Privacy policy (GDPR)

Data controller

Soplany, Belgium - contact: privacy@soplany.com. For client data entered by an establishment in its CRM, the establishment is the data controller and Soplany the processor.

Data collected

Client account: surname, first name, email, phone, language. Bookings: service, date, practitioner, optional free-text note. Pros: identity, contact details, CBE/VAT number, billing data. Browsing: technical logs (IP address, pages viewed) kept for a maximum of 12 months. No health data is collected; free-text notes must not contain any.

Purposes and legal bases

Performance of the booking service (contract), sending of confirmations and reminders (contract), billing of pros (legal obligation), security and fraud prevention (legitimate interest), anonymised statistics (legitimate interest).

Recipients

The booked establishment receives the information needed for the appointment (name, contact details, service, note). No data is sold. Hosting in Europe.

Retention periods

Account: until deleted by the user. Bookings: 3 years after the appointment, then anonymisation. Pro invoices: 7 years (accounting obligation).

Your rights

Access, rectification, erasure, portability, restriction and objection: from your account (self-service modification and deletion) or by email to privacy@soplany.com. You may lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

Security

Encrypted connections (HTTPS), hashed passwords, two-factor authentication for administrators, daily encrypted backups, access restricted to authorised staff.