This privacy statement explains how preveTEx handles personal data. preveTEx is a software service that helps organizations manage their occupational well-being and prevention records.
1. Data controller
preveTEx is provided by preveTEx (company registration number 1042.951.918). If you have questions about this statement or your data, contact us at info@prevetex.com.
2. Two roles: controller and processor
preveTEx processes personal data in two capacities. This distinction determines who is responsible for what:
- As data controller — for the data of users who have a preveTEx account: name, email address, login details, and usage data needed to provide and secure the service.
- As data processor — for all occupational well-being data that a customer organization enters into preveTEx (employees, occupational accident record cards, health surveillance, maternity notifications, training courses, etc.). For this data, the customer organization is the data controller; preveTEx processes it solely on that organization’s behalf and according to its instructions, under a separate data processing agreement (see the Terms of Use).
If you work for an organization that uses preveTEx, first direct questions about your personal data to your employer in its capacity as data controller.
3. What data we process and why
As data controller for account data, preveTEx processes:
- Identification and contact details (name, email address, organization) — to manage your account and provide access.
- Login and security data — to secure the service and prevent misuse.
- Billing details (the organization’s name, address, and company registration number) — to invoice the service.
The legal bases are performance of the agreement with your organization, compliance with legal obligations (such as accounting obligations), and the legitimate interest in keeping the service secure and operational.
The occupational well-being data entered by customers may include special categories of personal data (health-related data, such as an injury recorded on an occupational accident record card or the fact that a person is subject to health surveillance). preveTEx processes this data solely as a processor on behalf of the customer organization, on the legal basis applicable to that organization (including the Belgian Act on Well-being at Work and the Codex on Well-being at Work).
The medical file itself is not stored in preveTEx. It remains with the prevention advisor–occupational physician or the external service, which is exclusively responsible for it by law (Codex, Article I.4-88). preveTEx stores only the schedule and the legally required lists of names — no medical results, fitness-for-work decisions, or medical documents.
4. Recipients and processors
preveTEx does not share personal data with third parties for their own purposes. To provide the service, preveTEx uses a limited number of subprocessors:
- Vercel Inc. — application hosting.
- Supabase — database and authentication.
- Resend — sending transactional email (notifications and reminders).
- Stripe — subscription billing and payment processing.
- Microsoft 365 — only when your organization activates the Microsoft 365 integration (calendar, documents, and contacts).
- Anthropic PBC (United States) — AI processing of documents (extracting information from safety data sheets, analyzing inspection reports, and proposing risk analyses).
When you use an AI feature, the content of the relevant document is sent to the AI provider solely to perform that specific processing task. Under the provider’s commercial terms, this data is not used to train AI models and is retained for only a limited period after processing. The provider is established outside the European Economic Area, so the transfer is based on appropriate safeguards (see section 5). If you do not use the AI features, no documents are sent to the AI provider. AI provides assistance: it makes suggestions and completes fields, but a person reviews and decides.
preveTEx uses no analytics, tracking, or marketing services and sets no third-party cookies. See the cookie statement.
5. Transfers outside the EEA
preveTEx aims to keep processing within the European Economic Area. If data is nevertheless transferred outside the EEA (for example, for AI processing by Anthropic in the United States), the transfer is based on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.
6. Retention periods
Account data is retained for as long as your organization uses preveTEx, and for up to three months afterwards, unless a longer statutory retention period applies. Occupational well-being data is subject to the statutory retention periods applicable to the customer organization. Some are lengthy and mandatory, such as 10 years for occupational accident record cards and up to 40 years after the end of exposure for lists of exposure to carcinogenic substances. An overview is available in the retention periods guide in the application.
7. Your rights
You have rights of access, rectification, erasure, restriction, data portability, and objection. You can exercise these rights via info@prevetex.com for account data, or through your employer for occupational well-being data.
Important: an erasure request cannot remove data that is subject to a statutory retention obligation. Statutory records — including occupational accident record cards (10 years), CMR exposure lists (up to 40 years), and health surveillance lists (5 years) — are retained for as long as the law requires, even after an erasure request.
If you disagree with how your data is processed, you may lodge a complaint with the Belgian Data Protection Authority (Drukpersstraat 35, 1000 Brussels — gegevensbeschermingsautoriteit.be).
8. Changes
preveTEx may amend this statement. The date at the top shows the latest revision. We will actively notify you of material changes.