Chaussée de Roodebeek 206, 1200 Woluwe-Saint-Lambert, Belgique
Entreprise / Ondernemingsnummer / Enterprise No.: 0844.731.626
TVA / BTW / VAT: BE 0844.731.626
E-mail: sct@sctwebcare360.com
Web: sctwebcare360.com
1. Data controller
SPEC CONSTRUCTION TECHNOLOGIE SRL is the controller for personal data processed in connection with SCT WebCare 360. Contact: sct@sctwebcare360.com. The Platform is aimed at professionals, but personal data may relate to natural persons acting for a business.
2. Data we process
- Account data: name, email, identifiers, role, account status and language preferences.
- Business data: legal name, legal form, enterprise number, VAT/Tax ID, address, country, website, contact details and representative details.
- Verification data: VIES/other verification result, date, country, tax number, available name/address, manual-review status and evidence.
- Content data: profiles, ads, descriptions, images, videos, thumbnails, reviews, replies, reports, moderation decisions and appeals.
- Subscription/payment data: plan, period, Stripe Customer/Subscription/Price identifiers, invoices and payment status; the Platform does not store full card numbers.
- Technical/security data: IP addresses where necessary, user agent, logs, sessions, login attempts, trusted devices, security events, CSRF evidence and audit identifiers.
- Cookie/consent data: consent ID, policy version, selected categories, date and language.
- Communications: support messages, complaints, appeals and correspondence.
3. Purposes and legal bases
| Purpose | Main legal basis |
|---|---|
| Create/manage the account and provide subscription service | Performance of contract |
| Verify businesses/VAT and prevent fraud | Contract, legal obligation and legitimate interests |
| Payments, accounting, invoicing and Peppol where required | Contract and legal obligations |
| Security, abuse prevention, audit and defence of claims | Legitimate interests and legal obligations |
| Moderation, reports and DSA/authority obligations | Legal obligations and legitimate interests |
| Non-essential analytics/marketing cookies if activated | Consent |
| Support and service communications | Contract and legitimate interests |
4. Recipients and processors
Data may be shared only as necessary with hosting, payment (including Stripe), email, security, invoicing/Peppol, accounting or technical support providers, and with public authorities when legally required.
Processors acting on behalf of the Operator are subject to applicable data-protection contractual safeguards. Stripe-hosted payments are also subject to Stripe’s privacy information.
5. Transfers outside the EEA
Some providers may process data outside the European Economic Area. Where the GDPR requires it, the Operator relies on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism and applies supplementary safeguards where necessary.
6. Retention periods
| Category | Indicative retention |
|---|---|
| Active account/profile | For the contractual relationship; public visibility removed promptly after closure according to workflow |
| Rejected/hidden/suspended ads | Normally 24 months after the moderation decision; longer where needed for disputes, abuse or legal duties |
| Reports, appeals and complaints | Normally 3 years after closure |
| Audit/security logs | Normally 24 months; longer for incidents, fraud, disputes or legal duties |
| Technical logs | Normally 6-12 months |
| Verification/reset tokens | Until expiry and single use |
| Cookie consent | Until withdrawal/change and, for remembering the choice, normally no more than 6 months before asking again |
| Invoices/accounting records | For applicable Belgian legal periods, which may be up to 10 years |
Technical backups may temporarily retain copies until secure rotation. An erasure request does not remove information that must be retained for legal, accounting, security or legal-claim purposes.
7. Your rights
- Access and a copy of personal data.
- Rectification of inaccurate data.
- Erasure where legal conditions are met.
- Restriction of processing.
- Objection where processing is based on legitimate interests.
- Data portability for data provided by you where Article 20 GDPR applies.
- Withdrawal of consent without affecting earlier lawful processing.
- Complaint to the Belgian Data Protection Authority.
Requests may be made through account functions or at sct@sctwebcare360.com. Reasonable identity verification may be required.
8. Automated processing and moderation
The Platform uses automatic technical rules for security, limits, video processing and validation. The Moderation Policy may allow automated assistance, but material decisions may be subject to human review under the applicable process. The Platform does not announce standard solely automated decisions producing legal effects under Article 22 GDPR without specific notice.
9. Security
Measures include server-side authorisation, protected sessions, CSRF controls, password hashing, MFA where required, rate limiting, audit logging, upload validation, staging/production separation, verified Stripe webhooks and isolated video processing.
10. Reporting and legal obligations
Report data is processed to assess the matter, communicate with parties, take action, maintain an audit trail and comply with the DSA or other legal obligations. It is disclosed only to persons and authorities with a legitimate need to receive it.
11. Policy updates
Material changes are versioned and dated. Where required, affected persons are informed before the new version takes effect.