Privacy policy

Who is responsible

Bella Rosa Beauty Studio is the data controller for information processed through this website and in the salon. Our contact details and Chamber of Commerce number appear in the footer of every page and on the contact page.

What data we process

When you book an appointment we process your name, email address and phone number. If we ask you to complete a patch test or consultation, we also record information relevant to the treatment — for example a previous allergic reaction or a skin condition.

That treatment information is special category data under the GDPR, because it can say something about your health. We therefore process it only with your explicit consent, and only to the extent needed for a safe treatment.

We also process technical data such as your IP address and browser type when you visit our website, but only through cookies you have consented to — see our cookie policy.

Why we process it

We process your data to schedule and confirm your appointment (performance of a contract), to remind you of an appointment and to inform you about treatments you've had before (legitimate interest), to meet our accounting and retention obligations (legal obligation), and — only with your separate, explicit consent — to send you newsletters or offers.

For treatments covered by the Dutch Wkkgz, such as laser treatments, we record a treatment agreement and relevant treatment details. This is a legal requirement.

How long we keep it

We keep financial records for seven years, as the Dutch Tax Administration requires. Treatment records we generally keep for up to fifteen years after the last treatment, in line with the applicable retention period for treatment-related files. For clients who visit once and don't return, we delete their data after two years unless there is a legal reason to keep it longer.

Marketing and WhatsApp

We only send you commercial messages — email, WhatsApp or SMS — if you have given separate consent for that. Consent is not a condition of making an appointment, and you can withdraw it at any time.

Your appointment confirmation and reminders are sent on the basis of the contract, not marketing consent. So you can't opt out of those when you book; they are part of the service.

Sharing with others

We share your data with parties that help us run the salon: our booking and diary software, our email provider and our accountant. We have data processing agreements in place with all of them. Data is never sold, and never used for third-party advertising.

Where we have data processed outside the European Economic Area, we ensure appropriate safeguards such as the European Commission's standard contractual clauses.

Your rights

You have the right to access, correct or delete your data. You can object to processing, restrict it, and take data you provided yourself to another provider. You can withdraw consent at any time.

Send your request to the email address in the footer of this page. We respond within one month. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

We take appropriate technical and organisational measures to protect your data: encrypted connections, restricted access to treatment records, and a breach notification procedure. In the event of a breach posing a risk to your rights, we report it to the Dutch Data Protection Authority within 72 hours and inform you where required.