LegioLog privacy statement
Version 1.0, 30 October 2026. This statement describes how Basepay B.V., trading as LegioLog, established in Amsterdam, the Netherlands, Dutch Chamber of Commerce number 42081353 ("LegioLog", "we"), handles personal data. Questions: info@basepay.nl. This English version is binding. Translations are provided for information only.
1. When this statement applies
This statement applies to the website legiolog.com, the pilot and ordering process and our own administration. For personal data we process in the app on behalf of our customers, for example the name of an employee who records a flush, we are the processor and the customer is the controller; the data processing agreement applies to that. This is explained in section 7.
2. What data we process and why
Pilot and call requests. Name, company name, type of location, country, email address and optionally a phone number. We use this data to contact you about a pilot or a call. Legal basis: steps taken at your request before entering into a contract. Retention: no longer than 12 months after the last contact, or shorter at your request.
Video calls. Name, email address, optionally a phone number, company name and the answers you give about your location when booking. We use this data to schedule the call, send you a calendar invitation and reminders, and prepare the conversation. Legal basis: steps taken at your request before entering into a contract. Retention: no longer than 12 months after the last contact.
Orders. Company name, contact person, email address, phone number, delivery address, company registration number, VAT number, the kit configuration and payment data (we only receive the payment status from our payment provider, no account or card details). We use this data to perform the agreement, for invoicing and for shipping. Legal basis: performance of the agreement and a legal (tax) obligation. Retention: 7 years for invoice data (tax retention obligation); other order data until 2 years after the agreement ends.
Setup questionnaire. After an order we ask for information about your location (buildings, taps, plant room) and, optionally, photos of it, so we can set up your kit in advance. Please avoid showing recognisable people in these photos; if people do appear by accident, we use the photo only to set up your kit. Legal basis: performance of the agreement. Retention: until 2 years after the agreement ends.
Accounts. Name, email address and login details (passwords stored encrypted) of users of the app. Legal basis: performance of the agreement. Retention: until 60 days after the subscription ends, unless a longer legal retention period applies.
Business prospects. For our own sales we process business contact details of companies and institutions with a shared water installation, such as campsites, holiday parks, marinas and hotels (company name, business address, business phone number and email address, website). This data comes from public sources such as business directories and company websites. We use it to contact you once or a limited number of times about our services. Legal basis: legitimate interest (direct marketing to business contacts). If you do not want to be contacted, we delete your data straight away. Retention: no longer than 12 months after the last contact.
Contact and support. Correspondence by email or phone. Legal basis: legitimate interest (good service). Retention: no longer than 2 years after the matter is closed.
AI help in the app. If you ask the help in the app a question, we send your question and the account data relevant to the answer (such as your locations, open alerts and rounds) to a language model through OpenRouter. The model cannot change anything in your account. We keep the conversation for 30 days; if you pass the conversation on to a member of staff, it becomes part of your support correspondence. Legal basis: performance of the agreement.
Sensor data. The temperature measurements of sensors are not personal data; they concern pipes, not people.
3. No tracking
The website does not use advertising or tracking cookies or social media pixels. The app only uses functional cookies needed to log in and stay logged in. Functional cookies do not require consent, which is why we do not show a cookie banner. If this changes, we will update this statement and ask for consent first where required.
4. Who we share data with
We do not sell personal data. We share data only with service providers we need to deliver our services, and only as far as needed:
| Service provider | Purpose | Processing location |
|---|---|---|
| Supabase | Database, authentication and storage | EU (Frankfurt) |
| Vercel | Hosting of website and app | EU (Frankfurt region) |
| Mollie | Payments | EU (the Netherlands) |
| Moneybird | Invoicing and accounting | EU (the Netherlands) |
| Resend | Transactional email | See section 5 |
| Inngest | Processing of background tasks | See section 5 |
| The Things Industries | Forwarding of sensor messages (LoRaWAN) | EU |
| Google (Calendar, Meet) | Calendar invitations and video calls | See section 5 |
| OpenRouter and the language models chosen behind it (including Google, Anthropic) | AI help: answering questions in the app and draft replies for our support staff, based on your question and the data in your account | See section 5 |
| Telegram | Internal notifications to our team (for example a new call booking or request); contains at most company name and contact name | See section 5 |
| Carriers | Delivery of your order | EU |
We have data processing agreements or equivalent arrangements with these parties. We also disclose data where a legal obligation requires us to.
5. Transfers outside the EU
Our core infrastructure (database, hosting, payments, invoicing) runs within the EU. Some supporting services (such as email delivery, background tasks, calendar and video services, the language models behind the AI help and internal notifications) may process data outside the EU, usually in the United States. In that case we ensure appropriate safeguards: an adequacy decision (such as the EU-US Data Privacy Framework) or the European standard contractual clauses, together with keeping the shared data to a minimum.
6. Security
We take appropriate technical and organisational measures, including: encrypted connections (TLS), encrypted password storage, access separation per organisation at database level (row level security), separate rights for internal systems, and recording of entries in a logbook that cannot be changed. If you suspect a security problem, please report it to info@basepay.nl.
7. LegioLog as processor (data in the app)
In the app our customers record entries such as flushing rounds and tasks. The name or account of a customer's employee may be recorded with them. For that data the customer decides the purpose and we are the processor. We process this data only on the customer's instructions and under our data processing agreement. We refer customers' employees with questions about their data in the logbook to their employer; we support the employer in answering such requests. Please note: entries in the logbook form part of the customer's legal record and therefore cannot be changed or deleted; corrections are added as a new entry. If a customer's employee makes a statement, for example that flushing took place while the sensor could not measure it, the name, role, time and reason of that statement are included in the inspection report the customer exports; that report serves the customer's legal record-keeping obligation.
8. Your rights
You have the right of access, rectification, erasure, restriction, objection and data portability, as far as the GDPR grants these. Send your request to info@basepay.nl; we respond within one month. We may ask you to identify yourself. You can also lodge a complaint with the data protection authority in your country, or with the Dutch Autoriteit Persoonsgegevens, our lead supervisory authority.
9. Changes
We may update this statement, for example for new features or service providers. The current version is always available on legiolog.com. We inform customers by email of significant changes.