Privacy Policy
Last updated: March 2025
1. Data controller
The data controller responsible for processing your personal data is:
2. Data we collect
We collect the following categories of personal data:
- Account data — name, email address, hashed password (collected when you register or sign in via a third-party provider such as Google).
- Usage data — grocery lists, shop names, and items you create within the application.
- Technical data — IP address, browser type, device information, and log data collected automatically when you use the service.
- Cookie data — your cookie consent preferences and, if you consent, analytics and marketing data (see our Cookie Policy).
3. Legal basis for processing
| Processing activity | Legal basis (GDPR Art. 6) |
|---|---|
| User authentication and account management | Art. 6(1)(b) — Contract performance |
| Storing grocery lists and app data | Art. 6(1)(b) — Contract performance |
| Strictly necessary cookies | Art. 6(1)(f) — Legitimate interests |
| Analytics cookies | Art. 6(1)(a) — Consent |
| Marketing cookies | Art. 6(1)(a) — Consent |
| Security logging and fraud prevention | Art. 6(1)(f) — Legitimate interests |
4. Data retention
We retain your personal data only as long as necessary for the purposes described in this policy:
- Account and usage data — retained for the duration of your account and deleted within 30 days of account deletion.
- Server logs — retained for up to 90 days for security and troubleshooting purposes.
- Cookie consent records — retained for 1 year or until you reset your preferences.
5. Data sharing and transfers
We do not sell your personal data. We may share data with the following categories of recipients:
- Hosting and infrastructure providers — our VPS provider hosts the application within the EU.
- Authentication providers — if you sign in with Google, Google receives your sign-in request in accordance with their privacy policy.
- Analytics / marketing providers — only if you have given consent for those cookie categories (Google Analytics, Meta Pixel).
- Legal authorities — where required by applicable law.
6. Your rights under GDPR
As a data subject in the EEA, you have the following rights:
- Right of access (Art. 15) — request a copy of your personal data.
- Right to rectification (Art. 16) — request correction of inaccurate data.
- Right to erasure (Art. 17) — request deletion of your data (“right to be forgotten”).
- Right to restriction (Art. 18) — request that we limit processing.
- Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
- Right to object (Art. 21) — object to processing based on legitimate interests.
- Right to withdraw consent (Art. 7(3)) — withdraw consent at any time for consent-based processing.
To exercise any of these rights, email us at info@mykeypair.be. We will respond within 30 days. You also have the right to lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).
7. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data transmitted between your browser and our server is encrypted via HTTPS/TLS.
8. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of ListEase after changes are posted constitutes acceptance of the revised policy.