Draft text — please have this checked before publishing.
At Opaline Beauty Studio, we handle your personal data carefully and confidentially. This policy explains what data we process, why we do so and what rights you have under the General Data Protection Regulation (GDPR, in Dutch: AVG).
Who is responsible?
The data controller is:
- [OWNER NAME], Opaline Beauty Studio
- [ADDRESS], Almere
- Email: [EMAIL]
- Chamber of Commerce (KvK) number: [KVK]
What data do we process?
- Contact details: name, email address and (optionally) phone number.
- Booking data: chosen treatment, date and time, and your appointment history.
- Messages: what you send us via the contact form, email, phone or WhatsApp.
- Intake and skin/health information: for example skin type, skin conditions, allergies, medication or pregnancy.
- Website usage: only if you consent to analytics cookies (see our Cookie Policy).
Special category data
Under the GDPR, health data is special category data. We only process it with your explicit consent and solely to carry out your treatment safely and responsibly. You can withdraw this consent at any time; please note that we may then be unable to perform a treatment safely.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Scheduling, confirming and carrying out appointments | Performance of a contract |
| Treating you safely based on your intake | Explicit consent |
| Answering your questions via form, email or WhatsApp | Performance of a contract or legitimate interest |
| Accounts and tax returns | Legal obligation |
| Website statistics (Google Analytics) | Consent |
How long do we keep your data?
We do not keep your data longer than necessary:
- Contact and booking data: [RETENTION PERIOD]
- Intake and health information: [RETENTION PERIOD]
- Contact form messages: [RETENTION PERIOD]
- Financial records: [RETENTION PERIOD / statutory tax retention obligation — CHECK]
Who do we share data with?
We never sell your data. We only use providers that are needed to deliver our services (processors):
- IONOS (IONOS SE, Germany) — hosting of our website on a server in Germany.
- Formward (EGF Fastighetsservice AB, Sweden) — processing of contact form submissions (name, email, optional phone number, message and consent). The data is stored in Sweden.
- [BOOKING TOOL NAME] — online booking. This provider has its own privacy policy.
- Google Analytics 4 — only if you consent to analytics cookies.
- [EMAIL PROVIDER NAME] — our email communication.
If you contact us via WhatsApp, your data is also processed by WhatsApp (Meta) under WhatsApp’s privacy policy. The map on our contact page is only loaded from OpenStreetMap after you click “Load map”; your IP address is then sent to OpenStreetMap.
Some providers may process data outside the European Economic Area. This only happens with appropriate safeguards, such as standard contractual clauses approved by the European Commission. [CHECK]
Our fonts are hosted on our own server; no requests are sent to Google Fonts.
Your rights
You have the right to:
- access your data;
- have incorrect data rectified;
- have your data erased;
- restrict processing;
- receive your data in a portable format (data portability);
- object to processing;
- withdraw your consent at any time.
Please send your request to [EMAIL]. We will respond within one month and may ask you to confirm your identity.
Making a complaint
If you are not happy with how we handle your data, please contact us first so we can try to resolve it together. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Security
We take appropriate technical and organisational measures to protect your data, such as a secure (HTTPS) connection, access to data only for those who need it and [TODO: e.g. secure storage of intake forms].
Changes
We may update this privacy policy. The latest version is always available on this page; the date at the top shows when it was last updated.