Privacy policy

Data controller

Karnet is created and operated from Belgium. The service is available at karnet.be.

Hosting

The site is hosted by Infomaniak, a Swiss hosting provider. Switzerland is recognised by the European Commission as providing an adequate level of protection for personal data, allowing hosting and transfer of data from the European Union without additional specific safeguards.

Data used by the service

Karnet may process your email address, username, optional profile details, karnets and items you create, reservations, invitations, comments, subscriptions, contact messages, technical logs, security IP addresses (truncated to /24 subnet before storage) and data needed for product imports.

Purposes

• Create, secure and manage your account, sessions and login links.
• Create, share and display your karnets, items, reservations, proposals and comments according to the visibility settings you choose.
• Send service emails such as registration, login, reset, invitation, notification and unsubscribe messages.
• Protect the site against abuse, diagnose errors, log sensitive actions and maintain service stability.
• Respond to requests sent through the contact form.

Legal bases

Processing needed for accounts and karnets is mainly based on providing the requested service. Security measures, technical logs and abuse prevention are based on the legitimate interest of keeping the service safe. Some optional messages or settings are based on your choices, and limited retention may be justified by legal obligations where applicable.

Karnet visibility

Private karnets are only visible to their owner. Shared, public or friend-visible karnets follow the visibility level chosen at creation or modification.

Recipients and providers

Data is available to authorised people according to the sharing rules you choose. It may be processed by technical providers required for the service: Infomaniak for hosting, the configured email service for sending messages, Cloudflare Turnstile if bot protection is enabled, OpenStreetMap/Nominatim for some address searches, product page providers queried during imports, and Matomo for analytics unless you opt out.

Cookies, analytics and local storage

Karnet mainly uses cookies that are necessary or useful for the service. No targeted advertising is displayed.

• Session cookie: keeps you logged in and secures account actions.
• Language cookie: remembers your language preference for one year.
• Matomo analytics: audience measurement used to understand site usage. Matomo cookies are disabled in the script, and you can prevent Matomo from loading below.
• Cloudflare Turnstile: may be used on some forms to limit abuse and automated registrations.
• Service worker/local cache: enables some web app and offline-mode features.

Security

Passwords are stored as hashes, sensitive actions use CSRF protection and data access is controlled server-side.

Retention

Account and karnet data is kept while the account or content exists. Unfinished accounts may be deleted after 7 days. Contact messages are kept to process your request and deleted after 90 days. Registration links are deleted after use or expiry, reset links after around 1 day, expired sessions after around 30 days, abuse-rate limits after around 7 days, product imports after a limited period, and technical logs generally up to 90 days unless security or diagnostics require otherwise.

Your rights

You may request access, rectification, erasure, restriction, objection or portability of your data where these rights apply. Requests are handled within one month, unless the request is complex or your identity must be verified.

Complaint

If you believe your rights are not respected, you may lodge a complaint with the Belgian Data Protection Authority.

Contact

For any questions about your data, contact us via the contact page or at the address info@karnet.be.