrypted backup copy with Google Cloud in the Netherlands. If a service provider processes data outside the EEA (for example an AI provider), we ensure appropriate safeguards, such as standard contractual clauses (SCCs) or an adequacy decision.
8. Retention periods
| Data | Retention period |
|---|---|
| Account and sign-in data | as long as the login exists |
| Sign-in and security logs | as long as needed for security |
| Support Access logs | 12 months |
| Data in the Service | until the account is deleted |
| Backups | 30 days (daily) and 12 months (monthly) |
| Encrypted export after deletion of an account | until the statutory retention period for invoices and accounting has expired, at most 10 years |
| Subscription invoices | according to the tax retention obligation |
When an account is deleted, a login that is no longer used anywhere else is anonymised.
9. Security
We take appropriate technical and organisational measures, including:
- a separate database per account;
- two-step verification, mandatory for administrators and platform staff;
- encryption in transit and of backups;
- logging of sign-ins, administrative actions and Support Access;
- staff access based on the principle of least privilege.
10. Your rights
Under the GDPR you have the right to:
- access your personal data;
- have inaccurate data corrected;
- request erasure;
- restrict processing;
- object to processing;
- request data portability.
Requests can be submitted via the contact details below. If the request concerns data that a Cobiqo customer keeps in the Service, we forward it to that customer. You also have the right to lodge a complaint with a supervisory authority, primarily the Agencia Española de Protección de Datos (Spain, aepd.es), or the authority of the country where you live, such as the Data Protection Authority (Belgium, dataprotectionauthority.be).
11. Cookies
The Service uses cookies necessary for it to work, such as the session, the language and "trust this device". For other cookies we ask for consent where required.
12. Changes to this policy
We may update this Privacy Policy. Changes are published on cobiqo.com and, where appropriate, notified to users.
13. Contact
For questions or requests regarding this Privacy Policy:
Cobofam South SL (COBIQO)
C/ Alejandro Dumas 17, 29004 Málaga, Spain
NIF B93938421, VAT ESB93938421, registered in the Registro Mercantil de Málaga, sheet MA-200924 (EUID ES29023.000702027)
Branch office Belgium: Opperstraat 158, 1770 Liedekerke
info@cobofam.be