Privacy
Statement
1.Who we are, and what this statement covers
Charisma Clinic is an all-round beauty salon in Tilburg. We provide skin and laser treatments and we also run beautician training courses. This privacy statement explains which personal data we process when you book an appointment, contact us, visit our website or follow one of our courses — why we do so, how long we keep the data and what rights you have.
- Data controller
- Charisma Clinic, Korvelseweg 129, 5025 KX Tilburg, the Netherlands
- Chamber of Commerce number
- [TODO: fill in the Chamber of Commerce (KvK) number]
- Phone
- +31 6 10 39 06 32
- [email protected]
We are not required to appoint a data protection officer and have not appointed one. You can address any privacy question to [email protected].
2.Which personal data do we process?
Appointment and treatment
- First and last name
- E-mail address and phone number
- Chosen treatment, date and time
- Notes from the intake and the treatment
- Payment and invoicing details
Contact and website
- Name, e-mail address and phone number
- The content of your message
- IP address and technical log data
- Your language choice and your cookie choice
Training (academy)
- Name, address and date of birth
- E-mail address and phone number
- Study progress and attendance
- Exam results and evaluations
- Payment status and invoicing details
Data about your health
Some of our treatments — acne treatments, laser hair removal or a skin-improvement programme, for example — say something about your skin and your health. What you tell us during the intake about skin type, medication, allergies, pregnancy or other contra-indications, and what we record in your treatment file, may therefore be special category health data within the meaning of Article 9 GDPR. We process that data only in so far as it is needed to carry out your treatment safely and responsibly, and only with your explicit consent (Article 9(2)(a) GDPR). You are never obliged to share this information, but without it we cannot safely perform certain treatments. We do not process biometric data.
3.Purposes and legal bases
For each purpose we explain why we process data and which legal basis under the GDPR we rely on.
Booking an online appointment through our calendar (Salonized)
Legal basis: Performance of the contract — Art. 6(1)(b) GDPR
Carrying out the treatment and keeping a treatment file
Legal basis: Performance of the contract (Art. 6(1)(b)) and, for health data, your explicit consent (Art. 9(2)(a))
Answering questions sent through the contact form, e-mail, phone or WhatsApp
Legal basis: Legitimate interest in being able to answer your question — Art. 6(1)(f) GDPR
Invoicing, payment and financial administration
Legal basis: Performance of the contract (Art. 6(1)(b)) and statutory retention obligation (Art. 6(1)(c))
Enrolment, teaching, examination and certification within our training programme
Legal basis: Performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c))
Securing the website and preventing abuse of the contact form
Legal basis: Legitimate interest in a secure website — Art. 6(1)(f) GDPR
Loading third-party services that place cookies, such as the Salonized booking module
Legal basis: Your consent — Art. 11.7a Dutch Telecommunications Act and Art. 6(1)(a) GDPR
Photographs of treatment results, reviews and promotion
Legal basis: Your consent — Art. 6(1)(a) GDPR, and Art. 9(2)(a) where visible skin imagery is involved
4.The legal bases in short
We process data on the basis of:
- Performance of the contract
- Legal obligation
- Explicit consent (health data, photographs, reviews, cookies)
- Legitimate interest
5.Retention periods
Once the retention period has passed, data is securely deleted or destroyed.
6.Processors and other recipients
We never sell your personal data and we do not make it available for other parties' commercial purposes. We do use third parties that process data on our instructions. With those parties we conclude a data processing agreement, as required by Article 28 GDPR.
Salonized
Online appointment system. The calendar on our booking page is a window onto Salonized.
Receives: Your first and last name, e-mail address, phone number, the chosen treatment, the chosen time slot and any remarks. This data goes directly from your browser to Salonized and does not pass through our own web server. Salonized also places its own cookies, which is why the calendar is only loaded after you have given consent.
Data processing agreement: [TODO: confirm that a data processing agreement with Salonized has been signed and fill in the date]
Resend (Plus Five Five, Inc., United States)
Sends contact form messages as an e-mail to [email protected]. Your message goes from your browser to our own web server, which passes it on through Resend; our website does not store the message itself.
Receives: Your name, e-mail address, phone number (if you fill it in) and the content of your message. Your e-mail address is included as the reply-to address so that we can answer you directly. Resend stores this data in the United States.
Data processing agreement: According to Resend, a data processing agreement (Data Processing Addendum) under Article 28 GDPR applies automatically to every Resend account.
Our e-mail provider
Handles our business e-mail, including the [email protected] mailbox where contact form messages arrive.
Receives: Your name, e-mail address, phone number and the content of your message.
Data processing agreement: [TODO: fill in the name of the e-mail provider and the status of the data processing agreement]
Our hosting provider
Runs this website and its servers.
Receives: Technical log data, including visitors' IP addresses.
Data processing agreement: [TODO: fill in the name of the hosting provider and the status of the data processing agreement]
Google Maps (Google Ireland Limited)
The map on our contact page is supplied by Google.
Receives: When that map loads, Google receives your IP address and details about your browser and device. The map is only loaded after you have given your consent; until then we show only our address as text, with a link you can choose to open yourself.
Data processing agreement: Google acts here as an independent controller; please refer to Google's own privacy policy.
Our bookkeeper / accountancy firm
Handles our financial administration and tax returns.
Receives: Invoicing and payment details.
Data processing agreement: [TODO: fill in the name of the accountancy firm and the status of the data processing agreement]
Examination body (training programme only)
Administers exams and issues diplomas.
Receives: Students' names, dates of birth and exam results.
Data processing agreement: [TODO: fill in the name of the examination body and the status of the data processing agreement]
Transfers outside the European Economic Area
Resend (Plus Five Five, Inc.) stores the data of sent e-mails, including the messages from our contact form, in the United States. According to Resend, this transfer is based on the European Commission's standard contractual clauses, which are included in Resend's data processing agreement, and in addition on Resend's participation in the EU-U.S. Data Privacy Framework. [TODO: check whether any of the other parties above processes personal data outside the EEA and, if so, state the safeguard relied on.]
7.Security
We take appropriate technical and organisational measures to protect your data against loss, theft and unauthorised access.
- This website is only reachable over an encrypted HTTPS connection.
- Access to customer and student data is limited to staff who need it.
- Accounts are protected with personal passwords.
- Paper files are kept locked away.
- In the event of a data breach that poses a risk to you, we report it to the Dutch Data Protection Authority within 72 hours and inform you where the law requires it.
8.Cookies
We use no analytics, advertising or tracking cookies. There is no Google Analytics, no Google Tag Manager and no Meta pixel on this website. The cookie we place ourselves is strictly necessary to make the website work; under article 11.7a(3) of the Dutch Telecommunications Act no consent is required for it. We do ask for your consent for the Salonized booking module and for the Google Maps map, because those components send data to a third party.
| Name | Purpose | Retention |
|---|---|---|
| NEXT_LOCALE | Remembers which language you want to see the website in. | 12 months |
| charisma:cookie-consent (local storage) | Stores, per component, your choice to load or not load the third-party booking module and the map. Stays in your own browser. | 12 months |
| Salonized cookies | Only placed after you have accepted the booking module; Salonized uses them to make the booking process work. | [TODO: request and fill in the retention periods of the Salonized cookies] |
| Google Maps cookies | Only placed after you have accepted the map; Google uses them to display the map and remember preferences. | [TODO: request and fill in the retention periods of the Google Maps cookies] |
Change your cookie choice
You can change your choice per component at any time. Withdrawing is exactly as easy as accepting.
Online booking calendar (Salonized)Your current choice: —
Map (Google Maps)Your current choice: —
9.Photographs and imagery
We only use photographs of customers or students — including before-and-after treatment photographs — where you have given prior explicit written consent. You may withdraw that consent at any time; we will then remove the imagery from our own channels as quickly as is reasonably possible.
10. Your rights
Under the GDPR you have the following rights:
- The right of access to the data we process about you
- The right to rectification of inaccurate or incomplete data
- The right to erasure (the right to be forgotten)
- The right to restriction of processing
- The right to data portability
- The right to object to processing based on legitimate interest
- The right to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal
Submit your request via:
[email protected]We respond within one month. To avoid handing data to the wrong person we may ask you to identify yourself. Some data we are legally required to keep; in that case we cannot fully carry out an erasure request and we will explain why.
11. Complaints
12. Changes: We may amend this privacy statement, for instance when we start using a different service provider. The most recent version is always published on this page.