Last updated: 29 March 2026
1. Who We Are
YUPLEE is a service provided by Valtier Group BV ("Valtier", "we", "us", or "our").
- Registered address: Oombergenstraat 53A, 9620 Zottegem, Belgium
- Company number (KBO/BCE): 1035.764.020
- Contact email: privacy@valtiergroup.com
- Website: https://yuplee.com
Valtier Group BV is registered in Belgium and operates under Belgian and European Union law.
2. Scope of This Policy
This Privacy Policy explains how YUPLEE collects, uses, stores, shares, and protects personal data when:
- You use the YUPLEE platform as a business operator (e.g., a salon owner or manager);
- Your clients interact with YUPLEE-powered booking workflows via WhatsApp or other channels;
- You visit our website at yuplee.com.
This Policy applies to all YUPLEE products and services, including the WhatsApp-based booking and client management system.
3. Data Controller and Processor Roles
Business operators (salons) are the data controllers for their clients' personal data processed through YUPLEE. Valtier Group acts as a data processor on behalf of business operators, processing personal data only according to their documented instructions and pursuant to a Data Processing Agreement (DPA).
For personal data relating to business operator accounts (registration, billing, platform use), Valtier Group acts as the data controller.
This distinction is relevant to the allocation of GDPR obligations. Business operators must have their own lawful basis for processing their clients' data and must provide their clients with appropriate privacy notices.
4. What Personal Data We Collect
4a. Data collected from business operators (account data)
| Category | Examples | Purpose |
|---|---|---|
| Identity data | First name, last name | Account creation, service provision |
| Contact data | Email address, phone number | Account management, support, billing |
| Business data | Business name, address, VAT number | Invoicing, service configuration |
| Technical data | IP address, browser type, device identifiers | Security, platform performance |
| Usage data | Feature interactions, login events, session data | Product improvement, support |
| Payment data | Billing address, payment method reference | Subscription billing |
4b. Data processed on behalf of business operators (client data)
When business operators use YUPLEE to manage their clients, YUPLEE processes the following categories of data on behalf of the operator:
| Category | Examples | Source |
|---|---|---|
| Client identity | First name, last name | Provided by operator or client via WhatsApp |
| Contact data | Phone number (WhatsApp), email address | Provided by operator or client |
| Appointment data | Booking dates, service type, preferences, notes | Generated through platform use |
| Communication data | WhatsApp message content related to bookings | Transmitted via WhatsApp Business API |
4c. WhatsApp message data
YUPLEE integrates with the WhatsApp Business API (via Meta Platforms, Inc.). When clients interact with a salon's YUPLEE-powered WhatsApp number:
- Message content relevant to booking workflows is processed;
- Message metadata (timestamps, delivery status) is processed;
- YUPLEE does not access personal WhatsApp messages outside of the business messaging channel.
Meta's own privacy practices govern the WhatsApp platform independently of this Policy. Please refer to Meta's Privacy Policy.
5. Legal Basis for Processing
| Processing activity | Legal basis (GDPR Article 6) |
|---|---|
| Business operator account management | Performance of contract (Art. 6(1)(b)) |
| Billing and invoicing | Legal obligation (Art. 6(1)(c)) + Contract (Art. 6(1)(b)) |
| Processing client data on behalf of operators | Legitimate interest of the operator / contract with operator (Art. 6(1)(b)/(f)) |
| Marketing communications to operators | Consent (Art. 6(1)(a)) or legitimate interest (Art. 6(1)(f)) |
| Platform security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
For special category data (e.g., health-adjacent data), the applicable legal basis is explicit consent (Art. 9(2)(a)) unless another Art. 9(2) ground applies.
6. How We Use Personal Data
We use personal data to:
- Provide, operate, and improve the YUPLEE platform;
- Manage your subscription and process payments;
- Communicate with you about your account, updates, and support;
- Ensure the security and integrity of the platform;
- Comply with legal and regulatory obligations;
- Process client booking data on your behalf as a data processor.
We do not sell personal data to third parties. We do not use client booking data for advertising or marketing purposes.
7. Data Sharing and Third Parties
We share personal data only in the following circumstances:
| Recipient | Purpose | Basis |
|---|---|---|
| Meta Platforms, Inc. | WhatsApp Business API message delivery | Contract necessity; Meta's own terms apply |
| Amazon Web Services (AWS) | Cloud hosting and storage | Data processing agreement in place |
| Stripe | Payment processing and billing | Data processing agreement in place |
| Legal or regulatory authorities | Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
All third-party processors are contractually bound to process data only on our instructions and in compliance with GDPR.
We do not transfer personal data outside the European Economic Area (EEA) without appropriate safeguards. Where transfers occur (e.g., to Meta in the US), we rely on adequacy decisions or Standard Contractual Clauses (SCCs) as the transfer mechanism.
8. Data Retention
| Data category | Retention period |
|---|---|
| Business operator account data | Duration of subscription + 5 years for billing records (Belgian accounting law) |
| Client booking and communication data | As configured by the business operator, subject to a maximum of 3 years from last interaction |
| Platform logs and security data | 12 months |
Business operators may configure their own retention periods within the bounds of applicable law. Operators are responsible for ensuring their retention periods comply with GDPR.
9. Special Category Data
To the extent that YUPLEE processes health-adjacent data (e.g., allergy notes, skin sensitivity records stored by beauty operators), this constitutes special category data under GDPR Article 9.
Such processing requires explicit consent from the data subject. Business operators using YUPLEE for this purpose are responsible for obtaining explicit, documented consent from their clients, providing clients with appropriate information about the processing, and ensuring a valid Art. 9(2) ground is in place.
Valtier Group will not independently process special category data beyond what is strictly necessary for service provision.
10. Your Rights Under GDPR
If you are a data subject whose data we control (i.e., a business operator account holder), you have the following rights:
| Right | Description |
|---|---|
| Right of access (Art. 15) | Request a copy of personal data we hold about you |
| Right to rectification (Art. 16) | Request correction of inaccurate data |
| Right to erasure (Art. 17) | Request deletion of your data (subject to legal retention obligations) |
| Right to restriction (Art. 18) | Request restriction of processing in certain circumstances |
| Right to data portability (Art. 20) | Receive your data in a structured, machine-readable format |
| Right to object (Art. 21) | Object to processing based on legitimate interest |
| Right to withdraw consent | Where processing is based on consent, withdraw at any time without affecting prior processing |
To exercise any of these rights, contact us at: privacy@valtiergroup.com
If you are a client of a salon using YUPLEE, you should contact the salon directly to exercise your rights, as they are the data controller for your booking data.
You have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données):
- Website: https://www.dataprotectionauthority.be
- Address: Rue de la Presse 35, 1000 Brussels, Belgium
11. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS) and at rest, access controls and authentication requirements, regular security monitoring and logging, and staff confidentiality obligations.
Where a personal data breach occurs that is likely to result in risk to the rights and freedoms of individuals, we will notify the Belgian Data Protection Authority within 72 hours and, where required, notify affected individuals without undue delay.
12. Cookies and Tracking
YUPLEE's web interface may use cookies and similar tracking technologies. Details on cookies used will be provided via a separate Cookie Policy as applicable.
13. Children's Data
YUPLEE is a B2B service intended for business operators. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us immediately at privacy@valtiergroup.com.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify business operators of material changes via email or in-platform notification. The "Last updated" date at the top of this page reflects the most recent revision.
Continued use of YUPLEE after notification of changes constitutes acceptance of the updated Policy.
15. Contact and Data Protection Queries
For any questions about this Privacy Policy or to exercise your rights:
Valtier Group BV
Oombergenstraat 53A, 9620 Zottegem, Belgium
Email: privacy@valtiergroup.com
Website: https://yuplee.com
This document is governed by Belgian law and the General Data Protection Regulation (EU) 2016/679.