Who processes personal data on our behalf
As a driving school or training centre, you are the controller of the data of your students, trainees, instructors and business customers. BIQSDRIVE processes that data on your behalf, in accordance with the Data Processing Agreement (Annex C to the Subscription Agreement). For certain services, we engage suppliers ourselves: our sub-processors. By entering into the Subscription Agreement, you gave general authorisation for this, on the basis of this list (Article 28(2) and (4) GDPR).
1. Current sub-processors
| Sub-processor | Service | Which data | Location | Transfer outside the EEA | Since |
|---|---|---|---|---|---|
| Level 27 BV Hasselt, Belgium BE 0890.439.412 | Hosting of the Platform, the database and the backups | All Customer Data | Belgium (backups within the EEA) | No | October 2026 |
| Spryng B.V. Amsterdam, the Netherlands | Sending text messages (SMS), such as lesson reminders and notifications | Mobile number of the recipient and content of the message | Frankfurt, Germany | No | October 2026 |
| Odoo SA Grand-Rosière, Belgium BE 0477.472.701 | Helpdesk and support tickets | Name and contact details of the User, content of the ticket and attachments | Belgium and France; backups in France, the Netherlands and Sweden | No | October 2026 |
| Anthropic Ireland, Limited Dublin, Ireland, with processing by Anthropic PBC (United States) | AI agents in the Platform: the AI support agent (24/7), the admin agent and the planning agent | Questions to the agents and their answers and suggestions, name and email address of the User, data the User shares in a conversation, and the Customer Data that the agents look up within the User's permissions (such as enrolments, lessons, planning, payments and exam registrations), with the exception of national register numbers, INSZ numbers (Belgian social security numbers), identity documents, full addresses, dates of birth, internal notes, account numbers and imported bank transactions, and of the type of or reason for an absence, comments on leave requests, corrections to time records and Dimona declarations. As a location, the planning agent only uses the municipality or the postcode. | United States | Yes, with the standard contractual clauses of the European Commission in Anthropic's data processing agreement | October 2026 |
| Isabel NV (Ponto) Keizerinlaan 13-15, 1000 Brussels BE 0455.530.509 | Bank connection: importing the transactions of the connected payment accounts (account information service supervised by the National Bank of Belgium) | Transactions of the connected accounts (date, amount, payment reference, name and account number of the counterparty); the Platform only stores the matched customer payments | See the Isabel NV privacy statement | See the Isabel NV privacy statement | October 2026 |
| TinTel B.V. (Pay.) Spijkenisse, the Netherlands Chamber of Commerce (KvK) 24283498 | Online payments, SoftPOS and payment terminals, and the reporting of payments back to the Platform (payment institution supervised by De Nederlandsche Bank) | Name and email address of the payer, amount, description, payment method, transaction reference and masked card details | See the Pay. privacy statement | See the Pay. privacy statement | October 2026 |
Isabel NV and Pay. are regulated payment institutions. For their own tasks, such as executing payments and anti-money laundering checks, they are themselves the controller. For the location of their processing and any transfer outside the EEA, we refer to their privacy statements (section 4).
Good to know about the AI agents
Anthropic does not use the data to train its models. By default, Anthropic erases inputs and outputs within 30 days, except where a conversation is flagged by automated abuse detection (then up to 2 years) or where the law requires longer retention. The agents only see what the User is allowed to see and make suggestions; a member of staff of your organisation decides.
In a conversation with an agent, only share the data needed to answer your question, and no sensitive data about students or trainees.
2. Parties that are not sub-processors of BIQSDRIVE
Some parties receive data through the Platform, but do not process it on behalf of BIQSDRIVE. That is why they are not in the list above:
| Party | Role | Explanation |
|---|---|---|
| Google (Google Workspace) or Microsoft (Microsoft 365) | Processor of your organisation | Emails from the Platform are sent through your organisation's own mail server. Your organisation has its own agreement with Google or Microsoft for this. |
| Belgian Mobile ID NV (itsme®), Brussels | Separate controller | Belgian Mobile ID processes the data for the itsme® service itself, as a controller. The identity data that a student shares through itsme® is then processed in the Platform for your organisation. |
| Government authorities and exam centres (such as the Departement Mobiliteit en Openbare Werken (the Flemish Department of Mobility and Public Works), Autoveiligheid, SBAT and, for the flexi-Dimona declarations, the RSZ (the Belgian National Social Security Office)) | Separate controllers | Data is sent through the connections on the instructions of your organisation. |
| Review and survey services that your organisation connects itself: Tally BV (Tally), Ghent, Klantenvertellen B.V. (Klantenvertellen), Zaltbommel, and Google (Google Business Profile) | Processor of your organisation or separate controller | Your organisation chooses which review or survey service it connects, with its own account and under the terms of that service. BIQSDRIVE sends the invitations by email on behalf of your organisation, with the link to the review page or the form of that service. For Tally and Klantenvertellen, BIQSDRIVE also passes the recipient's name and email address to that service in the invitation, insofar as that service allows it; for Google, the invitation contains only the link. That service processes what BIQSDRIVE passes on in this way, and what a recipient fills in or publishes there, under its agreement with your organisation or as a separate controller, as Google does for reviews in Google Maps and Google Search. |
| Odoo SA (billing) and our payment service provider | Processors of BIQSDRIVE for its own administration | For billing your organisation and collecting payments, BIQSDRIVE is itself the controller. More information is available in our privacy statement at www.biqsdrive.com/en/privacy-statement. |
3. Changes and objections
- We notify the Administrator and the billing contact of your Account by email of the addition or replacement of a sub-processor at least 30 days in advance, and we update this page.
- Within those 30 days, you can raise a reasoned objection at privacy@biqsdrive.com.
- If we cannot find a solution together, you can terminate the service concerned or the Subscription Agreement free of charge before the change takes effect (Annex C, Article C.5).
- Every sub-processor is contractually bound by the same data protection obligations as BIQSDRIVE. BIQSDRIVE remains liable to your organisation for their performance as for its own acts.
4. Further chain
Our sub-processors may themselves use their own sub-processors, such as data centres and infrastructure suppliers. Their current lists, and the privacy statements of the payment institutions, can be found here:
- Odoo SA: www.odoo.com/privacy
- Anthropic: trust.anthropic.com/subprocessors
- Isabel NV (Ponto): privacy statement at www.isabel.eu/en/privacy-notice
- Pay. (TinTel B.V.): Pay. privacy statement
- Level 27 BV and Spryng B.V.: on request at privacy@biqsdrive.com
5. Change history
| Date | Change |
|---|---|
| October 2026 | Version 1.3: first publication. |
Contact
Questions about data protection: privacy@biqsdrive.com. BIQSDRIVE is a product of BIQS IT BV, Kolmen 35 box 1, 3980 Tessenderlo-Ham, enterprise number and VAT BE 0899.469.023, RLE Antwerp, Hasselt division.