Who processes personal data on our behalf
As a driving school or training centre, you are the controller of the data of your students, trainees, instructors and business customers. BIQSDRIVE processes that data on your behalf, in accordance with the Data Processing Agreement (Annex C to the Subscription Agreement). For certain services, we engage suppliers ourselves: our sub-processors. By entering into the Subscription Agreement, you gave general authorisation for this, on the basis of this list (Article 28(2) and (4) GDPR).
1. Current sub-processors
| Sub-processor | Service | Which data | Location | Transfer outside the EEA | Since |
|---|---|---|---|---|---|
| Level 27 BV Hasselt, Belgium BE 0890.439.412 | Hosting of the Platform, the database and the backups | All Customer Data | Belgium (backups within the EEA) | No | October 2026 |
| Spryng B.V. Amsterdam, the Netherlands | Sending text messages (SMS), such as lesson reminders and notifications | Mobile number of the recipient and content of the message | Frankfurt, Germany | No | October 2026 |
| Microsoft Ireland Operations Limited Dublin, Ireland | Sending emails from the Platform and their delivery reports (Azure Communication Services) | Name and email address of the sender and recipient, subject, content and attachments of the email, and the answer of the receiving mail server. Microsoft keeps an address that turned out to be undeliverable for 24 hours to 14 days, so as not to send to it again | European Union (EU data location) | Possible, under the EU-US Data Privacy Framework (Microsoft Corporation is certified) and the standard contractual clauses of the European Commission in Microsoft's data protection terms | October 2026 |
| Odoo SA Grand-Rosière, Belgium BE 0477.472.701 | Helpdesk and support tickets | Name and contact details of the User, content of the ticket and attachments | Belgium and France; backups in France, the Netherlands and Sweden | No | October 2026 |
| BIQS IT BV Tessenderlo-Ham, Belgium BE 0899.469.023 | Support for Users and development and maintenance of the Platform | Customer Data, to the extent that access is needed to handle a support request or resolve a failure | Belgium | No | November 2026 |
| Anthropic Ireland, Limited Dublin, Ireland, with processing by Anthropic PBC (United States) | AI agents in the Platform: the AI support agent (24/7), the admin agent and the planning agent | Questions to the agents and their answers and suggestions, name and email address of the User, data the User shares in a conversation, and the Customer Data that the agents look up within the User's permissions (such as enrolments, lessons, planning, payments and exam registrations), with the exception of national register numbers, INSZ numbers (Belgian social security numbers), identity documents, full addresses, dates of birth, internal notes, account numbers and imported bank transactions, and of the type of or reason for an absence, comments on leave requests, corrections to time records and Dimona declarations. As a location, the planning agent only uses the municipality or the postcode. | United States | Yes, with the standard contractual clauses of the European Commission in Anthropic's data processing agreement | October 2026 |
| Friendly Captcha GmbH Wörthsee, Germany HRB 260542 (Amtsgericht München) | Protection of the Platform's public forms against bots, such as the online enrolment, the inquiry form, forgotten password, the registration of business customers and signing in after failed attempts | Technical data of the visitor's browser and connection, such as the IP address, which Friendly Captcha hashes before storage; no cookies | Germany; the check in the browser may be delivered from servers outside the EU | Possible, for the delivery of the check in the browser, with the standard contractual clauses of the European Commission | October 2026 |
| e-Contract.be BV Beersel, Belgium BE 0845.600.072 | Reading the Belgian electronic identity card with a card reader at the front desk (Article 7.4 of the Subscription Agreement) | The data on the identity card that the Customer reads, such as name, first names, date and place of birth, gender, nationality, address, card number and validity, and the national register number and the photo only insofar as the Customer is authorised to do so | Belgium | No | October 2026 |
| Isabel NV (Ponto) Keizerinlaan 13-15, 1000 Brussels BE 0455.530.509 | Bank connection: importing the transactions of the connected payment accounts (account information service supervised by the National Bank of Belgium) | Transactions of the connected accounts (date, amount, payment reference, name and account number of the counterparty); the Platform only stores the matched customer payments | See the Isabel NV privacy statement | See the Isabel NV privacy statement | October 2026 |
| TinTel B.V. (Pay.) Spijkenisse, the Netherlands Chamber of Commerce (KvK) 24283498 | Online payments, SoftPOS and payment terminals, and the reporting of payments back to the Platform (payment institution supervised by De Nederlandsche Bank) | Name and email address of the payer, amount, description, payment method, transaction reference and masked card details | See the Pay. privacy statement | See the Pay. privacy statement | October 2026 |
Isabel NV and Pay. are regulated payment institutions. For their own tasks, such as executing payments and anti-money laundering checks, they are themselves the controller. For the location of their processing and any transfer outside the EEA, we refer to their privacy statements (section 4).
Good to know about the AI agents
Anthropic does not use the data to train its models. By default, Anthropic erases inputs and outputs within 30 days, except where a conversation is flagged by automated abuse detection (then up to 2 years) or where the law requires longer retention. The agents only see what the User is allowed to see and make suggestions; a member of staff of your organisation decides.
In a conversation with an agent, only share the data needed to answer your question, and no sensitive data about students or trainees.
2. Parties that are not sub-processors of BIQSDRIVE
Some parties receive data through the Platform, but do not process it on behalf of BIQSDRIVE. That is why they are not in the list above:
| Party | Role | Explanation |
|---|---|---|
| Your organisation's mail server (such as Google Workspace or Microsoft 365) | Processor of your organisation | Emails from the Platform are sent through BIQSDRIVE (see Microsoft in section 1), also when they use your own sender address. Replies from your customers arrive in your organisation's mailbox, which falls under your own agreement with your mail provider. |
| Belgian Mobile ID NV (itsme®), Brussels | Separate controller | Belgian Mobile ID processes the data for the itsme® service itself, as a controller. The identity data that a student shares through itsme® is then processed in the Platform for your organisation. |
| Government authorities and exam centres (such as the Departement Mobiliteit en Openbare Werken (the Flemish Department of Mobility and Public Works), Autoveiligheid, SBAT and, for the flexi-Dimona declarations, the RSZ (the Belgian National Social Security Office)) | Separate controllers | Data is sent through the connections on the instructions of your organisation. |
| Review and survey services that your organisation connects itself: Tally BV (Tally), Ghent, Klantenvertellen B.V. (Klantenvertellen), Zaltbommel, and Google (Google Business Profile) | Processor of your organisation or separate controller | Your organisation chooses which review or survey service it connects, with its own account and under the terms of that service. BIQSDRIVE sends the invitations by email on behalf of your organisation, with the link to the review page or the form of that service. For Tally and Klantenvertellen, BIQSDRIVE also passes the recipient's name and email address to that service in the invitation, insofar as that service allows it; for Google, the invitation contains only the link. That service processes what BIQSDRIVE passes on in this way, and what a recipient fills in or publishes there, under its agreement with your organisation or as a separate controller, as Google does for reviews in Google Maps and Google Search. |
| Advertising platforms that your organisation connects itself: Google Ireland Limited (Google Ads and the Google tag) and Meta Platforms Ireland Limited (Meta Pixel and Conversions API), Dublin | Processor of your organisation, joint or separate controller, according to the terms of that service | With the Leads (CRM) module, your organisation can set up its own Google tag and Meta Pixel for the online enrolment and the inquiry form, and have BIQSDRIVE report which leads and enrolments came in (Article 7.8 of the Subscription Agreement). This only happens with the visitor's consent for marketing, with your organisation's own account and according to the terms of that service. The email address, telephone number and name are only passed on in hashed form. What Google and Meta then do with those data falls under your agreement with them and their own privacy statement, including any transfer outside the EEA by those services. |
| Odoo SA (billing) and our payment service provider | Processors of BIQSDRIVE for its own administration | For billing your organisation and collecting payments, BIQSDRIVE is itself the controller. More information is available in our privacy statement at www.biqsdrive.com/en/privacy-statement. |
3. Changes and objections
- We notify the Administrator and the billing contact of your Account by email of the addition or replacement of a sub-processor at least 30 days in advance, and we update this page.
- Within those 30 days, you can raise a reasoned objection at privacy@biqsdrive.com.
- If we cannot find a solution together, you can terminate the service concerned or the Subscription Agreement free of charge before the change takes effect (Annex C, Article C.5).
- Every sub-processor is contractually bound by the same data protection obligations as BIQSDRIVE. BIQSDRIVE remains liable to your organisation for their performance as for its own acts.
4. Further chain
Our sub-processors may themselves use their own sub-processors, such as data centres and infrastructure suppliers. Their current lists, and the privacy statements of the payment institutions, can be found here:
- Odoo SA: www.odoo.com/privacy
- Anthropic: trust.anthropic.com/subprocessors
- Isabel NV (Ponto): privacy statement at www.isabel.eu/en/privacy-notice
- Pay. (TinTel B.V.): Pay. privacy statement
- Microsoft (Azure): servicetrust.microsoft.com
- Friendly Captcha GmbH: privacy statement at friendlycaptcha.com/legal/privacy-end-users
- e-Contract.be BV: privacy statement at www.e-contract.be
- Level 27 BV, Spryng B.V. and BIQS IT BV: on request at privacy@biqsdrive.com
5. Change history
| Date | Change |
|---|---|
| November 2026 | Version 1.7: BIQS IT BV added for support for Users and the development and maintenance of the Platform. |
| November 2026 | Version 1.6: our company details updated; the list of sub-processors has not changed. |
| October 2026 | Version 1.5: Friendly Captcha GmbH added for protecting the public forms against bots, and e-Contract.be BV for reading the identity card with a card reader; the advertising platforms Google and Meta, which your organisation connects itself, are listed among the parties that are not sub-processors. |
| October 2026 | Version 1.4: Microsoft Ireland Operations Limited (Azure Communication Services) added for sending emails from the Platform; your organisation's mail server now only receives the replies from your customers. |
| October 2026 | Version 1.3: first publication. |
Contact
Questions about data protection: privacy@biqsdrive.com. BIQSDRIVE 27 is offered by BIQSDRIVE BV, Kolmen 35 box 1, 3980 Tessenderlo-Ham, enterprise number and VAT BE 1044.893.601, RLE Antwerp, Hasselt division.