Privacy Policy
Last updated:
Download original PDFOstora respects your privacy and processes personal data in line with the GDPR (Regulation (EU) 2016/679) and Belgian law. This policy covers our website and our own commercial contacts.
1. Who is responsible?
Ostora , Antwerp, Belgium, VAT BE0795.294.585 Email: info@ostora.be · Phone: +32 486 84 77 86 Ostora is the data controller for the data described in this policy. When Ostora processes data on behalf of a customer (for example conversations an AI agent has for that customer), Ostora acts as processor and the Data Processing Agreement applies. The customer is then the controller.
2. What data do we process and why?
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, phone, company, message (contact form, demo request) | Answer your request and prepare a call or quote | Steps prior to a contract; legitimate interest |
| Booking details (Cal.com or similar) | Schedule appointments | Steps prior to a contract |
| Customer, billing and contact person data | Perform the contract, invoice, accounting | Performance of a contract; legal obligation |
| Conversations with our demo agent ("Talk to AI"): voice or text, transcript | Provide the demo, improve the service, prevent misuse | Consent or legitimate interest |
| Website usage: IP address, device, pages, cookies | Operation, security and statistics | Legitimate interest (necessary cookies); consent (analytics and marketing cookies) |
| Business contact details of prospects (B2B) | Commercial outreach to companies | Legitimate interest, with right to object |
| Data | Purpose | Legal basis |
|---|---|---|
| Newsletter and marketing sign-up | Send news and offers | Consent |
We do not collect special categories of personal data (such as health data) through our website and ask that you do not share them.
3. Who do we share data with?
Only with parties we need to deliver our services, under data processing agreements where required:
Hosting, database and website providers Telephony, messaging and AI providers (for voice, text and transcription) Booking, CRM, email and accounting tools Analytics and advertising platforms (only with your consent where required) Accountant, legal and tax advisers Authorities when required by law We do not sell your data.
4. Transfers outside the EEA
Some providers are located or process data outside the European Economic Area (for example in the US). In that case we ensure appropriate safeguards, such as an adequacy decision (including the EU-US Data Privacy Framework for participating companies) or EU standard contractual clauses.
5. How long do we keep data?
| Data | Retention |
|---|---|
| Contact form and enquiries | Up to 24 months after last contact |
| Prospect data | Up to 24 months, unless you become a customer |
| Customer and billing data | 7 years (statutory accounting duty) |
| Demo conversations and transcripts | Up to 90 days |
| Analytics cookies | See cookie banner (usually up to 13 months) |
After that we delete or anonymise the data.
6. Your rights
You have the right to:
access your data rectification and erasure restriction of processing data portability object to processing based on legitimate interest, including direct marketing withdraw your consent at any time Email info@ostora.be. We reply within 1 month. We may ask you to confirm your identity.
7. Making a complaint
You can complain to the Belgian Data Protection Authority (Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be) or to the supervisory authority in your own EU country.
8. Cookies
Necessary cookies: needed for the site to work. No consent required.
Analytics cookies: measure site usage. Only with consent.
Marketing cookies (such as Meta Pixel): for advertising. Only with consent.
You can change your choice at any time via the cookie banner or your browser settings.
9. Security
We take appropriate technical and organisational measures, such as encrypted connections (HTTPS), access restriction and backups. We report a data breach that poses a risk to you in line with the GDPR.
10. AI and automated decisions
Our AI agents hold conversations and book appointments. We do not make decisions with legal or similarly significant effects based solely on automated processing. You are informed when you communicate with an AI.
11. Changes
We may update this policy. The latest version is on our website with the date of last change.