Privacy notice.
Last updated October 22, 2026
This notice explains how personal information is handled on the Steward website, waitlist and invited product. Company information can also be personal information when it identifies a person, including a sole trader or business contact.
Who is responsible
Steward is operated by Sustainable Europe Group BV, enterprise and VAT number BE0801.223.661, Toeristenlaan 11 bus B, 1640 Sint-Genesius-Rode, Belgium. Contact hello@segbv.com for privacy questions and requests. We are the controller for our website, access administration, business contacts and service security. When a member company instructs us to handle personal information in its workspace, that company is the controller and we act as its processor. Requests concerning that information should normally go to the company; we help it respond.
Waitlist and invitations
We use your email address, request date, access-review outcome and the recorded intake-notice version to manage your beta access request and invitation. We rely on our legitimate interest in administering a requested, invitation-only service. This does not create an account or subscribe you to a newsletter. The current waitlist saves your email, not the role or interest selections displayed in the form. To prevent abuse, a pseudonymous network identifier and request counts are held in hourly buckets that expire after 24 hours and are periodically removed. Our legitimate interest is protecting the service. You can object or withdraw your access request at hello@segbv.com.
Accounts, support and service security
We process your email, authentication information, name, company details, invitation and membership records, correspondence, and operational or security logs. Information comes from you, your organisation and your interactions with Steward. We use it to provide requested access and support, administer the service relationship, and meet legal obligations. Our bases are performance of a contract or steps you request before a contract, legitimate interests in supporting business users and preventing misuse, and applicable legal obligations. Required information is identified in the forms; without account or invitation details we may be unable to provide access.
Company workspaces and AI assistance
Workspace content may contain business contacts, supplier information, uploaded documents, evidence and reports. We process it to prepare requested work under the member company's instructions and applicable agreement. This can involve contracted AI and document-processing services receiving relevant content. Human review remains necessary before relying on generated work. Do not upload sensitive personal information or unnecessary personal details. We do not promise that processing stays on your device or that every provider offers zero retention. Contractual safeguards, permitted data categories and provider retention must be agreed for the relevant service.
Directory and shared company information
The Directory and Hive are different from a private workspace. Company-profile information may be visible to other members, and business information can come from company websites, public registers, other public sources or the company itself. Publicly available does not mean free of privacy rights. Where information identifies a person, our purpose is business discovery and relevant company connections, based on legitimate interests subject to those rights. Ask hello@segbv.com about the source, correction, restriction or removal of your information. Private documents are not made public merely by joining. The information shown and available sharing controls depend on the feature; check before adding information intended to remain private.
Website analytics and browser storage
Optional website analytics runs only with your consent. You can reject it without losing website or waitlist access, and withdraw it through Cookie settings in the website footer. Essential sign-in storage and requested display preferences serve the functions you choose. Our Cookie notice explains storage names, purposes, duration and controls. Ordinary connection and security logs remain necessary to deliver and protect the service; they are separate from optional audience analytics.
Who receives information
Access is limited to authorised personnel and service providers supporting hosting, account access, secure storage, communications, analytics where allowed, and requested AI or document processing. Professional advisers and public authorities may receive information when necessary for legal obligations or claims. Other members receive information you share or that is included in the relevant Directory feature. We do not sell personal information. Contact hello@segbv.com for details of relevant recipients and subprocessors, including those applicable to your company's agreement.
International processing
Some service providers or their support and subprocessing operations may process information outside the European Economic Area. Where required, transfers must be covered by an applicable adequacy decision or appropriate contractual safeguards, such as the European Commission's standard contractual clauses, together with any necessary supplementary measures. Contact hello@segbv.com for the safeguards applicable to your information and how to obtain a copy. We do not represent that all processing takes place in the EU.
How long information is kept
Waitlist and invitation records are kept while needed to resolve the request, manage access and prevent repeated misuse. Account and workspace information is kept for the service relationship and any applicable company agreement. Support and security records are retained according to the purpose, incident or legal requirement concerned. We assess deletion requests against those purposes and legal duties; a valid legal hold can require limited retention. Backup copies follow their separate rotation periods rather than disappearing immediately. We will explain any relevant remaining retention when responding to a request. Privacy-choice storage lasts 180 days; the Cookie notice describes other browser storage.
Your rights and how to use them
Where applicable, you can request access, correction, deletion, restriction and portability, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. Contact hello@segbv.com and describe the request; do not send passwords or unnecessary identity documents. We may ask for proportionate verification. We respond within one month; if a permitted extension is needed because of complexity or number of requests, we explain it within that month. Rights have legal limits, and we explain a refusal and your options. You may complain to the Belgian Data Protection Authority at dataprotectionauthority.be, or your competent supervisory authority. We do not use website or waitlist data to make solely automated decisions producing legal or similarly significant effects.
Changes
The date above identifies this notice. We update it when our practices change and provide additional notice or seek new consent where required. Agreement-specific instructions and privacy terms may also apply to a company's workspace.