Legal

Privacy statement.

Last updated on 22 September 2026

This is a translation of the Dutch original. If the Dutch and English texts differ, the Dutch text prevails.

Salon Maria processes clients' personal data. This statement sets out which data that is, why it is processed, how long it is kept and what rights you have. In doing so, Salon Maria complies with the General Data Protection Regulation (GDPR).

1. Who is responsible

Salon Maria, based at Albardastraat 41, 1505 WT Zaandam, is the controller. For questions about your data you can reach Maria Boersma on 06 21 27 03 34 or maria74boersma@hotmail.com.

2. Which data is processed

• Contact details: your name, telephone number and, if you give it, your email address.
• Appointment details: date, time and type of treatment, and notes about the treatment.
• Health data: only what is necessary to be able to treat you safely, such as diabetes, the use of blood thinners or another medical background that you report yourself. These are special categories of personal data; they are only recorded with your explicit consent and only in so far as that is necessary for the treatment.
• Payment details: what has been paid and how, and in the case of a Tikkie the details that go with it.
• Messages: the content of what you send via WhatsApp, email or the contact form.

The website itself does not collect any visit data: it carries no visitor statistics, advertising script or profiling technique. See also the cookie statement.

3. Why, and on what legal basis

• To make and carry out your appointment. Legal basis: performance of the contract.
• To be able to treat you safely. For health data the legal basis is your explicit consent.
• To stay in contact with you about your appointment or your question. Legal basis: performance of the contract or legitimate interest in providing a good service.
• To comply with tax legislation. Legal basis: legal obligation.

4. How long is data kept

• Data in the accounts, such as invoices and payments, is kept for seven years. That is the statutory tax retention period.
• Client and appointment data is kept for as long as you are a client and afterwards for retention period still to be determined, for example two years after your last treatment.
• Messages are kept for as long as is necessary to deal with your question.
• If you withdraw your consent for the recording of health data, that data is deleted, unless the salon is legally required to keep it.

5. Who gets to see your data

Your data is not sold and is not used for other parties' advertising. It is only shared with parties that are necessary to run the salon:

• The hosting provider of this website (Vercel Inc.). The website itself does not store any data you enter.
• WhatsApp (Meta), if you get in touch via WhatsApp. What you send there is also covered by WhatsApp's privacy policy.
• Resend, the service that delivers messages from the contact form to Salon Maria by email. The message is not kept on this website or in a database; what you send only ends up in Salon Maria's mailbox.
• The email provider with which Maria receives email.
• The booking service Cal.com that the salon uses if you schedule an appointment online.
• The bookkeeper or tax authorities, in so far as that is legally required.

Some of these parties are established outside the European Economic Area, or store data outside it. In that case, transfer only takes place on the basis of a valid transfer mechanism, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How your data is secured

Salon Maria takes appropriate measures to protect your data: the website runs over a secure connection (https), devices and accounts are protected with a password, and paper notes are not left freely accessible. Only Maria has access to your client data.

7. Your rights

You have the right of access to your data, and the right to have it corrected or deleted. You can also ask for the processing to be restricted, object to the processing, receive your data in a commonly used file format, and withdraw consent you have given at any time. The latter has no consequences for what has already been processed before then.

You make a request by email or telephone. To prevent data ending up with the wrong person, Maria may ask you to identify yourself. You will receive an answer within one month.

If you cannot resolve it together, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

8. Changes

This privacy statement may be amended, for example if the way of working changes. The current version is always on this page, with the date of the last change at the top.

This statement has been drawn up for Salon Maria and has not been checked by a lawyer. Have it reviewed before use if you want certainty about its legal soundness.