Privacy policy

Onelia (DCNG SRL), onelia.be website, mobile application and web portal, version 6 of 22 October 2026

DCNG SRL, the publisher of the Onelia platform, attaches great importance to the protection of your privacy. This privacy policy describes the personal data that we process when you visit our onelia.be website, when you use our mobile application or our web portal, or when you enter into contact with us, the purposes and legal bases of those processing operations, their recipients, their retention periods and the rights available to you. It has been drawn up in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”) and with the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

This policy constitutes information and not a contractual document. It is published separately from the data processing agreement, which is annexed to the general terms and conditions of sale and accepted by our Clients when they register. Updating this policy does not amend that agreement or the general terms and conditions.

1. Who are we?

The controller is DCNG SRL, a limited liability company governed by Belgian law, with its registered office at Avenue de l’Abbaye d’Aywiers 25, 1410 Waterloo (Belgium), registered with the Crossroads Bank for Enterprises under number 0780.406.273, which publishes and markets the Onelia platform (hereinafter “Onelia” or “we”).

Onelia is management software intended exclusively for professionals, tradespeople, self employed persons and small and medium sized service undertakings established in Belgium, France and Luxembourg (hereinafter our “Clients”). It consists of a mobile application for iOS and Android systems, which works offline, and of a web management portal, and allows in particular the management of customers, jobs, sites, quotations, invoices, including electronic invoicing through the Peppol network, stock, the calendar and teams.

Given the nature, the scope and the purposes of its processing operations, Onelia is not required to appoint a data protection officer within the meaning of Article 37 GDPR and has not appointed one. For any question concerning the protection of your personal data or to exercise your rights, a single point of contact is available to you at privacy@dcng.be or by post at the address of the registered office mentioned above.

2. Our two roles: controller and processor

Onelia acts in two distinct capacities, which need to be clearly distinguished in order to understand this policy.

As a controller, Onelia determines the purposes and the means of the processing operations relating to its website, to the management of its Clients and their users, to support, to the security of the platform and to its commercial communications. Those processing operations are described in section 3.

As a processor, Onelia hosts and processes, on behalf of and on the instructions of its Clients, the data that they enter into the platform: their own customers and contacts, their quotations and invoices, their site photographs, their calendar and their teams. For that data, the Client is the controller and Onelia acts in accordance with the data processing agreement annexed to its general terms and conditions of sale (hereinafter the “DPA”). That role is described in section 4.

3. The data we process as a controller

For each processing operation, we indicate below the data concerned, the purpose pursued, the legal basis within the meaning of Article 6 GDPR and the retention period.

3.1 Visitors to the onelia.be website and waiting list

When you visit our website, our hosting provider generates technical logs containing in particular your IP address, the pages consulted, the time stamp and the type of browser, for the sole purposes of ensuring the security and the proper operation of the website. That processing is based on our legitimate interest in guaranteeing the security of our systems (Article 6(1)(f) GDPR). Those logs are kept for a maximum of twelve months.

Every night, the previous day’s server log is reduced to visit counters that no longer allow a visitor to be identified: the number of visits, of pages viewed, of form steps completed and the split between human visitors and robots. IP addresses are not kept in those counters. That processing, which allows us to measure the audience of our website without using a third party tool, is likewise based on our legitimate interest (Article 6(1)(f) GDPR). Our website places no cookie or tracker, subject only to the anti-robot check described below, uses no third party audience measurement tool and uses no advertising or embedded social network tool (see section 5).

If you provide us with your email address through the early access form, we use it to inform you of the launch of Onelia and to offer you access to the platform. That processing is based on your consent (Article 6(1)(a) GDPR), which you may withdraw at any time by clicking on the unsubscribe link contained in each email or by writing to us. Your address is kept until the commercial launch of Onelia, and then for no more than twelve months after that launch, unless you become a Client or withdraw your consent earlier. Addresses whose registration has not been confirmed are deleted automatically after thirty days.

To protect this form against automated sign-ups, we use Cloudflare’s anti-robot check (Turnstile). It only loads when you start filling in the form; simply visiting the website does not trigger it. Cloudflare then receives your IP address and technical information about your browser and your connection. It uses them to tell a person from a robot and, as a controller, to improve that detection (cloudflare.com/turnstile-privacy-policy). To limit repeated sign-ups, we keep a fingerprint of your connection, which does not contain your IP address, for no more than twenty-four hours. That processing is based on our legitimate interest in protecting the form and our emails against abuse (Article 6(1)(f) GDPR).

3.2 Contact and demonstration requests

When you contact us through the website form, by email or through any other channel, we process your identification and contact data, namely your surname and first name, your undertaking, your email address and your telephone number, as well as the content of your request, in order to answer it, to present the platform to you and, where applicable, to prepare the conclusion of a contract. That processing is based on the performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR) or, where you act on behalf of an undertaking, on our legitimate interest in answering the requests addressed to us (Article 6(1)(f) GDPR). That data is kept for the duration of the handling of your request and, if it does not lead to a contract, for three years from our last exchange.

3.3 Accounts of Clients and of their users

When a Client creates an account, we process the identification and contact data of the undertaking and of its representative, namely the company name, the enterprise number or value added tax number, the address, the surname and first name, the email address, the telephone number and the language, as well as the data of the users to whom the Client grants access: surname, first name, email address, language, role and capabilities assigned, two factor authentication secret where the user has activated it, device notification tokens, connection logs and security activity logs. The sign-up page of the portal uses the same anti-robot check, under the conditions described in section 3.1; there, it loads when the page opens.

That data is processed in order to create and administer the accounts, to authenticate users, to provide the service subscribed to, to ensure its security and to communicate with the Client about the contract, in particular to inform it of developments in the service, of contractual amendments, of updates to the list of sub-processors and of incidents. In relation to the Client, that processing is based on the performance of the contract (Article 6(1)(b) GDPR). In relation to users who are not themselves parties to the contract, it is based on our legitimate interest, and that of the Client, in allowing them to use the platform securely in the course of their professional activity (Article 6(1)(f) GDPR).

Account data is kept for the duration of the free trial and of the contract and is then deleted at the end of the retrieval and erasure periods laid down by the DPA, with the exception of the data necessary to prove performance of the contract and to defend our rights, which is kept for the applicable limitation period, namely ten years from the end of the contract. Connection and security logs are kept for twelve months.

3.4 Checking that accounts are personal to one user

Our subscriptions are invoiced per user and each account corresponds to a single natural person, login credentials not being capable of being shared. In order to ensure compliance with that rule and the accuracy of invoicing, we count, for each user account, the hours during which several connections of the mobile application are active at the same time. That count relates exclusively to technical connection data. It involves no analysis of the content entered into the platform, no geolocation and no measurement of working time, and gives rise to no automated decision: any possible sharing is assessed by a person and discussed with the Client, whose responsibility it is to open the missing accounts.

The same person may connect simultaneously from several devices, which does not constitute sharing. That processing is based on our legitimate interest in preventing non-compliant use of the service and in invoicing subscriptions correctly (Article 6(1)(f) GDPR). The indicators thus calculated are kept for twelve months. It is for the Client, in its capacity as employer, to inform its staff of that rule of use.

3.5 Subscriptions, invoicing and payment

Subscriptions to Onelia are sold and invoiced by DCNG. To draw up and send our invoices, monitor payments and keep our accounts, we process the identification of the Client (company name, address, enterprise number and value added tax number, Peppol identifier), the email address for invoicing, the plan subscribed to, the number of billed users, our invoices and the payments received, together with, depending on the means of payment, the name and bank account number of the payer.

That processing is based on the performance of the contract (Article 6(1)(b) GDPR) and on our legal obligations in accounting and tax matters (Article 6(1)(c) GDPR). Our accounting and tax records are kept for ten years from 1 January of the year following that in which they were drawn up.

Our invoices are sent through the Peppol network, via our access point provider, and by email. Payments are processed by our authorised payment service provider, as an autonomous controller, in accordance with its own privacy policy. Onelia keeps no complete payment card data.

3.6 Support and reports

When a user sends us a report or a request for assistance, from the application or by email, we process that user’s identification and contact data, the content of the request and, where applicable, the technical information or data extracts that the user chooses to send us in order to describe the problem. That data is processed in order to resolve the incident, to improve the platform and to keep a record of the exchanges. That processing is based on the performance of the contract concluded with the Client (Article 6(1)(b) GDPR) and on our legitimate interest in providing quality support (Article 6(1)(f) GDPR). We invite you not to send us, in your reports, more data than is necessary, in particular as regards end customers. Support exchanges are kept for two years from the closure of the request.

3.7 Security, technical logs and error reports

In order to ensure the security and the reliability of the platform, we process technical logs containing IP addresses, device identifiers, time stamps and security events, and we monitor the state of our components in an automated manner. That processing is based on our legitimate interest in guaranteeing network and information security and in preventing unauthorised access (Article 6(1)(f) GDPR). Technical logs are kept for a maximum of twelve months.

Technical error reports from the application and from the portal are collected by means of a tool configured to send no personal data: no IP address, no user identifier and no screenshot. Likewise, the availability of the platform is measured by an external probe which receives only an operating status. We mention those tools for the sake of transparency.

3.8 Push notifications and service emails

If you activate notifications in the application, we process the token assigned to your device by Apple or Google in order to send you notifications relating to your activity. That processing is based on the performance of the contract (Article 6(1)(b) GDPR). The text of those notifications is deliberately kept short: it mentions the number of the document concerned and the time, to the exclusion of the name of your end customers.

The notification token is deleted from our systems when you log out, when the notification provider informs us that it has expired, or after two hundred and seventy days without use. Deactivating notifications in your device settings stops you receiving them but does not, in itself, cause the token to be deleted.

Service emails, in particular those relating to login, to security alerts and to the sending of documents, are necessary for the operation of the platform and cannot be deactivated while the account is active.

3.9 Commercial communications

We may send our Clients information about new features of the platform and about our offers relating to services similar to those to which they have subscribed. That processing is based on our legitimate interest in maintaining the relationship with our customers (Article 6(1)(f) GDPR), in accordance with Article XII.13 of the Code of Economic Law. You may object to it at any time, free of charge and without giving reasons, by clicking on the unsubscribe link contained in each email or by writing to us.

As regards prospects, we send commercial communications by electronic means to a natural person only with that person’s prior consent (Article 6(1)(a) GDPR), except where the message is sent to a generic address of a legal person. Prospecting data is kept for three years from our last contact or until consent is withdrawn.

3.10 Activation of electronic invoicing (Peppol network)

When a Client activates electronic invoicing, the Peppol network access point provider which we use carries out, with the assistance of its identity verification provider, the verification of the undertaking and of the identity of its legal representative, which involves the transmission of an identity document. That verification meets the access point provider’s own obligations.

That identity document never passes through Onelia. The legal representative provides it directly on the access point provider’s verification page, which Onelia merely opens from the service. Onelia receives only the result of the verification, namely that the identity has or has not been verified, and keeps only that result together with the date of activation. The contact details of those providers appear in section 6.

3.11 Subscribing your calendar to the Onelia schedule

The service allows each user to subscribe their personal or professional calendar, for example Google Calendar, Outlook or Apple Calendar, to the schedule that they keep in Onelia. Technically, Onelia makes a calendar file available behind an address containing a secret; it is the calendar software chosen by the user that reads that file at regular intervals. Onelia sends nothing to those providers on its own initiative and has no contractual relationship with them.

A user who activates that function communicates to their calendar provider the appointments contained in their schedule, including the name of their employer’s customers, the job addresses and the descriptions entered. The telephone number is not included by default. That provider is a recipient chosen by the user and by the Client, and not a processor of Onelia; the processing that it carries out is governed by its own terms, including as regards the location of the data. The interface warns the user of the nature of the information exposed and of the strictly personal character of the link, which may be revoked at any time from the service.

The technical logs of the server that makes the file available record the requests received, including the token contained in the address, under the conditions described in section 3.7. When an end customer replies to an invitation sent from Onelia, that person’s email address and reply pass through our email sending and receiving provider and are kept there for a maximum of thirty days.

3.12 Social networks

Onelia has pages on LinkedIn, Facebook and YouTube. When you interact with those pages, your data is processed by the platforms concerned in accordance with their own privacy policies. For the audience statistics of those pages, Onelia and the platform concerned may be regarded as joint controllers; the arrangements for that joint controllership are defined in the terms published by each platform. We do not export your data from those platforms.

4. The data we process on behalf of our Clients

The data that our Clients enter into the platform, namely the identity and contact details of their own customers and contacts, their quotations, work orders and invoices, their site photographs and sketches, signatures, the calendar, time spent and team members, is processed by Onelia as a processor, on behalf of and on the instructions of the Client concerned, which is the controller of that data.

If you are a customer, supplier or contact of a tradesperson or of an undertaking that uses Onelia, it is that undertaking which decides on the purposes of the processing of your data, which is required to inform you and to which you must turn in order to exercise your rights. Onelia makes available to its Clients the tools needed to respond: consultation, rectification, full export of your file and erasure by anonymisation preserving documents having legal value. If you send us a request concerning that data directly, we will forward it to the undertaking concerned and inform you accordingly.

The conditions of that processing, including instructions, security, sub-processors, transfers, assistance, notification of breaches, return and erasure, are laid down by the DPA annexed to the general terms and conditions of sale. The list of the sub-processors which we use in order to provide the platform constitutes Annex 3 to that agreement; it is published on a permanent basis at onelia.be/sous-traitants and each amendment is in addition communicated by email to our Clients.

5. Cookies and similar technologies

The onelia.be website places no cookie or any other tracker on your device and uses no third party audience analysis, advertising or embedded social network tool. The only exception: when you start filling in the waiting list form, or open the sign-up page of the portal, Cloudflare’s anti-robot check described in section 3.1 reads, and may store in your browser, technical information. It is used solely to verify that the sign-up you request comes from a person, not for tracking or advertising: it is strictly necessary and does not require your consent. The traffic measurement described in section 3.1 is carried out on the basis of server logs alone, without reading or writing any information on your device and without keeping your IP address. No consent banner is therefore necessary. Should we in future make use of cookies that are not strictly necessary, we would obtain your prior consent in accordance with Article 129 of the Act of 13 June 2005 on electronic communications and with the recommendations of the Belgian Data Protection Authority, and we would publish a cookie policy.

The mobile application and the web portal use only local storage mechanisms strictly necessary for their operation: session and authentication tokens, display preferences and, on the mobile application, a local database allowing offline working, linked to a single user and purged automatically when the account on the device is changed. Those mechanisms serve no tracking or advertising purpose and do not require consent.

6. Recipients of your data and processors

Within Onelia, your personal data is accessible only to the persons who need it for the purposes described above. It is furthermore processed by the following providers, which act as processors on our instructions and under a processing agreement complying with Article 28 GDPR, or, where so specified, as autonomous controllers.

For the verification of value added tax numbers and of company data and for the suggestion of addresses in France and in Luxembourg, the platform queries official public services, namely the European Commission’s VIES system, the Crossroads Bank for Enterprises, the Base Adresse Nationale and the geoportal of the Luxembourg State, which process the data transmitted under their own responsibility. Belgian addresses are processed by means of an address database hosted by Onelia.

The calendar providers to which a user chooses to subscribe their schedule, under the conditions described in section 3.11, are recipients chosen by the user and by the Client. They are not processors of Onelia and do not appear in Annex 3 to the DPA.

We may also disclose your data to the judicial, administrative or supervisory authorities where the law requires us to do so, as well as to our legal advisers where this is necessary for the defence of our rights. We neither sell nor rent your personal data and we do not use it to train artificial intelligence models.

7. Transfers outside the European Union

Your data is hosted and processed by default within the European Union. Some of our providers are, however, established in the United States of America or process part of the data there, as indicated in section 6. Those transfers are based on the adequacy decision of the European Commission of 10 July 2023 concerning the EU-US Data Privacy Framework, for providers certified under that framework, and on the standard contractual clauses adopted by the European Commission by Implementing Decision (EU) 2021/914, supplemented where necessary by additional measures, in accordance with Articles 44 to 46 GDPR. You may obtain a copy of the applicable safeguards by writing to us at privacy@dcng.be.

8. Retention periods

We keep your personal data only for as long as is necessary for the purposes for which it is processed, and we then delete or anonymise it. The applicable periods are summarised below.

9. Security of your data

In accordance with Article 32 GDPR, we implement appropriate technical and organisational measures to protect your data against unauthorised destruction, loss, alteration, disclosure or access. Those measures include in particular the encryption of data in transit and at rest, strict isolation of each Client’s data at the level of the database engine, the possibility for each user to activate two factor authentication, role based access management, daily backups encrypted before they leave our hosting infrastructure, automated monitoring with alerts, error messages disclosing no technical detail and a procedure for managing data breaches. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you in accordance with Article 34 GDPR.

10. Your rights

Under the conditions and within the limits laid down by the GDPR, you have the following rights in respect of your personal data: the right of access (Article 15), which allows you to obtain confirmation that your data is being processed and to receive a copy of it; the right to rectification (Article 16) of inaccurate or incomplete data; the right to erasure (Article 17), subject to our legal retention obligations; the right to restriction of processing (Article 18); the right to data portability (Article 20), which allows you to receive the data you have provided to us in a structured, commonly used and machine readable format, where the processing is based on your consent or on a contract; the right to object (Article 21) to processing based on our legitimate interest, on grounds relating to your particular situation, and, at any time and without giving reasons, to processing for direct marketing purposes; as well as the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly affects you (Article 22), it being specified that Onelia takes no decision of that kind.

Where the processing is based on your consent, you may withdraw it at any time, without that withdrawal affecting the lawfulness of the processing carried out before it.

To exercise those rights, send your request to privacy@dcng.be or by post to the address of our registered office. In order to protect your data, we may ask you to prove your identity by any reasonable means where we have doubts in that regard. We reply to you within one month of receipt of your request; that period may be extended by two months having regard to the complexity or the number of requests, in which case we inform you accordingly. If your request concerns data processed on behalf of one of our Clients, we will direct you to that Client in accordance with section 4.

You also have the right to lodge a complaint with a supervisory authority, in particular that of the Member State of your habitual residence, your place of work or the place where the alleged infringement was committed. In Belgium, this is the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, telephone +32 (0)2 274 48 00, email contact@apd-gba.be, website www.autoriteprotectiondonnees.be. In France, this is the Commission nationale de l’informatique et des libertés and, in Luxembourg, the Commission nationale pour la protection des données. You may in addition seek a judicial remedy in accordance with Articles 78 and 79 GDPR.

11. Mobile application: permissions and local data

The Onelia mobile application may ask you for access to certain features of your device, only where this is necessary for a function that you use: the camera and the photo library in order to document sites, notifications in order to inform you of your activity and the location of the device in order to centre the map on your position. You may grant, refuse or withdraw those permissions at any time in your device settings. Where a photograph that you take or that you import carries geolocation metadata, the coordinates of the place where it was taken are recorded with the photograph in the site file; you may avoid this by disabling location for photographs in your device settings. The display of maps uses a map tile provider established in the European Union, which receives the IP address of the device and the map areas consulted, but never the addresses of your customers.

In order to allow offline working, the application keeps a local copy of your account data on your device. That copy is linked to your user alone, protected by the security mechanisms of your device and purged automatically when the account is changed. We recommend that you protect your device with a code, a fingerprint or facial recognition, and that you report any loss or theft to us without delay so that we can revoke access.

12. Minors

The Onelia platform is intended for professional use and is not addressed to persons under eighteen years of age. We do not knowingly collect personal data concerning minors. If you believe that a minor has provided us with data, please inform us so that we may delete it.

13. Amendments to this policy

We may amend this policy in order to take account of legal, regulatory or operational developments, in particular when a new provider or a new feature is added. The version in force, identified by its date, is published on a permanent basis at onelia.be/confidentialite and is accessible from the application and from the web portal. In the event of a substantial amendment affecting our Clients or their users, we inform them by email or by a notification in the platform before it enters into force. Amending this policy does not amend the general terms and conditions of sale or the DPA, which follow their own procedures.

14. Applicable law

This policy is governed by Belgian law, without prejudice to the mandatory data protection provisions applicable in the Member State of your residence. Any dispute relating to its application falls within the jurisdiction of the courts and tribunals of the judicial district of Walloon Brabant, without prejudice to your right to lodge a complaint with a supervisory authority or to bring an action before the competent courts in accordance with the GDPR.