Protection of personal data

SPA3 SRL (Oh Baby Spa), whose registered office is located at Rue de l'Ancien Bourg 12, Braine-l'Alleud, and registered with the Belgian Crossroads Bank for Enterprises under company number BE 0780.418.547, attaches great importance to the secure, transparent and confidential collection and processing of your personal data. In particular, we wish to protect the data of our customers, subcontractors and suppliers, among others, against loss, breaches, errors, unauthorised access or unauthorised processing. Through this data protection notice, we wish to inform you about the collection and processing of your personal data. We ask you to read this data protection notice carefully, as it contains important information about how and why we process your personal data. By providing your personal data, you explicitly declare that you have read this data protection notice and you explicitly accept its content as well as the processing itself.

This data protection notice applies to all services provided by us and, more generally, to all activities we carry out.

SPA3 SRL (Oh Baby Spa), whose registered office is located at Rue de l'Ancien Bourg 12, Braine-l'Alleud, with company number BE 0780.418.547, is the controller of your personal data. In collecting and processing your personal data, we comply with Belgian legislation on the protection of personal data, as well as with the General Data Protection Regulation (GDPR) as from its entry into force on 25 May 2018.

Depending on your activities and your relationship with our company, you will provide us with the following personal data: your identity data and contact details (name, title, address, email address, date of birth, telephone number, mobile number). For certain specific legal obligations, you may need to provide us with additional data in order to record your attendance. We point out that you bear responsibility for all the data you provide to us and we rely on their accuracy. If your data are no longer up to date, we ask you to inform us immediately. You are not obliged to provide your personal data, but please understand that it will be impossible to offer certain services or to collaborate if you do not consent to the collection and processing of certain data.

5.1. Customer data

As part of our services and activities, we collect and process the identity data and contact details of our customers and principals, their staff, collaborators, agents and any other relevant contact person. The purposes of this processing are the performance of the agreements with our customers, customer management, accounting and direct marketing activities, such as sending promotional or commercial information. The legal bases are the performance of a contract, compliance with legal and regulatory obligations and/or our legitimate interest.

5.2. Supplier and subcontractor data

We collect and process the identity data and contact details of our suppliers and subcontractors, as well as their possible (sub)subcontractor(s), their staff, collaborators, agents and any other relevant contact person. The purposes of this processing are the performance of this agreement, supplier/subcontractor management, accounting and direct marketing activities, such as sending promotional or commercial information. The legal bases are the performance of the contract, compliance with legal and regulatory obligations and/or our legitimate interest (such as for direct marketing). For direct marketing activities by email (such as newsletters or invitations to events), consent will always be requested and may be withdrawn at any time.

5.3. Staff data

We process the personal data of our employees as part of our personnel management and payroll administration. Given its specific nature, this processing is developed in more detail in a separate Data Protection Policy for employees.

5.4. Other data

In addition to the data of customers, suppliers/subcontractors and staff, we also process the personal data of other persons, such as new customers/prospects, useful contacts within our sector, networking contacts, expert contacts, etc. The purposes of this processing are in the interest of our activities, direct marketing and public relations. The legal basis is our legitimate interest or, in certain cases, the performance of a contract.

Personal data are kept and processed by us for a period necessary in light of the purposes of the processing and the (contractual or non-contractual) relationship between us. Customer and supplier or subcontractor data will, in any case, be removed from our systems after a period of ten years following the termination of the contract, or after the end of the project, except for personal data that we are required to keep for longer on the basis of specific legislation or in the event of an ongoing dispute for which the personal data are necessary.

In accordance with and under the conditions of Belgian data protection legislation and the provisions of the General Data Protection Regulation, we inform you that you have the following rights:

Right of access: you have the right to be informed, free of charge, of the data we hold about you and to check for what purposes they are used.

Right to rectification: you have the right to obtain the rectification (correction) of inaccurate personal data concerning you, as well as the right to complete incomplete personal data.

Right to erasure or restriction of data: you have the right to ask us to erase personal data concerning you and to restrict the processing of such data in the circumstances and under the conditions set out in the General Data Protection Regulation. We may refuse the erasure or restriction of data that are necessary for us to process payroll, comply with a legal obligation, perform the employment contract or pursue our legitimate interest, insofar as these data are necessary for the purposes for which they were collected.

Right to data portability: you have the right to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format. You have the right to transmit these data to another controller.

Right to object: you have the right to object to the processing of your personal data for serious and legitimate reasons. However, you may not object to the processing of data that are necessary for us to comply with a legal obligation, perform the employment contract or pursue our legitimate interest, insofar as these data are necessary for the purposes for which they were collected.

Right to withdraw consent: if the processing of personal data is based on prior consent, you have the right to withdraw that consent. Such personal data will then only be processed if we have another legal basis.

Automated decisions and profiling: we confirm that the processing of personal data does not include profiling and that you will not be subject to fully automated decisions.

You may exercise the above rights by contacting the email address: contact@ohbabyspa.be.

We will take the technical and organisational measures to process the data at a sufficient level of security and to protect the personal data against any destruction, loss, falsification, unauthorised access or accidental disclosure to third parties, as well as any unauthorised processing of such data. Under no circumstances can Oh Baby Spa be held liable for any direct or indirect damage caused by the incorrect or unlawful use of the personal data by a third party.

For the purpose of processing your personal data, we grant access to your personal data to our employees, collaborators and agents. We guarantee a similar level of protection by imposing contractual obligations on these employees, collaborators and agents that are similar to those described in this Data Protection Notice.

For the proper functioning of the Site and our services, we rely on several third-party providers located in the European Economic Area or benefiting from an adequacy decision of the European Commission:

• Mollie B.V. (Netherlands), online payment processing. No banking data is stored by us. See their privacy policy.
• Google reCAPTCHA v3 (Google Ireland Limited, Dublin), this site is protected by reCAPTCHA to combat automated submissions. The use of reCAPTCHA is subject to Google's privacy policy and terms of use.
• Mailjet SAS (France), sending of transactional emails (booking confirmation, reminders, invoices).
• Google Analytics 4 (Google Ireland Limited), only if you have accepted the “Audience measurement” category in the cookie banner. The data are anonymised (truncated IP).
• OVH SAS (France), web hosting and storage of the Site's data (servers located in France, under the GDPR).

You may change your cookie preferences at any time by clicking the “Cookies” link at the bottom of the page.

If you still have questions about the collection and processing of your personal data after reading this data protection notice, you can contact us by email at contact@ohbabyspa.be.

Supervisory authority: in the event of a persistent disagreement, you may lodge a complaint with the Belgian Data Protection Authority (DPA): Rue de la Presse 35, 1000 Brussels, www.autoriteprotectiondonnees.be.