Back

Data Protection — GDPR

Last updated: October 2026

1. Your rights in detail

In accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679), you have the following rights:

  • Right of access (Article 15): you may request a copy of all personal data we hold about you, as well as information about how it is processed.
  • Right to rectification (Article 16): you may request the correction of inaccurate or incomplete personal data.
  • Right to erasure (Article 17): you may request the deletion of your personal data when it is no longer necessary or when you withdraw your consent.
  • Right to restriction of processing (Article 18): you may request the restriction of the processing of your data in certain circumstances.
  • Right to data portability (Article 20): you may request to receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to object (Article 21): you may object to the processing of your data on grounds relating to your particular situation.

2. How to exercise your rights

To exercise any of your rights, you may:

  • Contact your company administrator, who can process your request directly through the OperSite platform.
  • Send us an email at: contact@opersite.com

We commit to responding to your request within a maximum of 30 days from receipt. If the request is complex, this period may be extended by two months, in which case you will be informed.

For security reasons, we may need to verify your identity before processing your request.

3. Data controller and processor

Data controller: the client company that uses OperSite to manage its cleaning interventions. It is the entity that determines the purposes and means of processing your data.

Data processor: BellafSoftware (publisher of OperSite) acts as a data processor within the meaning of Article 28 of the GDPR. We process data only on the instructions of the client company and within the framework of the service contract.

4. Security measures

We implement the following technical and organizational measures to protect your data:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Irreversible hashing of passwords
  • Role-based access control (Admin, Manager, Worker)
  • Secure authentication via Supabase Auth
  • Technical logging of sign-ins and access by the hosting provider; a log of sensitive actions is being implemented
  • Hosting on certified infrastructure (Google Cloud, Supabase)

5. Sub-processors and transfers outside the EU

The main data is hosted within the European Union. However, some sub-processors are established outside the EU, mainly in the United States, or process some data outside the EU (notification delivery, emails, maps, support). Personal data is therefore transferred outside the EU, or such transfers cannot be ruled out.

  • Supabase: database, authentication, files and server functions — EU (Ireland), company established in the United States
  • Google Cloud (Firebase App Hosting): web application hosting — EU (Netherlands)
  • PowerSync (JourneyApps): offline synchronisation of the mobile app — region being confirmed
  • Expo: push notifications and mobile app updates — United States
  • Google Firebase Cloud Messaging and Apple Push Notification service: notification delivery on Android and iOS — outside the EU
  • Sentry: error monitoring, without names or email addresses — EU (Germany), company established in the United States
  • Resend: emails related to intervention vouchers — United States
  • Google Maps Platform: entry and geocoding of site addresses — possibly outside the EU
  • OpenStreetMap and Photon (komoot): fallback geocoding and map tiles — United Kingdom, Germany and possibly outside the EU
  • GitHub and Microsoft OneDrive: running and storing backups, encrypted before upload — possibly outside the EU
  • Telegram and OpenAI: only for the manager assistant option, if the company subscribes to it — outside the EU

For these transfers, the planned safeguards are the provider's certification under the EU–U.S. Data Privacy Framework or, failing that, the European Commission's standard contractual clauses. They are being verified for each provider. Details are available on request.

6. Supervisory authority — DPA

If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to file a complaint with the DPA (Data Protection Authority), the Belgian supervisory authority.

  • Address: Rue de la Presse 35, 1000 Brussels
  • Phone: +32 (0)2 274 48 00
  • Website: www.autoriteprotectiondonnees.be

7. Data protection contact

For any questions regarding the protection of your personal data or to exercise your rights, you may contact our team at: contact@opersite.com

Also refer to our privacy policy for more details on how your data is processed.