Privacy policy — Smilo
Last updated: 22 August 2026
1. Who we are
Smilo is a service operated by ZODAM Invest SARL, Place Norbert Metz 18, L-4239 Esch-sur-Alzette (Luxembourg), VAT LU33844163 ("we", "Smilo"). We connect Belgian patients with dental practices using our management software.
2. Data we collect
On the public smilo.be directory we collect only what is strictly necessary:
- Your geolocation (only if you click "Near me");
- After you consent, audience measurements through Smilo's internal counter and Google Analytics: public page viewed, language, campaign and referring domain. Business URL parameters and the full referring URL are never sent to Google; advertising features are disabled;
- The contact details and information you voluntarily submit through an appointment request, waiting list or practitioner registration;
- A versioned consent record and pseudonymised technical identifiers (cryptographic fingerprints of the IP address and browser) to prevent abuse and evidence consent;
- A local technical choice in your browser to remember your audience-measurement preference for twelve months.
3. Legal basis
Consent (Art. 6.1.a GDPR), legitimate interest (Art. 6.1.f), contract performance (Art. 6.1.b).
4. Your rights
Under GDPR: access, rectification, erasure, restriction, objection, portability. Complaint: Belgian Data Protection Authority.
DPO contact: info@smilo.be
5. Retention
- Requests sent to a non-member practice: 30 days if unhandled and 90 days after acceptance;
- Waiting list: the confirmation link expires after 24 hours, and an expired temporary request is deleted after a one-day grace period. Once confirmed, the practice entry expires after 90 days; the public confirmation receipt is deleted after 7 days;
- Practitioner registrations: the confirmation link expires after 24 hours; an unconfirmed request remains visible to the team for 30 days after expiry so the link can be resent or the address checked manually. A confirmed pending request is retained for 180 days, and a rejected or blocked request for 90 days. An approved registration follows the lifetime of the active directory listing;
- Pseudonymised anti-abuse counters: short technical retention followed by daily deletion;
- Consent-based audience measurements: 13 months. Local consent preference: 12 months.
6. Cookies
The directory uses no advertising cookies. The Smilo counter and Google Analytics remain entirely disabled until you accept them. After consent, Google Analytics may set an audience-measurement cookie for up to thirteen months. Advertising and personalisation signals are disabled. Accept and decline are presented equally, and you may withdraw consent at any time.
7. Security
HTTPS only. EU-based servers.