Back

Privacy Policy

Last updated: October 2026

1. Data controller

OperSite is published by BellafSoftware. For data entered into the platform by a client company (its staff, sites and customers), that company is the data controller and BellafSoftware acts as a data processor, in accordance with the General Data Protection Regulation (GDPR).

2. Data collected

In the context of using the platform, the following data is collected:

  • Identity: last name, first name, email address, phone number where applicable
  • Authentication: login identifier, password (hashed), last sign-in date
  • Time and location records: arrival and departure timestamps, GPS position at arrival and departure, and geofencing events if the company enables them
  • Photos: before/after photos of interventions, quality inspections, equipment and complaints
  • Signatures: signatures on intervention vouchers and the signer's declared identity
  • Planning and absences: planned tasks, assignments, unavailability or absence periods and their reason
  • HR documents: contracts and personal documents uploaded by the employer
  • NISS: Belgian social security identification number, stored encrypted and used only for the attendance registration with the NSSO (ONSS) when the company enables this feature
  • Device: authorised device identifier, model, notification token and technical information when an error occurs
  • Usage data: role, company, account status

3. Purposes of processing

  • User account management and authentication
  • Planning and tracking of cleaning interventions
  • Documentation and proof of services performed
  • Cleaning product inventory management
  • Statistics and dashboards for managers and administrators

4. Legal basis

Data processing is based on the performance of the service contract between OperSite and the client company, as well as the legitimate interest of the employer in organizing and monitoring cleaning services.

5. Hosting and security

The main data is hosted within the European Union:

  • Database, authentication and files: Supabase (European Union, Ireland)
  • Web application: Firebase App Hosting, Google Cloud (europe-west4, Netherlands)
  • Offline synchronisation: PowerSync (region being confirmed)
  • Error monitoring: Sentry (EU data region, Germany), without names or email addresses

Data is encrypted in transit (TLS) and at rest. Passwords are irreversibly hashed.

Some technical providers are established, or process data, outside the European Union. Their list and the planned safeguards are given on the Data Protection page.

6. Retention period

Personal data is retained for the duration of the service contract. The retention period for intervention data is configurable by the company administrator. At the end of the contract, data is deleted or anonymized within 90 days, unless there is a legal obligation to retain it.

7. Data sharing

Data is not sold or shared with third parties for commercial purposes. It is accessible only to:

  • Authorized users of the client company (according to their role)
  • Technical sub-processors required to operate the service (hosting, synchronisation, notifications, emails, maps, error monitoring, backups)
  • The NSSO (ONSS), for attendance registration (Checkinatwork), when the client company enables this feature: NISS and attendance data
  • Authorities, upon a lawful request

8. Your rights (GDPR)

In accordance with the GDPR, you have the following rights:

  • Right of access: obtain a copy of your personal data
  • Right to rectification: correct inaccurate data
  • Right to erasure: request the deletion of your data
  • Right to data portability: receive your data in a structured format
  • Right to object: object to the processing of your data
  • Right to restriction: restrict the processing of your data

To exercise these rights, contact your company administrator or send an email to: contact@opersite.com

9. Cookies

OperSite uses only technical cookies necessary for the operation of the service (authentication session). No tracking or advertising cookies are used.

Maps display OpenStreetMap tiles and address entry uses Google Maps Platform: these services receive your browser's IP address.

10. Contact

For any questions regarding the protection of your data, you may contact: contact@opersite.com

You also have the right to file a complaint with the competent supervisory authority (DPA in Belgium).