Backlabel

Privacy policy

Backlabel · Blok Consulting · version of 2026-10-27

1. Who is responsible

Blok Consulting (Boomlaarstraat 75B, 2500 Lier, Belgium, enterprise and VAT number BE 0767.642.063) is responsible for the personal data described here: of people who use the Backlabel dashboard, who contact us, and who open a public page. Questions and requests go to legal@backlabel.eu. We haven’t appointed a data protection officer; that address handles everything about personal data.

Personal data that businesses put in their Backlabel account, such as the people in their team, the account’s log, to-dos, trade names or a contact in a recall message, is theirs: they decide about it, and we process it for them under the data processing agreement. Questions about that data go to the business first; we help them answer.

2. Public pages: no cookies, no tracking

  • The e-labels people open by scanning a code set no cookies, store nothing in the browser and contain no trackers or advertising.
  • We count scans without storing who scanned: the product, its version and lot, the language of the page, the country the scan came from and which link was followed. Those counts contain no IP addresses and are kept for three months.
  • Our hosting provider processes IP addresses to deliver the pages and to block attacks, and logs requests, including IP address and browser, for at most 7 days. If the backup copy ever takes over from our hosting, Bunny.net delivers the pages instead. Our legal ground is our legitimate interest in keeping the pages available and secure.

3. What we keep about dashboard users, and why

  • Your user: your name, email address and language, and the accounts you belong to with your role. For the person who opens an account, this is needed for the contract with their business; for colleagues, it’s our legitimate interest in providing the service their business asked for. Kept until you delete your user. Without an email address you can’t sign in.
  • Signing in: there are no passwords. We send sign-in codes by email, which expire after 10 minutes; we keep the public key of each passkey until you remove it; and if you choose to sign in with Google or Microsoft, the identifier, name, email address, profile picture and sign-in tokens they give us, until you unlink them. Sessions keep the IP address and browser they started from, so you can see and end them; a session ends when you sign out, or after a week without use.
  • Security log: sign-ins, every change to how you sign in, devices signed out, and our support signing in as you or blocking you, with IP address and device. Kept for one year, for our legitimate interest in protecting your user and investigating abuse.
  • Emails: sign-in and confirmation codes, invitations, reminders of to-dos and requests to check a product. We don’t keep copies of the emails we send.
  • Bot protection: sending a sign-in code goes through Cloudflare Turnstile, which checks the browser without cookies for tracking, for our legitimate interest in stopping abuse.
  • Technical logs: our hosting provider logs requests to the dashboard, including IP address and browser, and keeps those logs for at most 7 days so we can find errors and attacks (legitimate interest).
  • Support: emails to support@backlabel.eu reach our mailbox at Microsoft 365, and are kept as long as needed to help you and to handle what follows from it. When you or an owner of your account asks, our support may sign in as you for at most an hour; that session and what happens in it are in your security log and in the account’s log.
  • Problem reports: what you send with “Report a problem” in the dashboard, with the page you were on, your browser, window size and language. It reaches our support mailbox like an email, and we keep it with the account until the account is deleted, for our legitimate interest in helping you and improving Backlabel.
  • Where an account came from: when you open an account through a link on our website, the campaign tags of that visit (such as the campaign’s name), the name of the website that sent you to ours, the first page you saw there and the button you pressed. We keep them with the account, for our legitimate interest in knowing which of our marketing works; they’re in the account’s export.
  • Billing: paid plans are sold by Stripe as reseller (merchant of record). Stripe collects the payment and billing details itself and is responsible for them under its own privacy policy. We keep the Stripe customer number, the plan and its status, never card details.

We don’t use your data for advertising, don’t sell it, and don’t make automated decisions or profiles about you.

4. Cookies and browser storage in the dashboard

  • Session: a cookie keeps you signed in. Signing in with a passkey, Google or Microsoft sets a short-lived cookie to complete it.
  • Language: the lang cookie remembers the language you chose, for a year.
  • The browser’s own storage remembers which extra options you opened and the columns you chose for a product export, and the demo keeps its sample product in the tab until you close it. Coming from our website, the tab keeps where you came from until you open your account.

All of these only make the dashboard work as you asked, so they need no consent. There are no analytics or advertising cookies.

5. Who else receives data

  • Cloudflare hosts the service, sends its emails and forwards those to support, runs bot protection, keeps the technical logs and makes PDF labels and sheets, as our processor. The database and files are stored in Cloudflare’s EU jurisdiction; the service itself runs on Cloudflare’s worldwide network, close to whoever uses it.
  • Bunny.net (BunnyWay d.o.o., Slovenia) keeps the nightly backup copy of the public pages, stored in the EU, and delivers them if it ever takes over from Cloudflare, as our processor. It contains only what customers published.
  • Stripe sells paid plans and handles payments, as an independent controller.
  • Google and Microsoft, as independent controllers, only if you choose to sign in with them.
  • Microsoft 365 hosts our mailbox, for emails to support.
  • Our accountant and the authorities, where the law requires it.

Cloudflare and Stripe are also established in the United States. Where personal data leaves the European Economic Area, it’s protected by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

6. When you delete your user

You can delete your user in your profile, unless you’re the only owner of an account. We then delete your personal data, sessions, passkeys, links to Google or Microsoft and your security log. Account logs keep what happened without linking it to you, but can still mention your email address where it was part of the event, such as an invitation or deleting your user. Problem reports you sent stay with the account without linking them to you. Database backups that still contain your data expire within 30 days, technical logs within 7 days.

7. Your rights

You can see and correct your details in your profile, delete your user there, and an account’s owners and admins can export its data. You can also ask us for access, correction, deletion, restriction or a copy of your data, and object to processing based on our legitimate interest, at legal@backlabel.eu. We answer within a month and may ask you to confirm the request from the email address of your user. If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels (dataprotectionauthority.be).

8. Changes

When this policy changes in substance, we tell the owners of every account by email and in the dashboard before the change applies. The date at the top is the current version.