Skip to content

DEMO ENVIRONMENTAnything you do here is wiped every night and is NOT visible on the real tool. Safe to play with.

Samen Lenen
Start now

Privacy Policy

Last updated: 3 August 2026

For the use of the Platform – version 3 August 2026

Subject matter

This privacy policy (hereinafter: the "Privacy Policy") informs the Data Subject in a transparent manner about the way in which the Platform Operator processes personal data in the context of the use of the Platform.

This Privacy Policy applies to all Users of the Platform, including Entrepreneurs, Investors and visitors to the website of the Platform Operator. The Platform Operator processes Personal Data in accordance with the GDPR, the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data and all other applicable regulations.

This Privacy Policy supplements the Terms of Use. In the event of a conflict between this Privacy Policy and the Terms of Use, the provisions of this Privacy Policy shall prevail with regard to the processing of Personal Data.

Definitions

In this Privacy Policy, the following terms, each written with a capital letter, whether used in the singular or plural, have the following meaning. The terms not defined below have the same meaning as in the Terms of Use:

  • “Account”: the personal user account created by a User to gain access to (the relevant functionalities of) the Platform.
  • “GDPR”: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (general data protection regulation).
  • “Payment Service Provider”: the third party to which the processing of cash flows between the Entrepreneur and the Investors is, as the case may be, outsourced, and which possesses the permits or registrations required for that purpose.
  • “Data Subject”: the identified or identifiable natural person to whom the Personal Data relate, within the meaning of Article 4(1) GDPR.
  • “Campaign”: the financing initiative set up by an Entrepreneur via the Platform, including the Campaign Page, the requested financing amount, the conditions offered and the Model Agreement.
  • “Campaign Page”: the digital page on the Platform displaying the information of a specific Campaign, which is not publicly accessible and which can only be reached via a Personal Link.
  • “User”: any natural person or legal person consulting or using the Platform, including Entrepreneurs and Investors.
  • “Terms of Use”: the document containing the conditions under which the User may make use of the Platform.
  • “Investor”: a User, belonging to the Network of an Entrepreneur, who via the Platform considers or decides to conclude a Loan Agreement with the Entrepreneur.
  • “Loan”: the loan amount made available by the Investor to the Entrepreneur on the basis of a Loan Agreement which the Entrepreneur must repay to the Investor, increased by the agreed interest and, as the case may be, costs, in accordance with the modalities of the Loan Agreement.
  • “Loan Agreement”: the agreement regarding a Loan concluded directly between the Entrepreneur (as borrower) and the Investor (as lender) on the basis of a Model Agreement.
  • “Network”: the restricted circle of personal and business relations of the Entrepreneur (such as friends, family members, customers, suppliers or business relations) who are selected, approached and invited by the Entrepreneur themselves to participate in the Campaign.
  • “Entrepreneur”: a User that is an enterprise and that sets up a Campaign via the Platform to raise financing within its Network.
  • “Personal Link”: a personalised, non-publicly searchable hyperlink with which a member of its Network selected by the Entrepreneur gains access to a specific Campaign Page.
  • “Personal Data”: all information regarding an identified or identifiable natural person, as defined in Article 4(1) GDPR.
  • “Platform”: the software platform made available by the Platform Operator as Software-as-a-Service via www.samenlenen.be, including all associated functionalities, content and infrastructure.
  • “Platform Operator”: WinWinner Crowd BV, a company under the laws of Belgium, registered in the register of legal entities of Ghent, with its registered office at Oudenaardsesteenweg 21, 9000 Ghent and with company number 0723.682.356, which develops, maintains, operates and makes available the Platform, and which acts as Controller for the Processing activities described in this Privacy Policy.
  • “Privacy Policy”: this document containing the policy of the Platform Operator regarding the Processing of Personal Data.
  • “Processor”: the natural or legal person processing Personal Data on behalf of the Controller, within the meaning of Article 4(8) GDPR.
  • “Processing”: an operation or set of operations performed on Personal Data, as defined in Article 4(2) GDPR.
  • “Controller”: the natural or legal person who determines the purpose and means for the Processing of Personal Data, within the meaning of Article 4(7) GDPR.

Controller

Identity of the Controller

For the Processing of Personal Data in the context of the use of the Platform, the Platform Operator acts as Controller. The Data Subject can reach the Platform Operator via:

  • Postal address: Oudenaardsesteenweg 21, 9000 Ghent
  • E-mail address: info@samenlenen.be
  • Telephone number: +32473257052

Data protection officer

The Platform Operator has appointed a data protection officer (DPO) who can be reached via support@samenlenen.be.

Special position of the Entrepreneur

In some cases, the Entrepreneur itself processes Personal Data of Investors within its Network (e.g. to promote the Campaign or to execute the Loan Agreement). To that extent, the Entrepreneur acts as a separate Data Controller for its own Processing operations. The Platform Operator is not responsible for the compliance with the GDPR by the Entrepreneur in the context of its own Processing operations.

Categories of processed Personal Data

The Platform Operator collects and processes the following categories of Personal Data:

  • Identification and contact details

Surname, first name, e-mail address, address, telephone number and, if relevant, date of birth.

  • Data of the legal entity (for Entrepreneurs)

Name of the legal entity, legal form, registered office, company number, VAT number, identification of legal representatives and ultimate beneficial owners.

  • Account and connection data

Login, hashed password, IP address, browser data, date and time of connection, log files.

  • Data relating to the Campaign

The content of the Campaign, the funding amount, the loan conditions and any accompanying documents.

  • Payment and invoicing data

Bank account number, VAT number and invoicing history. The Processing of the actual payment flows is performed by the Payment Service Provider and falls under its own privacy policy.

  • Communication data

The content of the correspondence of the Data Subject with the customer service of the Platform Operator, as well as the forms filled in on the Platform.

  • Cookies and usage data

For more information about the cookies and similar technologies used by the Platform and the website of the Platform Operator, reference is made to the cookie policy on the website.

  • Sources

The Platform Operator receives Personal Data (i) directly from the Data Subject itself upon registration and use of the Platform, (ii) from the Entrepreneur (as regards Investors who are invited by the Entrepreneur in its Network) and (iii) from public sources (such as the Crossroads Bank for Enterprises) in the context of the limited checks carried out by the Platform Operator.

Purposes, legal grounds and retention periods

The Platform Operator processes Personal Data exclusively for specific, explicitly described and justified purposes. Below is an overview of the Processing operations, the underlying legal ground and the applicable retention period:

  • Account management and authentication of Users

Legal ground: performance of the agreement (Article 6.1.b GDPR). Retention period: for the duration of the Account, increased by five (5) years after the termination of the Account.

  • Activation and follow-up of Campaigns

Legal ground: performance of the agreement (Article 6.1.b GDPR). Retention period: for the duration of the Campaign, increased by ten (10) years.

  • Limited checks prior to the activation of a Campaign

Legal ground: legitimate interest of the Platform Operator (Article 6.1.f GDPR), consisting of the operational integrity of the Platform. Retention period: ten (10) years.

  • Invoicing and accounting processing

Legal ground: legal obligation (Article 6.1.c GDPR). Retention period: seven (7) years (fiscal retention period).

  • Compliance with anti-money laundering legislation

Legal ground: legal obligation (Article 6.1.c GDPR). Retention period: ten (10) years after the end of the relationship with the User.

  • Security of the Platform and fraud prevention

Legal ground: legitimate interest of the Platform Operator (Article 6.1.f GDPR). Retention period: twelve (12) months.

  • Customer support and communication

Legal ground: performance of the agreement (Article 6.1.b GDPR). Retention period: five (5) years after the last contact.

  • Improvement of the Platform

Legal ground: legitimate interest of the Platform Operator (Article 6.1.f GDPR). The Platform Operator only processes anonymised usage data for this purpose. Retention period: unlimited after anonymisation.

  • Direct marketing to existing Entrepreneurs

Legal ground: legitimate interest of the Platform Operator (Article 6.1.f GDPR). Retention period: until the Data Subject objects to this Processing.

  • Direct marketing to prospects

Legal ground: consent (Article 6.1.a GDPR). Retention period: until the withdrawal of the consent.

  • Dispute management and legal defence

Legal ground: legitimate interest of the Platform Operator (Article 6.1.f GDPR). Retention period: for the duration of the proceedings, increased by the applicable limitation period.

Upon expiry of the applicable retention period, the Personal Data shall be securely deleted or anonymised, unless longer retention is required or permitted on the basis of a legal obligation or a legitimate interest (such as legal defence).

Recipients of the Personal Data

The Platform Operator shares Personal Data exclusively with the following categories of recipients, and in each case to the extent strictly necessary for the execution of the purposes described in Article 5:

  • Processors

The Platform Operator relies on carefully selected Processors who process Personal Data in its name and on its behalf, specifically:

  • the Payment Service Provider, for the personal data required to execute a payment (for the payment service itself this party acts as a separate Data Controller; the Platform Operator itself never receives, manages or holds any funds);
  • the hosting provider and the cloud provider of the Platform;
  • providers of email, CRM, ticketing and analysis tools;
  • providers of electronic signature services;
  • IT service providers charged with maintenance and support of the Platform.

A processing agreement was concluded with each of these Processors in accordance with Article 28 GDPR.

  • Other Users of the Platform

Certain Personal Data of Entrepreneurs (such as the name of the legal entity and the content of the Campaign) are visible to the Investors who are invited by the Entrepreneur via a Personal Link. Certain Personal Data of Investors (such as name and invested amount) are visible to the Entrepreneur concerned.

  • External advisors

The lawyers, accountants, statutory auditors, insurers and other external advisors of the Platform Operator, who are bound by professional secrecy or by contractual confidentiality obligations.

  • Government bodies and competent authorities

The Platform Operator may communicate Personal Data to competent authorities (such as tax authorities, judicial authorities, the FSMA or the Financial Intelligence Processing Unit) when it is legally obliged to do so or when this is necessary in the context of a judicial procedure.

  • No sale of Personal Data

The Platform Operator never sells, rents or trades Personal Data to third parties for commercial purposes.

International transfer of Personal Data

The Platform Operator strives to process Personal Data within the European Economic Area (EEA). If a transfer to a country outside the EEA should nevertheless be necessary (for example because of a cloud provider established outside the EEA), the Platform Operator ensures that appropriate safeguards are taken in accordance with Articles 44 et seq. GDPR, such as:

  • an adequacy decision by the European Commission;
  • standard contractual clauses (Standard Contractual Clauses) approved by the European Commission;
  • where applicable, additional technical, organisational or contractual measures.

Rights of the Data Subject

In accordance with the GDPR, the Data Subject has the following rights:

  • Right of access

The Data Subject has the right to obtain confirmation from the Platform Operator as to whether or not his Personal Data are being Processed and to obtain access to those Personal Data (Article 15 GDPR).

  • Right to rectification

The Data Subject has the right to have inaccurate or incomplete Personal Data corrected or supplemented (Article 16 GDPR).

  • Right to erasure (right to be forgotten)

The Data Subject has the right to have his Personal Data erased, unless the Platform Operator is legally obliged or entitled to retain them (Article 17 GDPR).

  • Right to restriction of Processing

The Data Subject has the right to have the Processing of his Personal Data restricted in certain cases (Article 18 GDPR).

  • Right to portability

The Data Subject has the right to obtain the Personal Data that he himself has provided to the Platform Operator in a structured, commonly used and machine-readable format, and to transfer these to another data controller (Article 20 GDPR).

  • Right to object

The Data Subject has the right to object to the Processing of his Personal Data based on a legitimate interest, unless the Platform Operator can demonstrate compelling legitimate grounds (Article 21 GDPR). The Data Subject can at any time and free of charge object to the use of his Personal Data for direct marketing purposes.

  • Right to withdraw consent

If the Processing is based on the consent of the Data Subject, the latter can withdraw that consent at any time, without this affecting the lawfulness of the Processing before the withdrawal.

  • Exercise of rights

The Data Subject can exercise his rights by addressing a written request (accompanied by a copy of his identity card or an equivalent proof of identity) to info@samenlenen.be or Oudenaardsesteenweg 21, 9000 Gent. The Platform Operator shall respond to the request within one (1) month of receipt, potentially extendable by two (2) months in case of complexity or a large number of requests.

  • Right to lodge a complaint

The Data Subject has the right to lodge a complaint with the Data Protection Authority: Drukpersstraat 35, 1000 Brussels; Tel.: +32 (0)2 274 48 00; E-mail: contact@apd-gba.be; Website: www.dataprotectionauthority.be.

Security of Personal Data

The Platform Operator takes appropriate technical and organisational measures to protect the Personal Data against unauthorised or unlawful Processing, loss, destruction, damage or disclosure. These measures include, among others:

  • encryption of data in transit (TLS/SSL) and at rest;
  • access control based on the "need-to-know" principle;
  • strong authentication requirements;
  • regular backups and disaster recovery procedures;
  • periodic security audits and penetration tests;
  • awareness and training programmes for the employees of the Platform Operator.

In the event of a data breach with a likely high risk to the rights and freedoms of the Data Subject, the Platform Operator shall inform the Data Subject and the Data Protection Authority without delay in accordance with Articles 33 and 34 GDPR.

Automated decision-making and profiling

The Platform Operator does not make automated decisions that have legal consequences for the Data Subject or that affect him/her to a significant extent. Nor does the Platform Operator engage in profiling within the meaning of Article 22 GDPR.

Cookies

The Platform and the website of the Platform Operator use cookies and similar technologies. For more information, reference is made to the separate cookie policy, available at www.samenlenen.be.

Changes to this Privacy Policy

The Platform Operator reserves the right to amend this Privacy Policy at any time. Substantial changes will be communicated to the Data Subject via the Platform or by e-mail. The current version can always be consulted on the Platform.