Privacy Policy
This Privacy Policy explains how Penbox processes personal data when you visit our website https://penbox.io, use our platform https://app.penbox.io, connect a mailbox to Penbox, or get in touch with us.
This policy is effective as of 5 November 2026.
Last updated: 6 November 2026
1. Who We Are
Penbox SRL is a company registered in Belgium under number BE 0738.549.585, with its registered office at Rue des Pères Blancs 4, 1040 Etterbeek, Belgium (“Penbox”, “we”, “us”).
Penbox has appointed an external Data Protection Officer (DPO). For any question about this policy or your personal data, you can contact our DPO at dpo@penbox.io.
2. Our Two Roles: Controller and Processor
Penbox as controller. We decide how and why personal data is processed for our own activities: our website, our relationship with prospects and customers, the accounts of the people who use Penbox, billing, support and marketing. This policy mainly covers these activities.
Penbox as processor. Our customers (insurers, brokers and other businesses) use Penbox to collect documents, manage cases and handle their emails. The data they process on the platform, for example about their own clients, claimants or partners, is processed by Penbox on their behalf and on their instructions, under a data processing agreement (DPA) compliant with Article 28 of the GDPR. For that data, our customer is the controller. If you are a client of one of our customers, please contact them directly to exercise your rights. If you contact us, we will forward your request to them.
3. Personal Data We Collect
Data you give us
Contact and professional details: name, professional email address, phone number, company and job title, for example when you book a demo, sign up, subscribe to our updates or contact us.
Account data: your login details, role and preferences when you create or use a Penbox account.
Communications: the content of your messages to us and of your exchanges with our support and sales teams, including notes from calls and meetings.
Billing data: billing contact, company details and payment information. Payments are handled by our payment service providers.
Data collected automatically
Website data: IP address, browser and device type, pages visited, referring site and campaign parameters, collected through cookies and similar technologies. See our Cookie Policy.
Platform usage data: how you use the platform (features used, actions performed) to operate, secure and improve it.
Technical logs: security and audit logs containing technical identifiers (user, object concerned, timestamp, IP address, action and result).
Data from other sources
To identify and qualify businesses that may be interested in Penbox, we may collect professional information about you from publicly available sources (such as your company’s website or your professional social media profile) and from business data providers.
4. Why We Use Your Data and on What Legal Basis
Providing the platform and your account, and supporting you: performance of our contract with you or your organisation.
Billing, invoicing and accounting: performance of the contract and compliance with our legal obligations.
Answering your requests and preparing a contract, such as demos and quotes: steps taken at your request before entering into a contract.
Security, fraud prevention and abuse detection: our legitimate interest in protecting our platform, our customers and their users.
Measuring and improving our website and products: our legitimate interest, and your consent for non-essential cookies.
Business development and marketing to professionals (newsletters, product updates, events, prospecting): our legitimate interest or, where required by law, your consent. You can object or unsubscribe at any time.
Complying with the law and defending our rights: our legal obligations and our legitimate interest.
Where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before the withdrawal.
5. Connected Mailboxes (Gmail and Outlook)
When you connect a Gmail or Microsoft Outlook (Microsoft 365) mailbox to Penbox, you authorise us to access data from that mailbox through the Google APIs or the Microsoft Graph API. This section explains what we access, why, and how we protect it. Mailbox data is processed on behalf of the organisation that owns the Penbox workspace.
Data we access: the email messages and attachments of the connected mailbox, its labels, folders or categories and its drafts, and the name and email address of the account.
How we use it: we use this data only to provide the features of Penbox that you use:
detect incoming emails and show them in your workspace, with their attachments, and attach them to the right case;
send emails and create drafts from your email address, when you or your team ask us to;
label or categorise the emails Penbox has processed, so you can find them in your mailbox, and keep Penbox in sync when an email is archived.
Artificial intelligence: to sort incoming emails, extract information from them and prepare draft replies, we send their content to AI models (Google Gemini and Anthropic Claude) hosted by Google Cloud Vertex AI in the European Union, acting as our subprocessor. Google Cloud processes the data only to return a result to us. Neither Penbox nor Google Cloud use mailbox data, including Google user data, to develop, improve or train generalised AI or machine learning models.
Storage: emails are stored in our database, hosted on AWS. Attachments are stored on Google Cloud Storage. For workspaces with a connected Gmail account, our AI monitoring tools receive usage figures only, such as the model used and the number of tokens. They never receive the content of emails from those workspaces. For other mailboxes, a small number of authorised staff can access this monitoring data to fix problems.
Sharing: we do not sell mailbox data and we never use it for advertising. We only transfer it to the subprocessors needed to run the features above, to comply with the law, or as part of a merger or acquisition. Our staff does not read Google user data, unless you give us explicit permission for a specific message, or it is needed for security or required by law.
Retention and deletion: received emails are kept in your workspace’s inbox, and emails attached to a case are kept as long as that case exists. The body and attachment list of archived emails that are not attached to a case are erased after 30 days by default. Their subject, sender and recipients stay in your workspace. You can disconnect your mailbox at any time from your settings: we then revoke our access and stop reading your mailbox. You can also revoke our access from your Google Account or Microsoft account settings, or through your Microsoft 365 administrator. Data already stored stays in your workspace after a disconnect. To delete it, delete the cases concerned or contact us at dpo@penbox.io, and we will delete it on request.
Limited Use (Google user data): Penbox’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Microsoft accounts: for Outlook mailboxes, access relies on the permissions granted to the Penbox application by you or your Microsoft 365 administrator in Microsoft Entra ID. These permissions can be reviewed and revoked there at any time.
6. Artificial Intelligence
All Penbox AI modules (Document Intelligence, Email Intelligence, Case Intelligence, AI agents and more) run in a private enterprise environment hosted in the European Union. That environment does not retain any data: data is processed, the result is returned to the Penbox platform, and nothing is kept on the AI side. Our customers’ data is never used to train AI models.
Penbox does not itself take decisions that produce legal or similarly significant effects about you based solely on automated processing. When our customers use Penbox AI features in their own processes, for example to check documents, sort requests or flag possible fraud, they remain responsible for those processes as controllers.
7. Who We Share Your Data With
We do not sell personal data. We only share it with:
Service providers acting on our instructions, such as hosting and infrastructure (Amazon Web Services, Google Cloud), AI processing, email delivery, customer relationship management, analytics, billing and payment, customer support and scheduling tools. They are bound by contract to protect your data and to use it only to provide their services to us.
Professional advisers and auditors, such as lawyers, accountants and our ISO 27001 certification body, under confidentiality obligations.
Authorities, courts and regulators, when required by law or to establish, exercise or defend our legal rights.
A buyer or successor, if Penbox is involved in a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data.
The detailed list of the sub-processors we use for customer data is part of our DPA and is available on request at dpo@penbox.io. We inform our customers before any change.
8. Where Your Data Is Stored
Customer data processed on the Penbox platform stays in the European Union. Our application servers and databases are hosted by Amazon Web Services in Frankfurt (Germany), backups are kept at a separate site in Belgium, and AI processing and technical logs take place in the EU. The Penbox team is based in Europe and does not access customer data from outside the EU. More details are available on our Security page.
Some of the tools we use for our own business operations, such as our website, CRM, marketing or billing tools, may involve a transfer of personal data outside the European Economic Area. In that case, the transfer relies on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses.
9. How Long We Keep Your Data
Customer data on the platform (cases, forms, documents, emails and user accounts): our customer defines the retention period in its workspace. When it expires, an automatic, logged purge runs.
End of the subscription: when a customer ends its subscription, we delete all of its data, no later than 60 days after the end of the contract or immediately on request, and provide a certificate of destruction. Deleted data then disappears from backups at the end of a rolling 30-day window.
Technical and security logs: 365 days.
Prospect and marketing data: up to 3 years after our last contact with you, unless you object or unsubscribe earlier.
Billing and accounting records: for the period required by Belgian accounting and tax law.
We may keep some data longer when it is needed to comply with a legal obligation or to establish, exercise or defend legal claims.
10. Security
Penbox is ISO/IEC 27001 certified for the whole organisation and all of its products. Data is encrypted in transit and at rest, each customer’s data is isolated at every layer, and access to production is restricted, logged and reviewed regularly. You are responsible for keeping your own login credentials confidential. See our Security page for details.
11. Your Rights
Under the GDPR, you have the right to:
access the personal data we hold about you and receive a copy;
rectify inaccurate or incomplete data;
erase your data, unless we must keep it for a legal reason;
restrict the processing of your data in certain cases;
object to processing based on our legitimate interest, and to direct marketing at any time;
data portability, to receive the data you provided to us in a structured, machine-readable format;
withdraw your consent at any time, where processing is based on consent.
To exercise your rights, contact our DPO at dpo@penbox.io. We will answer within one month. We may ask you to confirm your identity. To unsubscribe from our emails, you can also use the link included in each email.
If you believe we have not handled your data properly, you can lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, or with the supervisory authority of the EU country where you live or work.
12. Cookies
We use cookies and similar technologies on our website. Non-essential cookies are only used with your consent. See our Cookie Policy for more information.
13. Children
Our website and services are intended for professionals. We do not knowingly collect personal data from children through our website. Our customers may process data about minors in their own cases, for example a beneficiary of an insurance policy, as controllers and under their own responsibility.
14. Changes to This Policy
We may update this policy to reflect changes to our services, our practices or the law. We will publish the new version on this page and update the date at the top. If the changes are significant, we will inform our customers and registered users.
15. Contact Us
For any question about this policy or your personal data, contact our Data Protection Officer:
Penbox SRL
dpo@penbox.io
Rue des Pères Blancs 4, 1040 Etterbeek, Belgium
