Privacy policy

Who is responsible

Blok Consulting ([street and number, postcode, city], Belgium, company number [company number]) is responsible for the personal data of people who use the Backlabel dashboard, who contact us, and who open a public page. Questions and requests go to [legal e-mail address].

Personal data that customers put in Backlabel themselves, such as the people in their team or a contact in a recall message, is theirs: we process it for them under the data processing agreement.

Public pages: no cookies, no tracking

The e-labels people open by scanning a code set no cookies and contain no trackers or advertising. We count scans without storing who scanned: the product, its version and lot, the language of the page, the country the scan came from and which link was followed. Those counts contain no IP addresses and are kept for three months. Our hosting provider processes IP addresses to deliver the pages and to block attacks.

What we keep about dashboard users, and why

• Your user: your name and email address, and the accounts you belong to with your role. Needed to provide the service.
• Signing in: there are no passwords. We send sign-in codes by email, keep the public key of each passkey, and, if you choose to sign in with Google or Microsoft, the identifier, name and email address they give us. Sessions keep the IP address and browser they started from, so you can see and end them.
• Security log: sign-ins and every change to how you sign in, with IP address and device. Kept for one year, to protect your user and to investigate abuse.
• Account log: what people did in an account, such as publishing a product or inviting someone. The account’s members can see it. Kept as long as the account exists.
• Bot protection: the sign-in page uses Cloudflare Turnstile, which checks the browser without cookies for tracking.
• Billing: payments are handled by Stripe. We keep the Stripe customer number, the plan and its status, never card details. Invoices are kept as long as accounting law requires.
• Support: when you ask for help, our support may sign in as you for at most an hour. That session and what happens in it are in the security log and in the account’s log.

The legal grounds are the contract with your business (to provide the service), our legitimate interest in keeping it secure, and legal obligations such as accounting.

Who else receives data

We don’t sell personal data. These providers process it for us:

• Cloudflare hosts the service, sends its emails, runs bot protection and makes PDF labels. The database and files are stored in Cloudflare’s EU jurisdiction.
• Bunny.net (BunnyWay d.o.o., Slovenia) keeps the nightly backup copy of the public pages, stored in Frankfurt. It contains only what customers published.
• Stripe handles payments and the related customer details.
• Google and Microsoft, only if you choose to sign in with them.

Cloudflare and Stripe are also established in the United States. Where data leaves the EU, it’s protected by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long

We keep your user as long as you use it. When you delete your user in your profile, we delete your personal data and your security log. Account logs keep what happened without linking it to you, but can still mention your email address where it was part of the event, such as an invitation.

Your rights

You can see and correct your details in your profile, delete your user there, and export the account’s data. You can also ask us for access, correction, deletion, restriction or a copy of your data, or object to how we use it, at [legal e-mail address]. If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be).

Changes

When this policy changes in substance, we say so in the dashboard before the change applies.