Privacy policy
This privacy policy describes how FolioArena handles personal data of members of affiliated investment clubs. The platform is managed by the respective club administrators and is intended solely for internal use within the closed club.
1. Who is responsible for the processing?
Compushopping CV is the data controller for the platform as a whole (hosting, technology, security). In addition, each investment club is itself responsible for the data of its own members; the administrator of your club is the point of contact for questions about your data.
2. What data do we process?
- Initials or first name — used as identification within the club (e.g. "D.V.L." or "Danny")
- Share picks — which shares you have placed in your portfolio for the club competition
- Purchase prices — the price at the time of adding, as a basis for the return calculation
- Return — calculated from current market prices relative to the purchase price
We do process your email address (for logging in, account management and email verification) and, if you set this up, reports by email. We do not process phone numbers, addresses or payment information.
3. Purpose and legal basis of the processing
Purpose: Keeping and showing investment results within a private investment club, solely for educational and recreational purposes.
Legal basis: Legitimate interest (GDPR art. 6.1.f) — the processing is necessary for the purpose for which the club was founded and the members have participated voluntarily. Where required: explicit consent (GDPR art. 6.1.a).
4. Who has access to the data?
- Members of your club — only members with the club password can view the dashboard
- Club administrator — has access to the admin panel and can manage data
- Other clubs — in the "Club Comparison" tab only aggregated returns are visible, no individual participants of other clubs
- Third parties — your hosting provider and email provider (to run the platform and send emails) and external services that the page loads (fonts, chart library) may process technical data such as your IP address in doing so. We do not sell or share data for marketing purposes.
5. How long do we keep the data?
Data is kept for as long as the club is active on the platform. When the club ends, the data is deleted from the server. Ranking history is kept for a maximum of 12 weeks.
6. Your rights
As a data subject you have the following rights:
- Right of access — you can request which data about you is stored
- Right to rectification — incorrect data can be corrected via the club administrator
- Right to erasure — you can ask for your data to be removed from the platform
- Right to object — you can object to the processing of your data
To exercise these rights, contact the administrator of your club.
7. Cookies and session management
This platform uses no tracking cookies. There is one functional, technically necessary session cookie: when you log in, the server sets an HttpOnly cookie (not readable via JavaScript, sent encrypted over HTTPS) that only indicates that you are logged in for your club, for a maximum of 8 hours. localStorage is also used for your theme preference (light/dark) and, for visitors who are not logged in, for a counter of how many free analyses and pages you have already viewed — that counter expires automatically after 48 hours and never leaves your own device. Neither relates to the session or personal data.
Platform-activiteitslog (sinds 2026-07-16): voor ingelogde gebruikers houdt het platform bij welke schermen je bezoekt en hoelang, samen met je inlogmomenten. Dit dient om het platform te beheren en te verbeteren (gebruiksinzicht), en is enkel zichtbaar voor de platformbeheerder — niet voor club-administrators of andere leden. Bij elke inlogpoging (gelukt of niet) bewaren we bovendien het IP-adres, browserinfo en de pagina van waaruit de poging kwam, om misbruik te herkennen en te beperken (bijvoorbeeld herhaalde foutieve pogingen blokkeren). Anonieme/gastbezoeken worden verder niet opgenomen in dit activiteitslog — met één uitzondering: verschijnt de registratiemelding of -muur (zie hierboven) voor een niet-ingelogde bezoeker, dan bewaren we van dat moment het tijdstip, IP-adres, browserinfo, de pagina van waaruit je kwam en je browsertaal, om te meten of dat nadien tot een registratie leidt. Bij een succesvolle registratie bewaren we om dezelfde reden diezelfde gegevens van dat moment. Deze gegevens verlopen niet via een cookie, maar via een korte serveraanvraag.
8. Security
Authentication and authorisation take place server-side: passwords are stored hashed (bcrypt) — not encryption that can be reversed, but a one-way conversion designed specifically for passwords and checked on the server, not in your browser. Personal data (member names, portfolio data) is only accessible after logging in; visitors without a valid password see an anonymised view. The connection runs exclusively over HTTPS.
9. Complaints
If you have a complaint about the processing of your personal data, you can contact the Data Protection Authority (GBA):
- Website: www.gegevensbeschermingsautoriteit.be
- Email: contact@apd-gba.be
- Phone: +32 2 274 48 00
10. Changes to this policy
This privacy policy may be amended. The date at the top of the page indicates when the policy was last updated. In the event of material changes, club members will be informed via the club administrator.