Privacy Policy

1. Data controller

2. Personal data collected

2.1 Via the showcase site (3smiles.eu)

When you use the contact form, we collect:

• First and last name
• Professional email address
• The content and subject of your message
• The date and time of the request

Third-party analytics and tracking tools (Google Analytics, Google Tag Manager, Google Search Console) are only activated with your consent where this is required.

2.2 Via the application (app.3smiles.eu)

When creating an account and using the service, we may collect:

• Identity data : last name, first name, email, Microsoft Entra External ID technical identifier
• Establishment data : name, address, description, configuration settings
• Service data : spaces, tables, services, operating parameters and rules
• Operational data : history of service requests, anonymised customer notes and reviews, activity KPIs
• Billing data : information required for billing and subscription management, processed mainly by Stripe (see §4) — we do not store any payment card data
• Technical data : IP address, user-agent, connection logs (retention: 30 days)

We limit ourselves to the data strictly necessary for the purposes pursued, in accordance with the data minimisation principle.

Providing the data necessary to create the account and for billing is a condition of access to the service: without it, the service cannot be provided.

3. Purposes and legal bases of processing

We process personal data for the following purposes:

Where we rely on legitimate interest, we ensure that the processing does not excessively infringe the rights and freedoms of the data subjects.

No solely automated decision producing legal effects or significantly affecting you, and no profiling, is carried out within the framework of the service.

4. Retention periods

We retain data for the following periods:

• Contact requests : 12 months after the last exchange
• Active account data : the duration of the subscription, then deletion or anonymisation after 30 days, unless otherwise required by law
• Operational data : the duration of the subscription, then deletion or anonymisation according to reversibility or contractual requirements
• Technical and security logs : 30 rolling days, unless longer retention is necessary in the event of a security incident
• Billing data : 7 years from the end of the relevant accounting year (Belgian accounting obligation — art. III.86 CEL)

5. Processors and recipients

We use processors that provide sufficient guarantees within the meaning of the GDPR, in particular:

No personal data is sold, rented or transferred to third parties for commercial or advertising purposes.

6. Transfers outside the European Union

7. Cookies and trackers

8. Your rights

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access : obtain a copy of the data concerning you (art. 15)
• Right to rectification : correct inaccurate or incomplete data (art. 16)
• Right to erasure : request the deletion of your data (art. 17)
• Right to portability : receive your data in a structured format (art. 20)
• Right to object : object to processing based on legitimate interest (art. 21)
• Right to restriction of processing : request the restriction of processing (art. 18)
• Right to withdraw consent : withdraw your consent at any time, without prejudice to prior processing (art. 7.3)

9. Data security

10. Changes to the policy

We may modify this policy at any time to reflect changes to the service, regulations or our practices. In the event of a substantial change, active users will be informed by email at least 30 days before the changes take effect. The last update date appears at the top of the document. Users are invited to review this policy regularly to stay informed of any updates.