Buss Lifestyle — Privacy Policy
This Privacy Policy explains which personal data we process when you use the Buss Lifestyle app, why we do so, with whom we share it and what rights you have. Buss Lifestyle is an ordering app for professional kitchens: you can only use it to order on behalf of a business with a valid VAT number.
1. Who is the controller?
The controller is:
Plan-B International BV, trading as Buss Olive Oil (“Buss”, “we”)
Vogelzangstraat 50B, 2560 Nijlen, Belgium
Enterprise number / VAT: BE 0881.457.509
Email: info (at) bussoliveoil.com
The app is built and technically managed by SMDS Solutions, a subsidiary of 10000 Suns bv (Sanderusstraat 9, 2018 Antwerp, BE 0788.948.312). SMDS Solutions acts as a processor on behalf of Buss and does not use your data for its own purposes. In the App Store and on Google Play the app is listed under SMDS Solutions; Buss remains responsible for your data.
2. What data do we process?
Data about your business
- company name, legal form, VAT number and the status of the VAT check;
- billing address and delivery address(es);
- delivery instructions (for example “rear entrance, ring at the kitchen”) and opening hours for deliveries, including closure periods.
Data about you as the contact person
- first name, surname, email address and mobile number;
- your preferred language;
- the date and time at which you accepted the terms and this Privacy Policy;
- whether you wish to receive news from Buss (marketing opt-in), and when you gave or withdrew that indication.
Order and payment data
- your orders: products, quantities, prices, VAT, delivery address and estimated delivery date;
- the payment status and a reference from the payment provider. Your card or bank details never reach us: you enter them directly with the payment provider.
Technical data
- login data needed for your session (a secure token, stored in your device's secure storage);
- your device's IP address, which is inevitably visible to the servers the app connects to.
- a system log of what happens in the app: registering, logging in and out, orders and payments, verification codes being sent, and which details were changed (not what to). It holds an internal user id, never your name, e-mail address or number; your IP address and your codes are not kept in it.
What we do not process
- Biometric data. Face ID, Touch ID or fingerprint are handled entirely by your device. The app only receives a “yes” or “no” and never receives your fingerprint or facial data.
- Location. The app does not request access to your location.
- Analytics or advertising trackers. The app contains no analytics tools, no advertising networks and no tracking across other apps or websites.
Your language choice, display setting (light/dark) and your shopping basket are stored only on your device.
3. Why do we process this data, and on what legal basis?
| Purpose | Legal basis (GDPR Art. 6) |
| Creating your account, confirming your identity with a one-time code and letting you log in | Performance of the contract |
| Checking your business's VAT number and pre-filling your company details | Performance of the contract and legitimate interest (selling to businesses only) |
| Suggesting addresses as you type | Performance of the contract |
| Processing, taking payment for, delivering and invoicing orders | Performance of the contract |
| Retaining invoices and accounting records | Legal obligation |
| Customer service and questions about orders | Performance of the contract and legitimate interest |
| Keeping the app secure and preventing misuse | Legitimate interest |
| Keeping a system log, to solve problems with orders, payments and logging in, and to detect misuse | Legitimate interest |
| Sending you news and offers from Buss | Consent (which you may withdraw at any time) |
4. With whom do we share your data?
We never sell your data. We share it only with parties we need to make the app work, and only what that party needs:
| Party | Role | Which data | Where |
| SMDS Solutions (10000 Suns bv), Belgium | Builds and manages the app, and receives a copy of every order confirmation for technical follow-up | All the data above, solely on behalf of Buss | EU |
| Supabase | Database, accounts and server functions | All account data and orders | Data centre in Frankfurt (EU) |
| Twilio | Sending verification codes by SMS or WhatsApp | Your mobile number | EU/US* |
| Google (Firebase Cloud Messaging) and Apple (Push Notification Service) | Notifications about your order on your phone, also with the app closed (“your order is on its way”) | A device token and the order reference with its status; no name, address or amount. In your profile you choose: always, ask per order, or never | EU/US* |
| Infomaniak (Switzerland) | Sending verification codes by email, and the confirmation of your order (to you and to Buss) | Your email address; for the confirmation also your company and contact details, addresses, opening hours and the order | Switzerland** |
| Mollie (Netherlands) | Handling payments | Amount, order reference and whatever you enter yourself when paying | EU |
| Carrier engaged by Buss | Delivering your order | Company name, contact person's name, delivery address, telephone number, delivery instructions and opening hours | EU |
| European Commission (VIES) | Checking the VAT number | The VAT number | EU |
| Geoapify (Germany) and PDOK (Dutch government) | Address suggestions | The text you type into an address field (no name or other data) | EU |
| Cloudflare | Hosting of the web version of the app, access control for testers, and protection against bots (Turnstile) when you request a code in the app or on the web | Your IP address and browser data when loading; when you request a code, also technical characteristics of your device and browser; for testers also the email address they request access with | EU/US* |
| Shopify | Supplies the product catalogue (names, photos, prices) | No account data; only your device's IP address when product photos are loaded | EU/US* |
| Buss's accountant and the Peppol network | Invoicing and accounting | Invoice data | EU |
* Where a party may process data outside the European Economic Area, this is done on the basis of a data processing agreement incorporating the European Commission's standard contractual clauses or under the EU-US Data Privacy Framework.
** According to the European Commission, Switzerland offers an adequate level of protection (adequacy decision).
The protection against bots when you request a code uses Cloudflare Turnstile. Cloudflare's Turnstile Privacy Addendum also applies to it: https://www.cloudflare.com/turnstile-privacy-policy/
We also disclose data to public authorities where the law requires us to do so.
5. How long do we keep your data?
- Account, company and address data: for as long as your account exists. If you delete your account, we erase it immediately.
- Orders and invoices: for the statutory retention period for accounting and VAT (currently 10 years). If you delete your account, we anonymise your orders: the link to you as a person and the delivery address are removed, while the invoice data the law requires us to keep is retained.
- Marketing opt-in: until you withdraw your consent or delete your account.
- Backups: our database provider makes automatic backups. Erased data disappears from them when those backups are overwritten, at the latest after 30 days.
- Verification codes: expire after 10 minutes.
- Unfinished sign-ups: if you ask for a code when registering and do not complete the registration, we delete your e-mail address or number automatically after 24 hours.
- Login code requests: to limit misuse, we keep for each request a coded fingerprint of your email address or number (not the address or number itself) and the time. These are deleted automatically after 1 day.
- System log: at most 12 months (Buss can set it shorter), then deleted automatically. If you delete your account, nothing in the log refers to you any more.
6. Deleting your account
You can delete your account and all associated data yourself at any time in the app, via Profile → Delete account and all data. You will first see a warning; once you confirm, the deletion is permanent.
No longer have the app? Then send a request from the email address or mobile number of your account to info (at) bussoliveoil.com, or see the explanation at https://www.smds.be/en/apps/buss-lifestyle/delete-account/. We will carry out your request within 30 days.
Orders already paid for but not yet delivered will still be completed. See also section 5 regarding invoices.
7. Your rights
You have the right to:
- obtain access to the data we hold about you;
- have inaccurate data rectified (you can change most of it yourself in the app);
- have your data erased;
- have the processing restricted;
- object to processing based on legitimate interest;
- receive your data in a commonly used format (portability);
- withdraw your consent to marketing at any time, via your profile or the unsubscribe link in every email.
Send your request to info (at) bussoliveoil.com. We will reply within one month. We may ask you to confirm your identity.
If you are not satisfied with how we handle your data, you can lodge a complaint with the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
8. Security
- All of the app's connections are encrypted (HTTPS/TLS).
- Your data is stored in a database in the EU, with access rules per business: a user can only see the data of their own business.
- Your session is stored in your device's secure storage (Keychain on iOS, Keystore on Android). In the web version, your browser keeps the session and your basket on your own device; log out when you use a shared computer.
- Login uses one-time codes, with no password that could be leaked.
- Our server logs contain no personal data.
9. Minors
Buss Lifestyle is intended for professional users ordering on behalf of a business. The app is not intended for persons under the age of 18.
10. Changes
We may amend this Privacy Policy, for example when we engage a new service or party. The date at the top shows the version in force. In the event of significant changes, we will notify you in the app.
11. Contact
Questions about your data or this policy: info (at) bussoliveoil.com
Technical questions about the app: hello (at) smds.be