Privacy Policy

1. Who We Are

BParked ("we", "our", "us") operates the BParked SaaS platform, accessible at www.bparked.com. We act as a data processor on behalf of the organisations ("data controllers") that use our Service to manage their employees' parking and desk reservations.

For questions about this policy, contact us at info@bbox.rs.

2. What Data We Collect

We collect only the data necessary to provide the Service:

Category	Examples	Purpose
Account data	Name, work email address, job title	Account creation and authentication
Reservation data	Parking spot bookings, desk reservations, dates and times	Core Service functionality
Authentication data	Hashed passwords, TOTP secrets, 2FA codes (temporary)	Security and access control
Vehicle data	Vehicle type, EV/handicap flags (optional)	Smart parking assignment
Usage data	Login timestamps, feature interactions, IP address	Security monitoring and Service improvement
Communication data	Email notification preferences and history	Sending reservation confirmations and reminders

3. How We Use Your Data

We use your personal data to:

• Provide, operate, and maintain the BParked Service
• Send reservation confirmations, reminders, and notifications
• Authenticate users and maintain account security
• Process subscription payments and billing
• Respond to support requests and communications
• Monitor and improve platform performance and reliability
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

4. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contract performance: Processing necessary to provide the Service you subscribed to
• Legitimate interests: Security monitoring, fraud prevention, and Service improvement
• Legal obligation: Compliance with applicable laws and regulations
• Consent: Where you have given explicit consent (e.g., marketing communications)

5. Data Sharing and Third Parties

We may share data with trusted third-party service providers strictly to operate the Service:

• Payment processing: Paddle (payment gateway) — billing data only
• Email delivery: SMTP email provider — for sending notifications
• Infrastructure: Cloud hosting and database providers

All third-party processors are contractually bound to GDPR-compliant data processing agreements.

We do not share personal data with any other third parties without your explicit consent, except where required by law.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service:

• Active accounts: Data is retained for the duration of the subscription
• After cancellation: Data is retained for 30 days to allow data export, then securely deleted
• Reservation history: Retained for up to 2 years for compliance purposes
• Billing records: Retained for 7 years as required by tax law

7. Data Security

We implement industry-standard security measures to protect your data:

• All data transmitted is encrypted using TLS/HTTPS
• Passwords are hashed using bcrypt — we never store plaintext passwords
• Two-factor authentication (TOTP and email OTP) available for all accounts
• Regular security reviews and access controls
• Isolated database per-tenant architecture

8. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to restrict processing: Request temporary restriction of processing

To exercise any of these rights, contact us at info@bbox.rs. We will respond within 30 days.

9. Cookies

BParked uses minimal cookies strictly necessary for the Service to function:

• Session cookies: Used to maintain your authenticated session (expires when you close the browser)
• Preference cookies: Used to remember your settings (e.g., language, theme)

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. International Data Transfers

BParked primarily stores and processes data within the European Union. If any data transfer outside the EU is necessary, it is subject to appropriate safeguards (Standard Contractual Clauses or equivalent adequacy decisions).

11. Children's Privacy

BParked is a workplace tool intended for adults (18+). We do not knowingly collect personal data from children under the age of 16. If you believe a minor has provided us with personal data, contact us immediately at info@bbox.rs.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice within the Service. Continued use of the Service after changes constitutes acceptance of the updated Policy.

13. Contact and Complaints

For privacy-related questions or to exercise your rights:

• Email: info@bbox.rs
• Website: https://www.bparked.com

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority. In Belgium: Autorité de protection des données (APD) — www.dataprotectionauthority.be.