Pitch BV, operating the IPRHQ platform at iprhq.com
Version 1.0. In force as from 28 September 2026.
This Privacy Policy explains how PITCH BV processes personal data in connection with the IPRHQ platform at iprhq.com and the services ordered through it. It covers visitors to iprhq.com, people who register and use an IPRHQ account, and individuals whose personal data reaches us through the matters our clients entrust to us.
IPRHQ is operated by a law firm. Much of what we do with personal data is therefore shaped by the professional rules that apply to lawyers, in particular professional secrecy. Section 10 explains what that means for your rights.
A separate policy, the Pitch BV Privacy Policy, applies to the pitch.law website and to services rendered by Pitch BV outside the IPRHQ platform.
1.1. Controller. The controller is PITCH BV, a private limited company with registered office at Gretrystraat 54, 2018 Antwerp, Belgium, registered with the Crossroads Bank for Enterprises under number BE 1013.954.658 ("PITCH", "we", "us").
1.2. When we are a controller. We act as controller for: the operation of the IPRHQ platform and its accounts; our client relationships and the handling of the matters entrusted to us; our legal and professional obligations, including client identification and anti-money-laundering checks; our billing and accounts; our own security; and our marketing.
1.3. When we are a processor. For some services we process personal data solely on the documented instructions of our client, in particular where we operate a register of processing activities or another data protection module on a client's behalf, and in parts of our monitoring services. There, the client is the controller and we are the processor, and we process the personal data only on the client's documented instructions and in accordance with Article 28 GDPR. Our agreement with that client, and not this policy, governs those activities; the client's own privacy notice applies to the individuals concerned.
1.4. Who this policy covers. This policy applies to:
1.5. Our customers are businesses. IPRHQ is offered to enterprises only. Where we refer to "you", we mean the individual whose personal data we process, who will usually be acting on behalf of a business.
1.6. Contact. For anything relating to this policy, write to info@iprhq.com or to PITCH BV, Gretrystraat 54, 2018 Antwerp, Belgium. PITCH has not appointed a data protection officer, as it is not required to do so under Article 37 GDPR.
2.1. From you. When you register an account, complete an intake questionnaire, place an order, submit documents, comment on a draft in the review workspace, contact us, or use the platform.
2.2. From the organisation you work for. Our customer may give us your contact details so that you can be given access to the platform, or so that we can deal with you on a matter.
2.3. From public sources. To prepare a document or an analysis, and to run our monitoring services, we consult public sources. These include company registers (such as the Belgian Crossroads Bank for Enterprises), published annual accounts, intellectual property registers of national, regional and international offices, domain name registration data and public DNS records, certificate transparency logs, court and decision databases, company websites, online marketplaces, app stores and public social media pages.
2.4. From monitoring. Where a customer subscribes to brand, domain or online monitoring, we collect and analyse publicly accessible pages, listings and registration records that match the customer's brands. This may include personal data about the people behind a website, a listing or a registration, such as a name, a trading name, an e-mail address, a postal address or a telephone number, where these are publicly available.
2.5. From third parties. From official authorities and registries in the course of proceedings, from local agents and co-counsel, from counterparties and their advisers, from payment providers, and from providers of company and credit information.
2.6. Automatically. When you use iprhq.com, technical data is generated by your browser and device. Section 11 covers cookies.
| Purpose | Personal data | Legal basis | How long |
|---|---|---|---|
| Creating and running your account: registration, authentication, access management, platform notifications | Name, business e-mail address, telephone number, job title, employer, account and login data, authentication and device data | Performance of a contract (Art. 6(1)(b) GDPR); our legitimate interest in a secure and functioning platform (Art. 6(1)(f)) | Duration of the account, then 12 months |
| Client identification and anti-money-laundering checks | Identity documents, company data, details of directors and ultimate beneficial owners, source of funds where applicable, screening results | Legal obligation (Art. 6(1)(c)), Act of 18 September 2017 | 10 years after the end of the client relationship |
| Delivering the services you order: intake, production of documents, analyses, filings, monitoring and enforcement | Everything you submit and everything contained in the matter: contact details, commercial terms, counterparty details, documents, correspondence, and the personal data these contain | Performance of a contract (Art. 6(1)(b)); our legitimate interest and that of our client in obtaining legal assistance (Art. 6(1)(f)) where the individual is not our client | See Section 7 |
| Establishing, exercising and defending legal claims: enforcement actions, oppositions, proceedings | Identity and contact details of registrants, sellers, operators and other counterparties; evidence of the use complained of, including screenshots and captures | Our legitimate interest and that of our client in protecting their intellectual property (Art. 6(1)(f)); for special categories, Art. 9(2)(f) | See Section 7 |
| Conflict checks | Names of the customer, the counterparties and other parties involved | Legal obligation and professional rules (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) | Duration of the firm's records |
| Billing, accounts and tax | Billing contact, address, VAT number, payment and transaction data | Legal obligation (Art. 6(1)(c)); performance of a contract (Art. 6(1)(b)) | 7 years for accounting records; 10 years for invoices in a client file |
| Support and complaints | Your message, the matter it concerns, correspondence | Performance of a contract (Art. 6(1)(b)); legitimate interest in handling requests properly (Art. 6(1)(f)) | 5 years after the last contact |
| Security, logging and abuse prevention | Access logs, IP address, device data, security events, records of calls to AI systems | Legitimate interest in the security of our systems and our clients' data (Art. 6(1)(f)); legal obligation where a breach is notifiable | 12 months, longer where an incident is under investigation |
| Improving our services | Usage data, aggregated or de-identified content, quality-control records | Legitimate interest in improving the quality and reliability of our services (Art. 6(1)(f)) | 24 months |
| Direct marketing to existing customers | Business contact details, what you ordered | Legitimate interest (Art. 6(1)(f)), Art. XII.13 Belgian Code of Economic Law | Until you object, then a suppression record |
| Other marketing, newsletters and events | Business contact details, preferences | Consent (Art. 6(1)(a)) | Until you withdraw consent, then a suppression record |
| Website analytics and cookies | See Section 11 | Consent (Art. 6(1)(a)) for non-essential cookies; legitimate interest for strictly necessary ones | See Section 11 |
3.1. Special categories. We do not seek special categories of personal data. They may nonetheless reach us through the documents in a matter. Where that happens, we process them only as necessary for the establishment, exercise or defence of legal claims (Art. 9(2)(f) GDPR) or where you have given explicit consent.
3.2. Criminal matters. Data relating to criminal convictions and offences may appear in files concerning counterfeiting and other infringements. We process it under the supervision of our lawyers and within the limits of Art. 10 GDPR and Belgian law.
3.3. If you do not provide data. Where personal data is needed to conclude or perform a contract, or to meet a legal obligation such as client identification, we cannot provide the service without it.
This Section sets out how artificial intelligence is used in the production of our work and what that means for the personal data we process.
4.1. What AI is used for. We use AI systems to build context about a matter from the information available, to search and analyse legal and registry sources, to draft and revise documents, to triage detections from our monitoring services, and to run quality checks on our own output.
4.2. Human review. No document, analysis or recommendation is released before a lawyer or IP attorney of PITCH has reviewed and approved it under their own professional responsibility. Nothing is filed, sent, published or submitted to an authority on the basis of AI output alone.
4.3. No solely automated decisions. We do not take decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing within the meaning of Art. 22 GDPR. Automated triage and scoring in our monitoring services rank material for human attention; they do not decide anything on their own.
4.4. What happens before content reaches an external AI provider. Before any content is sent to an AI provider outside our own infrastructure, it passes through automated controls designed to detect and remove or mask directly identifying and privileged information. Where a matter concerns only public register data, a lawyer may record that these controls are not required for it; that decision is recorded against the matter. Some processing, including the detection of personal data, extraction, and the generation of vector representations for search, runs on infrastructure we operate ourselves within the European Union and does not leave it.
4.5. Model training. We have switched off the use of our content for the training and improvement of the models we use, and have agreed zero or limited retention with their providers. We do not sell personal data or otherwise make it available for model training.
4.6. Our own improvements. We use information about how our systems perform to improve our prompts, templates and quality controls. For this we use aggregated or de-identified material, unless our client has separately agreed otherwise in writing.
4.7. The models we use. We use the following models:
Where we change the models or the providers we use, we update this Section.
4.8. Personal data and third-party models. Content is not sent to a model operated by a third party until it has passed through the controls described in Section 4.4, which are designed so that personal data is not submitted to those models. Independently of those controls, and as a further safeguard, we have switched off the training and improvement of those models on our content and have agreed zero or limited retention with their providers, so that content reaching them is neither retained nor used to develop them. We name Anthropic and OpenAI in Section 4.7 so that you know which providers are involved, whether or not the content sent to them constitutes personal data.
4.9. Transparency under the AI Act. Where you interact with a conversational or agent interface on IPRHQ, that interface is identified as an AI system. Where required, content generated by our systems is marked in a machine-readable format in accordance with Regulation (EU) 2024/1689.
5.1. We do not sell personal data and we do not share it with third parties for their own marketing.
5.2. Recipients. We disclose personal data to:
5.3. Service providers and sub-processors. We engage the following providers, each under a data processing agreement:
| Provider | What they do | Where they process |
|---|---|---|
| DigitalOcean | Hosting of the IPRHQ platform, its application servers and its managed database | European Union |
| Microsoft | E-mail, collaboration, document storage and authentication (Microsoft 365) | European Union |
| Cloudflare | Encrypted off-platform backups | European Union (EU-jurisdiction storage) |
| Stripe and Mollie | Processing of card and bank payments | European Union, with onward transfer to the United States in the case of Stripe |
| Sentry | Error and performance monitoring of the platform | European Union (Germany) |
| Webflow | The public marketing pages at iprhq.com | United States |
| Exact Online | Accounting and invoicing, and transmission of electronic invoices as our Peppol access point | European Union |
| Website analytics, only where you have consented (Section 11) | United States |
We keep this list current and update it when a provider is added or replaced. Where we act as processor for a client, we inform that client of any intended addition or replacement of a provider that processes its personal data, giving it the opportunity to object, as Article 28(2) GDPR requires. The models we use are set out separately in Section 4.7.
5.4. Business transfer. If our business or the IPRHQ platform is transferred to another entity, personal data may be transferred as part of it. Client files are transferred only in a manner consistent with professional secrecy and the rules of the Bar, and clients are informed.
6.1. Hosting within the European Union. IPRHQ is built to keep personal data in the European Union. The platform, its database, our backups and our own AI inference infrastructure are located in the EU.
6.2. When data does leave the EEA. Transfers outside the EEA occur in three situations:
6.3. Safeguards. Where we transfer personal data outside the EEA we rely on one of the following: an adequacy decision of the European Commission; the Standard Contractual Clauses adopted by the Commission, supplemented where necessary by additional technical and organisational measures after a transfer impact assessment; or, for transfers that are occasional and necessary for the establishment, exercise or defence of legal claims or for the performance of a contract concluded in your interest, the derogations in Art. 49 GDPR.
6.4. Information on safeguards. You may request information on the safeguards applied to a transfer, and a copy of the relevant clauses, by writing to info@iprhq.com.
7.1. Client files. We keep the file of a matter for five (5) years after the matter is closed, in line with the rules of the Bar and the limitation period for a lawyer's professional liability. Where a right we have handled remains in force, or where a longer period is needed to establish, exercise or defend a legal claim, we keep the file for as long as that is the case.
7.2. Intellectual property records. Records relating to a registered right (the application, the registration, renewals, oppositions and assignments) are kept for the life of the right and for five (5) years afterwards, because they may be needed to prove the chain of title or prior use.
7.3. Identification and anti-money-laundering records. Ten (10) years after the end of the client relationship, as required by the Act of 18 September 2017.
7.4. Accounting records. Seven (7) years, as required by Belgian tax and accounting law.
7.5. Monitoring detections and evidence. The output of an individual check is kept for one hundred and eighty (180) days, because a detection can be the evidence behind an enforcement action and enforcement runs slower than a quarter. A domain or listing we have observed but never assessed, and which nothing downstream refers to, is kept for three hundred and sixty-five (365) days and then deleted as corpus noise. Where a detection has been acted upon, it becomes part of the matter file and is kept under Section 7.1.
7.6. Accounts and platform data. For the duration of the account and twelve (12) months afterwards, so that access can be restored and questions answered.
7.7. Logs. Twelve (12) months, or longer where an incident is under investigation.
7.8. Marketing. Until you object or withdraw consent. We then keep a minimal record of your objection so that we do not contact you again.
7.9. Unsuccessful enquiries. Twelve (12) months after the last contact.
7.10. After the retention period. We delete the personal data or irreversibly anonymise it. Where deletion is not technically possible immediately, for example in a backup, we isolate the data and delete it on the next backup cycle.
We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, disclosure, alteration or destruction. These include:
8.1. Incidents. If a personal data breach occurs, we assess it without delay, notify the Belgian Data Protection Authority within 72 hours where the breach is notifiable, and inform affected individuals where the breach is likely to result in a high risk to their rights and freedoms. Where we act as processor, we notify our client without undue delay.
8.2. User responsibility. No system is entirely secure. Credentials must be kept confidential, multi-factor authentication should be used where it is offered, and any suspected compromise of an account should be reported to us without delay.
Subject to Section 10, you have the following rights in respect of your personal data:
9.1. Making a request. Write to info@iprhq.com, or to PITCH BV, Gretrystraat 54, 2018 Antwerp, Belgium, stating which right you wish to exercise and giving sufficient detail to allow us to locate your data.
9.2. Verification of identity. Where we have reasonable doubts about your identity, we may request additional information. A full copy of an identity document should not be sent; a copy with the photograph and national register number masked is sufficient.
9.3. Response time. We respond within one month. Where a request is complex, or where several requests are received, we may extend that period by a further two months and will state the reason within the first month.
9.4. Cost. Exercising your rights is free. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse to act, and will explain why.
9.5. If we hold your data on behalf of a client. Where we act as processor (Section 1.3), we will forward your request to the client who is the controller and assist them in responding.
10.1. Professional secrecy. PITCH is a law firm. Information entrusted to us by a client is covered by professional secrecy under Article 458 of the Belgian Criminal Code and the rules of the Bar. Professional secrecy cannot be waived by us. It protects the client and continues to bind us after the matter has ended.
10.2. The effect on your rights. Where personal data about you is held in a client file, professional secrecy may prevent us from confirming that we hold it, giving you access to it, or acting on a request to erase or restrict it. Belgian law gives effect to this, in particular through the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and Art. 14(5)(d) GDPR relieves us of the duty to inform you where personal data must remain confidential by reason of an obligation of professional secrecy.
10.3. Practical effect. If you are a counterparty, or a person whose details reach us through the matter of a client, we will in most cases be unable to confirm what we hold, on whose instructions, or for what purpose. This is a legal constraint on us and not a discretionary refusal.
10.4. Our response. We will acknowledge your request, state whether professional secrecy is the reason we cannot respond in full, and respond to the extent we lawfully can. You retain the right to lodge a complaint with the Belgian Data Protection Authority and to bring proceedings before the courts. The Authority exercises its powers in relation to data held by lawyers through the President of the Bar.
10.5. Other limits. Independently of professional secrecy, your rights may be limited where giving effect to them would adversely affect the rights of others, where we are required by law to retain the data, or where the data is needed for the establishment, exercise or defence of legal claims.
10.6. Our own clients. If you are our client, or act for one, these limits do not stand between you and your own file. Section 9 applies in full, and you may also ask us for your file under the rules of the Bar.
11.1. What we use. On iprhq.com we use:
| Category | What it does | Consent needed |
|---|---|---|
| Strictly necessary | Signs you in, keeps your session, remembers your cookie choices, protects against fraud and abuse, balances load | No |
| Functional | Remembers preferences such as language and layout | Yes |
| Analytics (Google Analytics) | Tells us how the site and the platform are used so that we can improve them | Yes |
| Marketing | Measures campaigns and shows relevant information | Yes |
11.2. Consent. When you first visit iprhq.com or the customer portal at portal.iprhq.com, you are asked whether you accept cookies that are not strictly necessary. Nothing in the functional, analytics or marketing categories is placed before you accept it. Refusing is as easy as accepting.
11.3. Changing your mind. You can change or withdraw your choices at any time through the cookie settings link in the footer of iprhq.com and of the customer portal, and you can delete cookies through your browser. Blocking strictly necessary cookies will stop parts of the platform from working.
11.4. Duration. Session cookies are deleted when you close your browser. Persistent cookies last no longer than 6 months, after which you are asked again.
11.5. Details. A full list of the cookies in use, their purpose and their lifetime is available in the cookie settings panel on iprhq.com.
11.6. Do Not Track. Our site does not currently respond to Do Not Track browser signals, because there is no agreed standard for doing so.
We may amend this policy, for instance when we change how the platform works, when we add or replace a service provider, or when the law changes. The version in force is always the one published at iprhq.com, with its date at the top. Where a change materially affects how we process your personal data, we will inform you in advance by e-mail or through the platform, and, where the change requires your consent, we will ask for it. Previous versions are available on request.
13.1. Contacting us. Any question, request or complaint about the processing of personal data should be addressed to info@iprhq.com or to PITCH BV, Gretrystraat 54, 2018 Antwerp, Belgium.
13.2. Supervisory authority. You have the right to lodge a complaint with the Belgian Data Protection Authority:
Gegevensbeschermingsautoriteit / Autorité de protection des données Drukpersstraat 35, 1000 Brussels, Belgium contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be
You may also complain to the supervisory authority of the EU Member State where you live or work, or where you believe an infringement occurred, and you have the right to an effective judicial remedy.
13.3. Professional supervision. Complaints about the conduct of our lawyers may be addressed to the President of the Bar of Antwerp, Bolivarplaats 20/15, 2000 Antwerp (balieantwerpen.be).
---
Pitch BV, Gretrystraat 54, 2018 Antwerp, Belgium. Enterprise number BE 1013.954.658. iprhq.com. info@iprhq.com