Version of 26 September 2026

This privacy statement explains what information we collect about you, the purposes for which we use it and with whom we share it. It also sets out your rights regarding your information and whom you can contact for more information or with any questions.

This privacy statement applies to Metropolis (Metropolis Mobility Services SRL, company number 1026.710.554), whose registered office is located at Avenue des Communautés 110, B-1200 Brussels.

We are committed to protecting your privacy and to handling your information in an open and transparent manner.

This privacy statement sets out how we collect, process, store and protect information about you when:

• we provide services to you or to our clients;
• you use our website; or
• we carry out any other activity that is part of the operation of our business, as described in more detail below.

When we refer to “our website” or “this website” in this statement, we mean the specific web pages of Metropolis whose address begins with “https://metropolis.info”.

This privacy statement also contains information about when we share your personal data with other third parties (for example, our service providers).

In this privacy statement, your information is sometimes referred to as “personal data” or “personal information”. This means any information that directly or indirectly identifies you. We may also refer collectively to the handling, collection, protection and storage of your personal information as the “processing” of that personal information.

In the course of (i) providing services to you or to our clients and (ii) discussing services we might provide, we will collect or obtain personal data about you. We may also collect personal data about you when you use our website.

We may collect or obtain such data because:

• you give it to us (for example, in a form on our website);
• other people provide it to us (for example, your employer or adviser, or third-party service providers we use to help run our business);
• it is publicly available; or
• we observe or infer it from the way you interact with us or with others. For example, to improve your experience when you use our website and to make sure it works efficiently, we (or our service providers) may use cookies (small text files stored in a user’s browser) and web beacons, which may collect personal data. You will find more information on how we use cookies and other tracking technologies, and on how you can control them, in our cookie notice.

The personal data we collect or obtain may include:

• identification and contact details: first name, last name, e-mail address, phone number;
• for companies and public bodies: name, VAT number and billing address;
• country of residence;
• information about your request: place (and its geographic coordinates), dates and type of occupation of the public road, attached documents and messages;
• payment and invoicing information (amounts, payment status); payment card data is processed directly by our payment provider, Stripe, and is not shared with us;
• IP address;
• browser type and language;
• access times;
• details of complaints;
• details of how you use our products and services; and
• any other personal information you may provide to us in order to benefit from our services.

Mandatory fields are necessary to handle your request; without them, we cannot submit your application.

We do not seek to collect so-called “sensitive” personal data (special categories within the meaning of the GDPR). If you provide such data to us spontaneously, we only process it to the extent necessary to handle your request, or where the law requires us to do so.

We do not take any decision based solely on automated processing.

The types of personal data we collect may vary depending on the nature of the services we provide to you or to our client, or on how you use our website.

Where our client provides us with personal data about you, we make reasonable efforts to include in the contract with the client clauses requiring it to comply with privacy laws and regulations applicable to that information; this may include, for example, the client having informed you of the collection (and of other matters) and having obtained any consent necessary for us to process that information as described in this privacy statement.

We understand the importance of protecting children’s privacy. Our website and services are not designed for or intentionally aimed at children. It is not our policy to intentionally collect or store information about children.

We are required by law to set out in this privacy statement the legal grounds on which we rely to process your personal data.

We therefore use your personal data for the purposes described above because:

• we have obtained your consent to do so;
• of legal and regulatory obligations to which we are subject (for example, keeping records for regulatory or tax purposes, or providing information to a public body or law-enforcement authority);
• we are performing a contract with you;
• we need to exercise, establish or defend legal claims;
• the information is necessary to provide our services to you or to our client;
• of our legitimate interests in the effective delivery of our services to you or to our client, provided those interests are not overridden by yours; and
• of our legitimate interests in the effective and lawful operation of our business (such as, but not limited to, preventing fraud, making sure complaints are investigated, protecting our commercial interests, and evaluating, developing or improving our services or products), provided those interests are not overridden by yours.

In practice: handling your request and payment rely on the contract; invoicing and keeping accounting records on a legal obligation; preventing abuse (limiting submissions, tracking errors) on our legitimate interest in securing the site; audience measurement and advertising pixels on your consent.

We do not send marketing communications by e-mail.

In connection with one or more of the purposes described in the “The legal grounds we rely on to process personal information” section above, we may disclose details about you to:

• third parties that provide services to Metropolis;
• competent authorities (including courts and authorities that regulate us or our clients);
• your employer and/or its advisers;
• your advisers; and
• other third parties that reasonably need access to personal data about you for one or more of the purposes described in the “The legal grounds we rely on to process personal information” section above.

We may also have to disclose your personal data where required:

• by law;
• by a regulatory body;
• or in the course of legal proceedings.

We may share non-personal, de-identified and aggregated information with third parties for several purposes, including:

• data analysis; and
• promotional purposes.

The providers we use for the proper functioning of the site and the handling of your file include: Vercel and Supabase (hosting of the site, the database and the documents, in Ireland), Mailjet (sending e-mails), Stripe (online payment), Billit (invoicing), NocoDB (case management), Upstash and Sentry (security and technical monitoring), bpost, OpenStreetMap and OpenDataSoft (address checks), the FPS Economy and the European Commission (VAT and company number checks), Umami (audience measurement), Meta, LinkedIn and Google (advertising, with your consent), YouTube (video, on click) and Cloudflare (bot protection, when enabled). Our processors act on our instructions.

For your permit application, we send the competent authority (municipality, region, road authority) the information your file requires.

Some of these providers are based outside the European Union, notably in the United States; these transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

We use a range of physical, electronic and managerial measures to keep your personal data secure, accurate and up to date. These measures include:

• education and training of relevant staff, so that they are aware of our privacy obligations when handling personal data;
• administrative and technical controls restricting access to personal data on a need-to-know basis; and
• technological security measures, including firewalls, encryption and anti-virus software.

Although we apply appropriate security measures once we have received your personal data, the transmission of data over the internet (including by e-mail) is never completely secure. We strive to protect personal data, but we cannot guarantee the security of data transmitted to us or by us.

We will retain your personal data on our systems for as long as necessary for these purposes, in particular:

• as long as necessary for the relevant activity or services;
• any retention period required by law; and
• until the end of the period during which litigation or investigations might arise in connection with the services.

In practice: attached documents that are never used are deleted in the weekly clean-up that follows a 48-hour period; contact details passed on by our payment provider are deleted after 180 days (at the latest one week later); your personal tracking link expires after 60 days; your cookie choice is kept for 6 months. Invoices and accounting records are kept for 10 years, as required by accounting and tax law.

You have various rights in relation to your personal data. In particular, you have the right to:

• obtain confirmation that we process your personal data and request a copy of the personal data we hold about you;
• ask us to update the personal data we hold about you, or to correct personal data you consider incorrect or incomplete;
• ask us to delete the personal data we hold about you, or to restrict the way in which we use it;
• withdraw your consent to the processing of your personal data at any time (to the extent that such processing is based on consent);
• receive a copy of the personal data about you that you have provided to us, in a structured, commonly used and machine-readable format, and have that personal data transmitted to another party (to the extent that the processing is based on consent or on a contract); and
• object to our processing of your personal data.

To exercise any of your rights, or if you have any other questions about our use of your personal data, please e-mail contact@metropolis.info. We will reply within one month. Metropolis is not required to appoint a data protection officer; for any question, write to us at the same address.

You can also use these contact details if you wish to make a privacy-related complaint to us.

If you wish to exercise your rights as set out above, please note that, in case of reasonable doubt about your identity, we may need proof of identity in order to deal with your request.

If you are not satisfied with the way we have handled your personal data, or with any privacy-related question or request you have addressed to us, you have the right to lodge a complaint with the data protection authority (“DPA”) of your jurisdiction. In Belgium, this is the Data Protection Authority (Rue de la Presse 35, 1000 Brussels). If you would like to be directed to the competent data protection authority, please contact us as indicated above.

We may amend or update this privacy statement from time to time.

To inform you of changes to this privacy statement, we will update the revision date at the top of this page. The amended or updated privacy statement will apply from that revision date. We therefore encourage you to review this statement periodically to stay informed about how we protect your information.

With your consent (Article 6(1)(a) GDPR), we use advertising pixels — Meta Pixel, LinkedIn Insight Tag and Google Ads — which collect browsing data on our public pages for campaign measurement and targeted advertising. These partners process this data for their own purposes. For the collection via these pixels, we are joint controllers with these partners. The list of cookies involved and how to withdraw your consent are described in our cookie notice.

Also with your consent, we measure visits to our site with Umami. The presentation video hosted by YouTube only loads if you start it.