Privacy policy

Data controller

Pascale Van Daele, Massage Therapist · dōTERRA Wellness Advocate — Bellemansheide 33, 1640 Rhode-Saint-Genèse — info@ausrea.com.

Data collected

• Customer account: first name, last name, email, phone (optional), shipping address (optional, for product orders).
• Instagram: the customer's public handle (only if entered by the customer or imported).
• Loyalty: visit count, applied discounts, appointment history.
• Orders: purchased products, status, shipping address.
• Authentication: password hash (bcrypt, never stored in clear), session tokens.

Purposes

• Account management and authentication.
• Booking and history of rituals.
• Loyalty programme (loyalty cards, discounts).
• Order and shipping management.
• Service-only communication (appointments, shipping, schedule changes). No unsolicited marketing emails.

Legal basis

Performance of a contract (managing appointments, orders, loyalty programme). Explicit consent for account creation and for service-related emails.

Retention period

• Account data: while the account is active, then deleted on request or after 24 months of inactivity.
• Order data: 7 years (accounting obligation).
• Access logs: 30 days.

Subprocessors / recipients

• Amazon Web Services (hosting, database, email via Amazon SES) — EU region.
• Keycloak (authentication) — self-hosted.
• hCaptcha (anti-bot protection on quick booking and gift-card purchase) — Intuition Machines, Inc. (United States); only technical data (IP address, widget interaction) is transmitted for this purpose.

Except for hCaptcha as described above, no transfers to non-EU countries. No automated profiling. No sale of data.

Your rights (GDPR)

Access, rectification, erasure, portability, objection, restriction. To exercise these rights: info@ausrea.com. Reply within 30 days. For complaints: Data Protection Authority (APD), rue de la Presse 35, 1000 Brussels — autoriteprotectiondonnees.be.