1. Who is responsible?
The controller of your data is [TO COMPLETE: legal company name], with registered office at [TO COMPLETE: address], company number [TO COMPLETE: CBE number], hereinafter "NIVA CARE". For any privacy question, reach us at info@nivacare.be.
2. What data do we collect?
When you complete a form (contact, free consultation, hair analysis or info session), we collect: • Identification and contact data: your name, email address and phone/WhatsApp number. • Data about your request: the chosen treatment, your question or message and — for the hair analysis — your questionnaire answers and any photos you upload. • Technical data: an anonymised (hashed) IP address and general visit statistics (see our cookie policy). We use Cloudflare Web Analytics without individual tracking.
3. Health data (special category)
Some of the data you provide — for example through the hair analysis (hair-loss pattern, family history, products/medication used) or photos and your choice of medical treatment — is data concerning your health. This is a "special category of personal data" (Art. 9 GDPR). We process this data solely on the basis of your explicit consent, which you give by ticking the dedicated box before submitting a request. You can withdraw this consent at any time (see 'Your rights'); this does not affect processing carried out before the withdrawal.
4. On what legal basis do we process?
We process your ordinary contact data to handle your request and provide the requested information or consultation — on the basis of your consent and/or to take steps at your request prior to any agreement. Your health data is processed solely on the basis of your explicit consent (Art. 9(2)(a) GDPR).
5. What do we use your data for?
We use your data to: assess your request and prepare a personalised treatment advice or quote; contact you and follow up; and — only with your consent for marketing cookies — measure the effectiveness of our ads. We do not use your data for automated decision-making producing legal effects.
6. Who do we share your data with?
To handle your request, we share your data with: • The partner clinic [TO COMPLETE: clinic name] in Istanbul (Turkey), which provides the medical advice and treatment. • Our processors (service providers processing data on our behalf): Cloudflare (hosting, database and email security), Resend (email delivery), Sanity (content management) and Meta (only with consent for marketing cookies). We have data processing agreements with them. We never sell your data to third parties.
7. Transfers outside the EEA
To make your treatment possible, your data, including health data, is transferred to our partner clinic in Turkey. Turkey is a country outside the European Economic Area for which the European Commission has not adopted an adequacy decision. This transfer relies on [TO COMPLETE: appropriate safeguard, e.g. Standard Contractual Clauses (SCCs), or your explicit consent to the transfer under Art. 49 GDPR]. Some processors (such as Resend) may process data in the United States, also under appropriate safeguards.
8. How long do we keep your data?
We do not keep your data longer than necessary for the purposes described above. Request and contact data are kept for a maximum of [TO COMPLETE: period, e.g. 24 months] after our last contact, unless a longer statutory retention obligation applies. The hair-analysis answers we temporarily store on your device are erased after a maximum of 7 days.
9. Your rights
You have the right to access, rectification, erasure ('right to be forgotten'), restriction of processing, data portability and the right to object. Where processing is based on consent, you can withdraw it at any time. To exercise a right, email info@nivacare.be. If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Belgian Data Protection Authority (www.dataprotectionauthority.be).
10. Security
We take appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access limited to those who need it, and protection against misuse of our forms.
11. Cookies
We use essential, analytics and (only with your consent) marketing cookies. For exactly how we do this and how to change your choice, see our Cookie policy.
12. Contact
Questions about this policy or your data? Contact us via [TO COMPLETE: privacy contact / responsible person] at info@nivacare.be.
13. Changes
We may update this privacy policy from time to time. The date at the top shows when it was last updated. We will inform you of significant changes via the website.