Privacy · last updated 2 November 2026

How we handle your data

This is an English translation of the Dutch version, which prevails. Hoobler helps you to sell your property yourself. For that we process personal data, and only for that. Below you can read, per situation, which data we use, why, how long we keep it and who gets to see it. That is also what the General Data Protection Regulation (GDPR) requires. If you have a question, e-mail privacy@hoobler.be.

§1 Who we are

Who is responsible for your data.

The controller for hoobler.be, the pocket (pocket.hoobler.be), Hoobler Steward and the associated services is:

Hoobler BV.

Company no.: BE 1035.824.002
Address: Puttestraat 111, 3130 Begijnendijk, Belgium
Telephone: +32 16 18 62 76
E-mail (privacy): privacy@hoobler.be

Hoobler has no data protection officer. For a company of our size and with our processing operations, that is not mandatory. With questions about your privacy you can contact the address above. We reply within 30 days.

If someone sells a property via Hoobler, that seller is themselves responsible for what happens with the data you send as a prospective buyer. We only pass on to the seller what you sent yourself.

§2 When you visit the site

What we measure, and what you choose.

Without you ticking anything, we only count how many times a page is viewed. Only when you choose so yourself in the cookie banner do we link your visit to your browser.

To make the site and the pocket work.

Data: Your login session, your cookie choice, your language and what you filled in on a form
Legal basis: Strictly necessary, so no consent needed under the ePrivacy rules. For your account: performance of the contract (art. 6.1.b GDPR)
Retention period: Your session for as long as it runs. Your cookie choice 13 months, after which we ask again. As evidence we also keep your choice on our server (device ID, hashed IP address, browser)
Recipients: Microsoft Azure (West Europe)

Anonymous counter.

Data: Page, day, country code and type of device. No cookie, no ID, no IP address and no browser characteristics
Legal basis: Falls outside the GDPR, because these figures are anonymous and cannot be traced back to you
Retention period: Unlimited, totalled per day
Recipients: Microsoft Azure

Statistics and product measurement (only if you choose so).

Data: A random browser ID and session ID, the pages you view, your clicks, how far you scroll, how long you stay on a page, where you come from and through which campaign (utm and the click ID that an advertising platform attaches to the link, such as fbclid or gclid), type of device, country code and hashed IP address. If you log in, or send a bid, question or request, we link that measurement data and your origin to your account or your e-mail address, so that we see which steps you took and through which campaign you came. If you arrive via an advertisement without making this choice, your tab remembers the campaign only until you close it, and it is only passed on with a request you make yourself
Legal basis: Consent (art. 6.1.a), via the cookie category Statistics. Off by default
Retention period: 13 months after your last visit. The link to your account remains for as long as your account exists. If you withdraw your consent, the browser ID disappears immediately
Recipients: Microsoft Azure. No third party

Advertising measurement (only if you choose so).

Data: Pixel cookies and events (page visit, request, payment) of Meta, Google, LinkedIn, TikTok and X. Through our server (Meta Conversions API) we additionally send your hashed e-mail address, telephone number and name, together with your IP address and browser. That way the pixel can recognise a conversion
Legal basis: Consent (art. 6.1.a), via the cookie category Marketing. Off by default
Retention period: As the provider determines. Our own conversion log 13 months. If you withdraw your consent, the pixels and the measurement through our server stop, and we delete the pixel cookies
Recipients: Meta, Google, LinkedIn, TikTok, X (US, see §7)

Chat on the site.

Data: Your questions (we log up to 400 characters) and, if you allow statistics, your browser ID. If you ask for the team, also your first name, surname, e-mail address and the conversation
Legal basis: Legitimate interest (art. 6.1.f): helping visitors. If we pass your question on to the team, pre-contractual (art. 6.1.b)
Retention period: Chat logs 13 months. Questions that go to the team (tickets) 24 months
Recipients: Microsoft Azure OpenAI (EU region), Postmark

Contact form, contact window and notary page.

Data: Name, e-mail address, telephone number (if you fill it in), subject, message, the page on which you completed the form and hashed IP address
Legal basis: Legitimate interest (art. 6.1.f): answering your question
Retention period: 12 months after the last contact
Recipients: Microsoft Azure, Postmark

§3 When you try something for free

Indicative price, demo, Stylist and early access.

You get what you asked for: a report, a tour, a styling example or access. After that we only e-mail you if you tick that separately. That box is never pre-ticked, and in every e-mail you can unsubscribe again with one click.

Free indicative price.

Data: E-mail address, name, telephone number, full address and coordinates, characteristics of the property (type, surface area, rooms, year of construction, plot, EPC, condition) and your answer to the question about your plans to sell
Legal basis: Pre-contractual, at your request (art. 6.1.b), for the report and one telephone call in which our property expert goes through your estimate with you. For follow-up e-mails, and for later calls: consent (art. 6.1.a) via the separate checkbox
Retention period: 12 months after the last contact. After that we anonymise the request and keep it only as a statistic
Recipients: Microsoft Azure, Postmark. The market figures come from Statbel (open data) and from our own comparison points

Free demo (tour).

Data: First name, surname, e-mail address, telephone number (if you fill it in), what you bring, timeframe, type of property, browser and what you viewed in the demo
Legal basis: Pre-contractual (art. 6.1.b) for the demo. For follow-up e-mails, and for a call if you gave your number: consent (art. 6.1.a)
Retention period: 12 months
Recipients: Microsoft Azure, Postmark

Hoobler Stylist (virtual styling).

Data: E-mail address, name, the photos you upload and the images that result from them
Legal basis: Pre-contractual, at your request (art. 6.1.b), also for editing your photos: without your photos we cannot show you the result
Retention period: Photos and results 30 days. Your request 12 months
Recipients: Microsoft Azure, and Google Gemini for editing the images (EU, see §7)

Request for early access.

Data: Name, e-mail address, telephone number, what you want to sell, the location, whether you have sold something before and how you found us
Legal basis: Pre-contractual (art. 6.1.b): we contact you about your request. For news and tips: consent (art. 6.1.a) via the separate checkbox
Retention period: 24 months after the last contact. Rejected requests 12 months
Recipients: Microsoft Azure, Postmark. Meta Conversions API only if you allow marketing

Follow-up e-mails and news.

Data: E-mail address, name, how you came to us, and whether those e-mails were sent and whether you clicked on them
Legal basis: Consent (art. 6.1.a) via a separate checkbox. Prospective buyers never receive these e-mails automatically
Retention period: Until you unsubscribe. The evidence of your choice 3 years
Recipients: Postmark

Referral scheme and community.

Data: Of the referrer: name, e-mail address, the code and the vouchers. If you apply for a code: also your phone number, municipality and motivation if you fill them in, and our decision on your application. Of anyone who uses a code: e-mail address, account, and the date of linking the code and of the first payment
Legal basis: Performance of the scheme you take part in as a referrer, and your application for it (art. 6.1.b). If you receive a code without asking for one: our legitimate interest in inviting you (art. 6.1.f). For anyone who uses a code: our legitimate interest in establishing whether a voucher is due (art. 6.1.f). An application we do not approve is kept briefly on the same basis, to answer questions about it. Community e-mails: consent (art. 6.1.a) through a separate tick box
Retention period: 24 months after linking the code. A code without referrals 24 months after it was created. An application we do not approve or do not handle, 3 months after the application; an approved application follows the code. Community e-mails until you unsubscribe, the proof of your choice 3 years
Recipients: Postmark, for the e-mails. The referrer receives no data about who used the code

§4 When you sell via Hoobler

Your account, your dossier and your listing.

To sell your property yourself, we process data about your identity, your documents, your payment and your listing. Hoobler is the controller for that. The notary and the buyer are each the controller for their own role.

Account and identity.

Data: Name, e-mail address, telephone number and password (stored hashed with Microsoft Entra). If you register with itsme, we receive your name, your telephone number and the confirmation that your identity and your age of majority have been verified. We do not store your date of birth or national register number
Legal basis: Performance of the contract (art. 6.1.b). For the verification of identity and age: legal obligation and legitimate interest (art. 6.1.c and f)
Retention period: For as long as your account exists. Your declarations (18 years of age or older, owner or authorised) 10 years, as evidence
Recipients: Microsoft Entra and Azure, itsme

Sale dossier and documents.

Data: Data about the property and its ownership, certificates and documents (EPC, land registry, soil, town planning, asbestos, inspections), photos, price and estimate, messages, your conversation with your Hoobler Expert, your task list and your conversations with the Hoobler assistant
Legal basis: Performance of the contract (art. 6.1.b), also if you build your dossier free of charge. For data of others in your documents, such as co-owners or tenants: legitimate interest (art. 6.1.f), because without those documents you cannot sell your property
Retention period: 10 years after the sale, for any liability. Personal data of others in the dossier we anonymise as soon as the dossier is closed. A dossier that was never online and for which you did not pay, we keep until 24 months after your last activity, with two warnings beforehand. What still remains after that, you can read in §11. If no sale follows, we keep your conversation with your Hoobler Expert until 10 years after your package ends.
Recipients: Microsoft Azure, Azure OpenAI and Azure Document Intelligence (summarising, reading out documents and blacking out), Google Gemini (reading out documents and photos, EU), Postmark

Your listing, on Hoobler and on Zimmo.

Data: The listing (photos, text, price, address down to street level) and the statutory notices. With Zimmo, the contact requests also come back to your pocket
Legal basis: Performance of the contract (art. 6.1.b). Zimmo only if you switch it on
Retention period: For as long as your property is for sale. Sold properties we show as a reference, until you hide them
Recipients: Visitors of the showroom, Zimmo (BE)

Coming soon in the showroom.

Data: As long as your dossier is in preparation: the place name from the address of your property, the type of property, the number of bedrooms, a pin at a fixed spot in the square of about two by two kilometres in which your property lies, and the notice that it is coming up for sale. Where in that square your property stands cannot be derived from it. Never the address, your name, the photos or the price
Legal basis: Legitimate interest (art. 6.1.f): showing buyers which properties are coming up for sale through Hoobler, so that they can sign up for an alert in time
Retention period: For showing it, we store nothing separately. Your property is shown for as long as your dossier is in preparation and something changed in it in the last 180 days. It disappears as soon as it is online, after your objection and if you delete your account. After an objection, we keep the fact that you objected and since when, for as long as your dossier exists. That way your property will not come back
Recipients: Visitors of the showroom on hoobler.be and hoobler.eu, Microsoft Azure
Objection: If you do not want your property to be shown here, e-mail privacy@hoobler.be. We then take it out, and it will not come back. Nothing changes to your dossier

Payment and invoicing.

Data: Name, address, VAT number, amount and payment reference. Your card or bank details never reach Hoobler
Legal basis: Performance of the contract (art. 6.1.b) and accounting legislation (art. 6.1.c)
Retention period: 7 years
Recipients: Mollie (NL), Billit (BE)

Interest in your property.

Data: The number of views per day and the interest in total. When a candidate looked and how great his or her interest is, we do not show to sellers as long as the legal basis for that has not been confirmed
Legal basis: Legitimate interest (art. 6.1.f) for the figures in total
Retention period: For as long as the property is for sale. After that we anonymise the data
Recipients: You as the seller, Microsoft Azure

Business customers (Hoobler Steward) and the realtor programme.

Data: Company data, members (name, e-mail address, role), subscription, invoices and credits
Legal basis: Performance of the contract (art. 6.1.b)
Retention period: For as long as the contract runs, plus 10 years
Recipients: Billit, Microsoft Azure, Postmark

Realtors who ask for contact.

Data: Name, office, e-mail address, phone number, region or municipality, and what you fill in yourself about how you work and what you want to know
Legal basis: Steps at your request before a contract (art. 6.1.b). If you ask on behalf of an office you work for: our legitimate interest in answering that question (art. 6.1.f)
Retention period: 12 months after the last contact if no collaboration follows. If a collaboration follows, the periods of that agreement apply
Recipients: Postmark, for the confirmation e-mail

§5 When you are a prospective buyer

Questions, viewings and bids.

Your question, viewing request or bid goes to one owner. They only get to see it after you confirm your e-mail address, and only then does it also enter our contact book. We do not put you on a mailing list. Alerts about new properties you request yourself.

Question, viewing, document request or bid.

Data: Name, e-mail address, telephone number, your question or message, the time slot you chose, the amount and the conditions of your bid, how you finance and possibly proof of financing, your declaration that you are 18 years of age or older, the confirmation of your e-mail address (double opt-in) and hashed IP address against abuse
Legal basis: Pre-contractual, at your request (art. 6.1.b). The owner receives your data as an independent controller for their own sale
Retention period: Until the sale plus 12 months, after which we anonymise it. Proof of financing 90 days after a rejection, or until the deed
Recipients: The owner, the notary once a bid has been accepted, Microsoft Azure, Postmark

After an accepted bid, and Hoobler Nest.

Data: Data of buyer and notary, the sale agreement, the date of the deed and the document vault after the sale
Legal basis: Performance of the contract (art. 6.1.b)
Retention period: The vault for as long as you use it. If you do not use it for a long time, we warn you and delete it
Recipients: Notary, Microsoft Azure, Postmark

Alerts and saved searches.

Data: E-mail address, what you are looking for, your confirmation (double opt-in), and whether the alerts were sent and whether you clicked on them
Legal basis: Consent (art. 6.1.a)
Retention period: Until you unsubscribe. The evidence of your choice 3 years
Recipients: Microsoft Azure, Postmark

§6 Behind the scenes

E-mails, security, customer contact and evidence.

Some processing you do not see. It ensures that your e-mails arrive, that we stop abuse and that we can demonstrate which choices you made.

Delivering e-mails.

Data: E-mail address, content and status of every e-mail. For news and follow-up e-mails also whether you opened the e-mail or clicked on a link
Legal basis: Performance of the contract (art. 6.1.b) to deliver e-mails. Opens and clicks we only track for e-mails for which you gave consent
Retention period: E-mails 24 months. Data about opens and clicks 90 days
Recipients: Postmark (US, see §7)

Security and preventing abuse.

Data: Login attempts (e-mail address, IP address, browser), a limit on the number of requests per IP address, hashed IP address on submissions, decoy fields against spam (honeypots), suspensions and a register of incidents
Legal basis: Legitimate interest (art. 6.1.f): protecting accounts and the platform
Retention period: Security logs 12 months. Hashed IP address on submissions 90 days
Recipients: Microsoft Azure. In the event of an incident also the Data Protection Authority and the data subjects, as the duty to notify requires

Customer contact (CRM).

Data: Contact details, contact moments, notes, appointments and e-mails from our team mailbox that are linked to your contact card
Legal basis: Performance of the contract and legitimate interest (art. 6.1.b and f)
Retention period: 24 months after the last contact. If you have an account, for as long as your account exists. For customers who paid for a package: for as long as the contract runs, plus 10 years
Recipients: Microsoft 365 and Microsoft Graph (EU tenant), Microsoft Azure

Evidence of your consent and your requests.

Data: Your cookie choices, your choices on forms, your requests for access or erasure and the deletion log (with hashed e-mail address)
Legal basis: Legal obligation (art. 6.1.c): being able to demonstrate what you chose
Retention period: 3 years after you withdrew your consent or after your request was handled
Recipients: Microsoft Azure

§7 Who sees the data

Our providers, and data outside the EU.

Hoobler works with a small number of providers that process data on our behalf. The GDPR calls them processors (art. 28). We have a data processing agreement with each of them. Your data is stored on servers in the European Union.

Some services process data outside the European Economic Area (EEA). For that we rely on the EU-US Data Privacy Framework or on the standard contractual clauses of the European Commission (Implementing Decision 2021/914). On top of that, the data is encrypted, both in transit and where it is stored.

Hosting, database and storage

Provider: Microsoft Azure
Where: EU (West Europe)
Safeguard: Within the EEA

Accounts and passwords

Provider: Microsoft Entra
Where: EU
Safeguard: Within the EEA

AI assistant, summaries and reading out documents

Provider: Microsoft Azure OpenAI
Where: EU region (Sweden)
Safeguard: Within the EEA. Your data is not used to train the models

Reading documents and blacking out

Provider: Microsoft Azure Document Intelligence
Where: EU region
Safeguard: Within the EEA. Your documents are not used to train the models

Reading out documents, enhancing photos and virtual staging

Provider: Google Cloud (Gemini)
Where: EU region
Safeguard: Within the EEA, with a data processing agreement. Your data is not used to train the models

Delivering e-mails

Provider: Postmark (ActiveCampaign)
Where: US
Safeguard: EU-US Data Privacy Framework

Verifying identity

Provider: itsme (Belgian Mobile ID)
Where: BE
Safeguard: Within the EEA

Payments

Provider: Mollie
Where: NL
Safeguard: Within the EEA

Invoicing and accounting

Provider: Billit
Where: BE
Safeguard: Within the EEA

Your listing on Zimmo (if you choose so)

Provider: Zimmo
Where: BE
Safeguard: Within the EEA

Inspection certificates (if you request them)

Provider: De Immowinkel BV, and the accredited inspector they schedule
Where: BE
What: Your name, e-mail address, telephone number and the address of the property, to schedule the inspection and draw up the certificate
Safeguard: Within the EEA, Immowinkel's own privacy statement

Maps and addresses on the property pages

Provider: Google Maps
Where: US
Safeguard: EU-US Data Privacy Framework. Only receives your IP address, your browser and the address you look up

Team mailbox and calendar

Provider: Microsoft 365 (Graph)
Where: EU tenant
Safeguard: Within the EEA

Advertising measurement (only if you choose so)

Provider: Meta, Google, LinkedIn, TikTok, X
Where: US
Safeguard: EU-US Data Privacy Framework or standard contractual clauses

Hoobler never sells or rents out your personal data. From which country a visit comes, we determine on our own servers. For that we send no IP address to an external service.

§8 Age and identity

Selling and bidding from the age of 18.

Selling a property or making a bid has legal consequences. That is why you declare when you register that you are 18 years of age or older. At every publication you declare that you are the owner or authorised. And with a bid you declare that you are of age and bid in your own name or under a power of attorney.

If you register with itsme, we calculate at that moment from your date of birth whether you are of age. We only store the result, not the date.

Hoobler is not aimed at minors and deliberately collects no data from children. If an account nevertheless proves to belong to a minor, we delete it.

§9 Automation and AI

How we use AI.

Hoobler uses AI as a tool. AI estimates an indicative price, reads out documents and summarises them, suggests listing texts, enhances photos and answers your questions. What AI suggests, you check yourself, and the decision remains with you.

Internally we rank requests according to how concretely someone wants to sell. That is how we choose whom we call first. That helps our team, but it is not a decision with legal consequences for you.

If you make a bid or request a viewing, Hoobler estimates how concrete your bid or your interest is: on the basis of what you fill in yourself (your bid, your conditions, your answers at a viewing) and, if you allow it, how you viewed the property. That helps the seller and our team to assess bids and viewings. It remains an estimate: the seller decides, never the software. You can object to this via privacy@hoobler.be.

Hoobler takes no decisions based solely on automated processing that have legal effects for you (art. 22 GDPR). Your data is not used to train the models of our AI providers.

§10 Security

How we protect your data.

We protect your data with appropriate technical and organisational measures (art. 32 GDPR). Traffic is encrypted (TLS 1.2 or higher) and so is storage. Our team works with personal accounts and roles, and we keep track of who opens personal data. We make regular backups, limit the number of requests and detect abuse. Where we have to keep IP addresses, we keep them only as a keyed hash.

If there is a data breach that poses a risk to your rights and freedoms, we report it within 72 hours to the Data Protection Authority and notify you directly (art. 33 and 34 GDPR).

§11 Retention and clean-up

How long we keep data.

With every processing operation above, you can see how long we keep the data. In broad terms: measurement data 13 months, requests and conversations 12 to 24 months after the last contact, sale dossiers 10 years after the sale and the accounts 7 years. After that we delete the data automatically or anonymise it. What we still use for statistics then can no longer be traced back to you.

A dossier that was never online and for which you did not pay, we clean up if you no longer work on it. After 11 months without activity you receive an e-mail with the button "Keep my dossier". It works with one click, without logging in, and resets the counter. If you do nothing, we archive your dossier after 12 months without activity, and at the earliest 3 weeks after that e-mail. You receive an e-mail then too. After 11 months archived, you receive a final e-mail with the same button, which sets your dossier back to active. If you do not click, we delete, 12 months after archiving, so 24 months after your last activity, and at the earliest 3 weeks after that final e-mail: your photos, your original documents, the address and the location of the property, and what you wrote about the property yourself. A deleted dossier does not come back. We keep the characteristics of the property that you filled in or that we extracted from your documents, such as the type of property, the surface area, the number of rooms, the year of construction, the energy label and the asking price, with the municipality and the postcode. Of your documents we keep a copy in which your personal data and the address have been blacked out automatically; a copy we could not black out reliably is deleted. All of this is detached from your account and contains nothing that points to you or your address. We use it for our figures and to improve our services. Activity is every change to your dossier and every click on that button. This does not apply to dossiers of organisations (Hoobler Steward), to dossiers that were ever online and to dossiers with an ongoing option or sale. Your account itself remains until you delete it.

If you delete your account yourself, we keep an anonymised dossier for our legal obligations. If a sale is ongoing at that moment, we notify the prospective buyers and visitors of it.

§12 Your rights

Your rights, and how you exercise them.

Under the GDPR you have the right to:

access your data and obtain a copy of it (art. 15);
have it rectified (art. 16);
have it erased (art. 17);
have the processing restricted (art. 18);
take it with you to another service (art. 20);
object to processing based on legitimate interest, and always to direct marketing (art. 21);
withdraw your consent. What was done lawfully before that remains lawful (art. 7.3).

If you have an account, you will find in your pocket, under your profile, an overview of your data, an export and the button to delete your account. You change your cookie choices via Cookie settings at the bottom of every page.

For everything else, e-mail privacy@hoobler.be. We reply within 30 days. If your request is complex, or if we receive many at once, that period may be extended by two months. To be sure that it is you, we may ask you for a copy of your identity card, with your national register number and your photo covered.

If you are not satisfied with how we handle your request, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) (Drukpersstraat 35, 1000 Brussels · contact@apd-gba.be · +32 2 274 48 00).

§13 Changes

If this statement changes.

If something material changes in what we process, we amend this statement. You hear about it at least 30 days in advance, by e-mail or in the pocket.

This version applies since 2 November 2026 and replaces all earlier versions.

Questions?

Do you have a question about your data or about this statement?Feel free to e-mail us.

privacy@hoobler.be

Back to Hoobler