Privacy policy
Data controller
Pascale Van Daele — Rhode-Saint-Genèse, Brabant flamand — pascale@ausrea.be.
Data collected
- Customer account: first name, last name, email, phone (optional), shipping address (optional, for product orders).
- Instagram: the customer's public handle (only if entered by the customer or imported).
- Loyalty: visit count, applied discounts, appointment history.
- Orders: purchased products, status, shipping address.
- Authentication: password hash (bcrypt, never stored in clear), session tokens.
Purposes
- Account management and authentication.
- Booking and history of rituals.
- Loyalty programme (loyalty cards, discounts).
- Order and shipping management.
- Service-only communication (appointments, shipping, schedule changes). No unsolicited marketing emails.
Legal basis
Performance of a contract (managing appointments, orders, loyalty programme). Explicit consent for account creation and for service-related emails.
Retention period
- Account data: while the account is active, then deleted on request or after 24 months of inactivity.
- Order data: 7 years (accounting obligation).
- Access logs: 30 days.
Subprocessors / recipients
- Amazon Web Services (hosting, database, email via Amazon SES) — EU region.
- Keycloak (authentication) — self-hosted.
No transfers to non-EU countries. No automated profiling. No sale of data.
Your rights (GDPR)
Access, rectification, erasure, portability, objection, restriction. To exercise these rights: pascale@ausrea.be. Reply within 30 days. For complaints: Data Protection Authority (APD), rue de la Presse 35, 1000 Brussels — autoriteprotectiondonnees.be.