Privacy Policy

1. Identity of the data controller

The controller of your personal data is:

CONNIT SRL
Company number: 0797.295.755
Registered office: Avenue Reine Astrid 49, 1780 Wemmel, Belgium
Email: contact@loutou.com

2. Personal data collected

We only collect the data necessary for the operation of the Platform. These data come from three sources:

2.1 Data you provide directly

• Identification data: surname, first name, email address, telephone number
• Profile data: profile photo, biography, city of residence
• Identity documents: identity document provided during KYC verification
• Listing data: description of offered Items, photos, prices, availability
• Communication data: messages exchanged via the integrated messaging system, reports, support requests
• Item condition data: photos, checks and remarks at the start and end of the rental, the renter’s answer (confirmation or disagreement, with its description and photos) and, where applicable, electronic signatures
• Review content: ratings and comments left after a rental

2.2 Data generated through use of the Platform

• Transaction data: Booking details (dates, duration, amounts, status, cancellation policies)
• Payment data: information relating to the payment instrument (processed exclusively by Stripe; Loutou does not store card data)
• Activity history: listings created, bookings made or received, reviews published

2.3 Data collected automatically

• Technical data: IP address, browser type, operating system, language
• Browsing data: pages visited, session duration, actions performed on the Platform
• Device data: device identifier, mobile app version
• Cookies and similar technologies: see section 11 below

Loutou does not collect sensitive data within the meaning of Article 9 GDPR (racial origin, political opinions, health data, etc.).

3. Purposes and legal bases of processing

Any processing of personal data carried out by Loutou is based on one of the following legal bases defined by the GDPR:

• Performance of a contract: processing is necessary for the performance of the contract between Loutou and the User
• Legal obligation: processing is required by applicable Belgian or European law
• Legitimate interest: Loutou has a legitimate interest in processing the data, provided it is not overridden by your interests or fundamental rights
• Consent: you have given explicit consent for processing for specific purposes (for example marketing communications)

4. Sharing your data

Loutou never sells your personal data. Your data may be shared in the following cases:

4.1 With other Users

In the context of a rental, certain profile information is visible to the other party: name, profile photo, reviews received, and the information necessary to hand over the Item. No banking data or identity document is communicated to other Users.

4.2 With our technical processors

Loutou uses third-party service providers to operate the Platform (payment processing, hosting, notifications, analytics). These providers act exclusively as processors: they only process your data on Loutou’s instructions and under GDPR-compliant contracts containing strict confidentiality and security clauses.

Stripe (payments): payments and card data are processed directly by Stripe Payments Europe, Ltd., which acts as a separate data controller for transaction security, fraud prevention, and PCI-DSS compliance. This data is never stored on Loutou servers. For more details, see the Stripe Privacy Policy.

Google (artificial intelligence): the photos, title and description of a listing are sent to Google (Gemini service) to check that the photos follow our rules and to suggest the item's category. Google acts as a processor and does not use this content to train its models.

Loutou ensures that any processor offers a level of data protection equivalent to that guaranteed by this policy and by the GDPR. The detailed list of processors may be provided upon request at contact@loutou.com.

4.3 Where legally required

Loutou may be required to disclose certain personal data to competent judicial, tax, or administrative authorities in response to a duly formulated legal request.

4.4 In the event of a transfer of business

In the event of a merger, acquisition, or partial or total transfer of Loutou’s business, your personal data may form part of the transferred assets. You will be informed in advance of any such transfer.

5. Transfers of data outside the European Union

Some processors used by Loutou may be established or host data outside the European Economic Area (EEA). In all such cases, Loutou ensures that appropriate safeguards are contractually in place in accordance with the GDPR, notably through Standard Contractual Clauses approved by the European Commission.

Whenever possible, Loutou prefers providers hosting data within the European Union in order to limit transfers to third countries. Loutou only transfers your data outside the EEA when strictly necessary and under conditions providing a level of protection equivalent to that guaranteed within the European Union.

6. Data retention period

We only retain your personal data for as long as necessary for the purposes for which it was collected, or to comply with our legal obligations. The detailed periods by processing category are set out in the table in section 3.

At the end of the applicable retention periods, data are either securely deleted or irreversibly anonymized for statistical purposes.

Closing your account results in the deletion of your visible profile on the Platform. Some data may nevertheless be kept longer to comply with our legal obligations or for the defense of legal claims.

7. Data security

Loutou implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, alteration, or accidental disclosure. These measures include, in particular:

• Encryption of communications via HTTPS/TLS
• Encryption of stored sensitive data
• Access control and strong authentication
• Regular data backups
• Monitoring and logging of system access

In the event of a personal data breach likely to create a risk to your rights and freedoms, Loutou undertakes to notify the Data Protection Authority within 72 hours in accordance with Article 33 GDPR and to inform you where the risk is high.

If you believe the security of your data has been compromised, please contact us immediately at contact@loutou.com.

8. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you, together with information on its processing.
• Right to rectification: you may request correction of inaccurate or incomplete data concerning you.
• Right to erasure: you may request deletion of your data in the cases provided for by the GDPR.
• Right to restriction of processing: in certain circumstances, you may request that we limit the processing of your data.
• Right to data portability: you may request to receive your data in a structured, commonly used, and machine-readable format.
• Right to object: you may object to processing based on Loutou’s legitimate interest.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time.

How to exercise your rights

Send your request by email to contact@loutou.com, specifying your identity and the right you wish to exercise. We will respond within one month from receipt of your request.

If you believe your rights are not respected, you may lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.autoriteprotectiondonnees.be.

9. Marketing communications

With your explicit consent, we may send you communications about Loutou news, new features, or offers likely to interest you. You may withdraw this consent at any time by clicking the unsubscribe link in each commercial email or by contacting us directly.

Transactional notifications (booking confirmations, reminders, security alerts) are not subject to consent; they are necessary for contract performance and your security.

10. Minors

The Loutou Platform is intended for persons aged 18 and over. Loutou does not knowingly collect personal data from minors. If you discover that a minor has created an account on the Platform, please report it to contact@loutou.com so that we may take appropriate measures.

11. Cookies and tracking technologies

The Platform uses cookies and similar technologies to ensure proper operation and improve your experience. A cookie is a small text file placed on your device during your visit.

We notably use:

• Essential / technical cookies: necessary for the operation of the Platform (authentication, session security, preferences). They cannot be disabled.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the proper functioning of the Platform.

12. Automated decisions and profiling

Loutou does not make decisions producing legal effects or similarly significantly affecting you based solely on fully automated processing of your personal data (profiling within the meaning of Article 22 GDPR).

13. Changes to this policy

Loutou reserves the right to update this privacy policy to reflect regulatory, technological, or operational developments related to the Platform. The date of the last update is indicated at the top of this document.

In the event of a substantial change, we will inform you by email and/or visible notice on the Platform with reasonable prior notice. Continued use of the Platform after the changes take effect constitutes acceptance of the updated policy.