Privacy Policy

Data Controller Information

The data controller responsible for your personal data is:

Data We Collect

We collect and process the following types of personal data collection to provide our stress relief and wellness services:

Personal Information

• Name and contact details (email address, phone number, postal address)
• Date of birth and age
• Emergency contact information
• Payment and billing information

Health and Wellness Information

• Stress levels and triggers
• Sleep patterns and quality
• Lifestyle factors affecting wellbeing
• Previous wellness experiences and preferences
• Session notes and progress records

Technical Information

• IP address and browser information
• Website usage data and analytics
• Cookie preferences and settings
• Device and operating system information

How We Use Your Information

We use of your data is based on legitimate legal grounds under GDPR. Here's how we use your information and our legal basis for processing:

Service Provision (Contract Performance)

• Providing stress relief and relaxation services
• Creating personalised wellness plans
• Scheduling and managing appointments
• Processing payments and billing

Legitimate Business Interests

• Improving our services and developing new offerings
• Website analytics and performance optimisation
• Marketing communications (with your consent)
• Fraud prevention and security measures

Legal Compliance

• Maintaining records as required by law
• Responding to legal requests and regulatory requirements
• Protecting our legal rights and interests

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your data only in the following limited circumstances:

• Service Providers: Trusted third-party providers who assist us in delivering our services (payment processors, appointment scheduling systems)
• Legal Requirements: When required by law, court order, or regulatory authority
• Business Transfers: In the event of a merger, acquisition, or sale of business assets
• Emergency Situations: To protect the vital interests of you or another person

Data Retention

We retain your personal data retention only for as long as necessary to fulfil the purposes outlined in this policy:

• Client Records: Retained for 7 years after the last service provision for legal and professional requirements
• Marketing Data: Until you withdraw consent or request deletion
• Website Analytics: Anonymised data retained for 26 months
• Financial Records: Retained for 7 years as required by Belgian law

Your Rights

Under GDPR and Belgian data protection law, your rights include:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing communications

To exercise any of these rights, please contact us at privacy@boldstep.pro or call +32 94990947.

Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• SSL encryption for data transmission
• Secure storage systems with access controls
• Regular security assessments and updates
• Staff training on data protection procedures
• Incident response procedures for data breaches

Cookies and Tracking

We use cookies and similar technologies to enhance your website experience. For detailed information about our cookie usage, please see our Cookie Policy.

International Data Transfers

Your personal data is primarily processed within the European Union. If we need to transfer data outside the EU, we ensure appropriate safeguards are in place, including:

• European Commission adequacy decisions
• Standard contractual clauses
• Binding corporate rules
• Certification schemes approved by supervisory authorities

Children's Privacy

Our services are not directed to children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such information promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending email notifications for significant changes
• Providing notice during your next service appointment

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the contact information below: