Last updated: 4 November 2026
The data controller is the operator of the SofieFlat accommodations (Charleroi and Brussels, Belgium).
Contact for any question about your data: contact@sofieflat.com.
| Situation | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Visiting the website | IP address, date and time, page viewed, browser type (server technical logs) | Running and securing the website — legitimate interest | Limited period set by our hosting provider for its technical logs |
| Guest check-in form (QR code in the apartment) | First name, last name, company (optional), reason for stay, e-mail, phone, apartment, date and language of registration, plus any additional information requested in the form (marked as required or optional) | Giving you access to the wifi, practical information and house rules; contacting you about your stay — consent (which you can withdraw at any time) | 24 months at most, then automatic deletion |
| Booking and stay (direct or via Airbnb, Booking.com…) | Name, contact details, stay dates, number of nights, amounts paid, payment method | Managing your booking and stay — performance of the contract; accounting and tax returns — legal obligation | During the stay, then 10 years for accounting and tax records (Belgian tax law) |
| Contacting us (e-mail, WhatsApp) | Name, contact details, content of your message | Answering your request — legitimate interest or pre-contractual steps | As long as needed to handle the request, then at most 3 years if no booking is made |
We do not collect any sensitive data (health, opinions, etc.) and make no automated decisions about you.
Your data is never sold or rented and is not shared with any third party for commercial purposes.
If you book through a platform (Airbnb, Booking.com…) or contact us via WhatsApp, those services also process your data under their own privacy policies, which we do not control.
The public website uses no advertising cookies and no audience-measurement tools (no Google Analytics, no advertising pixel). That is why no cookie banner is shown.
The guest check-in page only uses two strictly necessary cookies:
Some information pages may display content from a third-party service (for example the climate sensor dashboard provided by Datacake); that service may then apply its own rules.
Videos on the guest check-in page (YouTube or Vimeo) only load if you click “Play video”; YouTube is then used in privacy-enhanced mode (youtube-nocookie.com). From that click, the video service applies its own privacy policy.
The website is only available over an encrypted connection (HTTPS). The management area is protected by individual accounts, encrypted passwords, login attempt limits and an activity log. Guest registrations are deleted automatically at the end of the retention period.
Under the General Data Protection Regulation (GDPR), you can at any time:
Write to us at contact@sofieflat.com. We reply within one month. We may ask you to confirm your identity, for example by writing from the e-mail address used when registering.
Data we must keep for accounting and tax obligations cannot be deleted before the legal retention period ends.
If you believe your rights are not respected, you can lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit): Rue de la Presse 35, 1000 Brussels — contact@apd-gba.be — +32 2 274 48 00 — www.dataprotectionauthority.be. You may also contact the authority of your country of residence within the EU.
This page may be updated, for example if we add a new service. The date of the last update is shown at the top.