Privacy Policy

1. Data controller

The controller is Beauty Essentiel, Begonialaan 2, B-3090 Overijse, info@beautyessentiel.be, BE1006753201.

For privacy questions: info@beautyessentiel.be.

2. Data we process

Depending on how you interact with us, we may process:

• Identity and contact data (name, email, phone)
• Message content via the contact form
• Newsletter preferences (with explicit consent)
• Booking data via our appointment provider (Optios)
• Limited technical data (IP, device type, pages viewed) via cookies / logs
• Cookie preferences (necessary, analytics, marketing)

3. Purposes and legal bases (GDPR)

We process data only for specified purposes:

• Contract / pre-contractual steps: appointments and care-related communication
• Legitimate interest: site security, abuse prevention, service improvement (balanced against your rights)
• Consent: newsletter, non-essential cookies, marketing communications
• Legal obligation: accounting / tax retention where applicable

4. Recipients and processors

We do not sell your data. Sharing happens only with providers needed to deliver the service, under processor terms (GDPR Art. 28):

• Hosting / web infrastructure
• Booking system (Optios)
• Email / communication (if enabled)
• Analytics or marketing tools only if you consent via the cookie banner

5. Transfers outside the EEA

If a provider processes data outside the European Economic Area, we require appropriate safeguards (e.g. EU Standard Contractual Clauses or an equivalent mechanism).

6. Retention

We keep data only as long as needed for the purpose or legal duty. Indicative: contact messages (up to 24 months), newsletter consent (until withdrawal + proof), technical logs (short term), booking data per operational and legal need.

7. Your GDPR rights

You may request access, rectification, erasure, restriction, portability, and object to certain processing. You may withdraw consent at any time (without affecting prior lawfulness).

Contact info@beautyessentiel.be. You may also lodge a complaint with the Belgian Data Protection Authority (APD/GBA).

8. Security (SOC 2 alignment)

We apply proportionate organisational and technical measures designed around SOC 2 Trust Services Criteria (Security & Confidentiality), including:

• Access control and least privilege for admin systems
• Encryption in transit (HTTPS/TLS) for the website
• Environment separation and reasonable backups via the host
• Logging / monitoring of sensitive access where available
• Vendor management and subprocessor review
• Incident response (timely notice if high risk to your rights)

9. Minors

Our services primarily target adults (ladies only). We do not knowingly collect data from children under 16 without an appropriate legal basis.

10. Changes

We may update this policy. The date at the top will change. For material updates, we will inform you appropriately via the site.