Privacy Policy — Chantier Plus

Version 3.0 — last updated: 19 September 2026

English courtesy translation. The French version is the binding reference.

This policy explains how personal data is processed within the "Chantier Plus" service (the "Service"), in accordance with the GDPR (EU 2016/679) and the Belgian Act of 30 July 2018.

1. Controller

Salbaoui Mostafa, natural person — activity not yet registered with the Belgian Crossroads Bank for Enterprises (BCE/KBO), not VAT-registered at this stage.

Address: Chaussée de Bruxelles 206, 6020 Charleroi, Belgium

E-mail: mostafa.salbaoui@proton.me

(the "Provider" / "we")

2. Two distinct roles

• As controller — for data processed on our own behalf: managing our customers' accounts, billing, support, prospecting. This is the subject of this policy.
• As processor — for data that our customers (construction businesses) record in the Service about their own users (managers and workers). There, the customer business is the controller and we act on its instructions under the DPA. Data subjects (workers, managers) should contact their employer to exercise their rights; we assist the employer.

3. Data we process as controller, and purposes

Data category	Purpose	Legal basis (art. 6 GDPR)
Customer/contact identity (name, e-mail, company, role)	Account creation and management, providing the Service	Contract (6.1.b)
Billing data (contact details, subscription history)	Invoicing, accounting	Legal obligation (6.1.c) + contract
Usage and technical logs (logins, IP, device IDs)	Security, fraud prevention, improvement	Legitimate interest (6.1.f)
Support data (messages, tickets)	Handling support requests	Contract / legitimate interest
Prospect contact details	B2B prospecting	Legitimate interest (6.1.f), with right to object
Trial requests submitted through the Service (company name, contact name, e-mail, optional phone and company number, desired plan, language)	Handling the access request, creating the trial account, replying to the requester	Pre-contractual steps at the data subject's request (Art. 6(1)(b))
IP address and user agent attached to a trial request	Abuse prevention and rate limiting	Legitimate interest (Art. 6(1)(f))

We do not collect "sensitive" data (health, opinions, biometrics). No ID photos, signatures or biometric data are stored.

4. Data processed as processor (on customers' behalf)

Data recorded by customer businesses concerns their managers and workers: name, login identifier (technical pseudonym), role, container assignment, consumption/equipment status reports, movement logs. Details are in the DPA (Schedule 1). The technical e-mail generated for workers is never displayed in the app.

Report history. Each evening report keeps, frozen as at the date it was submitted, the name of the worker who validated it, the container and job site concerned, and the names of the items declared. These remain readable after the worker's account, the container, the job site or an item has been deleted: a report is a record of equipment issued and returned, which the customer business keeps on the basis of its legitimate interest (Art. 6(1)(f)) and, where applicable, for the establishment or defence of legal claims (Art. 17(3)(e)). The customer business can anonymise an individual's history at any time from within the app (the name is replaced by a neutral label and the technical link is severed; quantities, dates and equipment are retained).

5. Recipients and sub-processors

Your data is never sold. It is accessible to the Provider and the technical sub-processors strictly necessary to provide the Service:

Sub-processor	Role	Data location
Supabase Inc. (database, auth, app hosting)	Hosting and infrastructure	EU — AWS eu-west-1 (Ireland)
Amazon Web Services (AWS)	Underlying hosting	EU (Ireland)

Service data is stored in the EU (Ireland). No data is transferred outside the EU for storage. Any non-EU transfer (e.g. support from the US) would be covered by the European Commission's Standard Contractual Clauses and art. 46 GDPR safeguards. The current sub-processor list is in the DPA.

6. Retention

• Account data (manager / business): for as long as the account is used. The end of the trial or suspending an account does not delete the data: it is kept until purged by the publisher or until an erasure request (see § 8); backups may persist briefly before being overwritten.
• Billing/accounting data (if any — there is no billing during the free trial): 7 years (Belgian accounting obligation).
• Report history (processed on the customer business's behalf): kept for as long as the customer business requires, that business being the controller and the sole judge of the period needed to evidence equipment issued and returned. The publisher recommends a period no longer than 5 years after the end of the employment relationship, and anonymises an individual's history on instruction from the business (in particular upon an erasure request).
• Unconverted trial requests: 12 months from the request, then automatic deletion. An accepted request follows the lifetime of the corresponding customer account.
• IP address and user agent of a trial request: 90 days, then automatic erasure (the request itself is kept without them).
• Security logs: max 12 months.
• Prospect data: up to 3 years after last contact, or until objection.

7. Security

We implement appropriate measures: per-company data isolation (PostgreSQL RLS), encryption in transit (HTTPS/TLS), encrypted session at rest on the device, role-based authentication, access control and logging. Details in the security note.

8. Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, objection and portability, plus post-mortem directives. To exercise them, write to mostafa.salbaoui@proton.me. We reply within one month. If you are a worker or manager using the Service via your employer, address your request to your employer (the controller); we will assist.

9. Complaints

You may lodge a complaint with the Belgian Data Protection Authority (APD/GBA): Rue de la Presse 35, 1000 Brussels — contact@apd-gba.be — autoriteprotectiondonnees.be.

10. Cookies

The Service uses only strictly necessary cookies/local storage (session, authentication, offline mode). No audience measurement or advertising cookies. See the legal notice & cookies.

11. Changes

This policy may be updated; the version in force is the one published, with its update date.