Saloon Privacy Statement

This is a translation of the Dutch "Privacyverklaring Saloon". Where the two differ, the Dutch text prevails.

In short

• Saloon makes the back office for salons (mijn.saloon.nl), the website Saloon.nl and the app; this statement tells you what we do with your personal data along the way.
• If you are a salon's customer, the salon decides what is kept about you; we process that data only on the salon's behalf, and for your rights you go to the salon.
• We are responsible ourselves for your account with Saloon, your reviews, our newsletter, the contact form and the accounts of salons and their users.
• We do not sell your data and we measure nothing with cookies ourselves. Only on the pages of a salon that has set it up does that salon measure with Google Analytics or the Meta Pixel, and only if you consent to it.
• Some parties outside the European Economic Area receive data, Google among them; article 12 says which and on what basis.
• You can see, correct, take along or have your data deleted: much of that you do yourself in your account, the rest you ask for at [not known yet].

This is a summary; the articles below are binding.

1. Who we are

1.1 This privacy statement is that of [not known yet], [not known yet], trading as Saloon, established at [not known yet], [not known yet] [not known yet], Nederland, registered with the Dutch Chamber of Commerce under number [not known yet]. In this statement we are called Saloon or we.

1.2 In this statement:

• the platform means the back office, the website and the app together;
• the back office means mijn.saloon.nl, where salons keep their calendar, customers, till and team;
• the website means Saloon.nl, with the salons' pages, online booking, the waitlist, reviews, accounts with Saloon, the newsletter and the contact form;
• the app means Saloon's customer app, a web app you can put on your phone;
• the salon means a business that uses the platform, such as a hairdresser, beauty salon or massage practice;
• user means anybody with a login at a salon, such as the owner and the staff;
• customer means a salon's customer;
• account with Saloon means the account a consumer signs in with on the website.

1.3 If you have a question about privacy, or want to use one of your rights (article 17), e-mail [not known yet]. We have not appointed a data protection officer; your question goes straight to the people at Saloon who deal with privacy.

1.4 This statement follows the General Data Protection Regulation (GDPR). Two of its terms come back often:

• the controller decides why and how personal data is used, and is the one you can turn to;
• a processor uses personal data only on someone else's behalf, never for itself.

1.5 We use personal data only where the law recognises a ground for it (article 6(1) GDPR). For each use, this statement names which:

• consent (a): you chose it yourself, and you can always withdraw that choice;
• contract (b): it is needed to provide what you take from us or ask us for, such as your account;
• legal obligation (c): the law requires it;
• legitimate interest (f): we or someone else have a good reason for it, and it outweighs your interest. We always say which interest that is. You may always object to it (article 17).

2. Our two roles

2.1 For part of the data we are the controller. That is: your account with Saloon, the reviews we publish, the salons' pages on the website, visits to the website and the app, the newsletter, the contact form, users' accounts, the salon as our own customer, and the logs we use to secure the platform. For that data, you can come to us.

2.2 For the data a salon keeps in the back office, the salon is the controller and we are its processor. This is the salon's customers, their appointments, purchases, notes, allergies, files and messages, and the salon's staff and suppliers. The salon decides what it records and why; we store and process it only for the salon, under the data processing agreement we have with every salon.

2.3 Are you a salon's customer? Then the salon is responsible for what it keeps about you: your contact details, your appointments and purchases, notes, forms you fill in for the salon, and sometimes data about your health, such as an allergy or the result of an allergy test. The salon decides why it holds that data and how long it keeps it. The salon may record health data only with your explicit consent or on another ground the law allows for it. We do not use the data a salon keeps about you for ourselves. If you want to see it, have it corrected or deleted, or have a question or complaint about what the salon does with your data, go to the salon. If such a request reaches us, we pass it on to the salon without undue delay and let you know we have done so.

2.4 If you book an appointment through the website, we pass your details to the salon (article 4). Once the appointment is in the salon's calendar, it is the salon's data and article 2.3 applies. Your account with Saloon remains yours and ours: we are responsible for it (article 5).

2.5 We publish reviews ourselves on the website; we are responsible for that. The salon reads your review in the back office and can reply to it (article 6).

3. Visitors of the website and the app

3.1 What our servers see. When you visit the website, the app or the back office, our servers receive your IP address, which page or function you request and when. We use that to keep the platform safe and working: to recognise abuse and attacks, to limit the number of requests per visitor and to track down faults. Ground: legitimate interest (a safe platform that works). We keep logs for 30 days. The counters with which we limit the number of requests or sign-in attempts disappear by themselves once their period is over: after a few minutes up to three months at most.

3.2 Error reports. When something goes wrong, the platform sends an error report to Sentry, a service that stores the report in the European Union. Such a report contains technical details of the error, the page where it happened and data derived from your IP address. When you work in the back office, the report also carries the identifier (the id) of your account and of the salon and location you were working in; when it happens on a salon's pages, the address of that salon page. Your name or e-mail address never goes along. This lets us find the errors that affect a particular salon. We remove the contents of forms, cookies, search terms in web addresses and sign-in credentials before it is sent. Ground: legitimate interest (finding and fixing errors). We keep error reports for 90 days.

3.3 Cookies and storage in your browser. The website uses a session cookie to keep you signed in and to protect forms. Your browser also stores a salon's position on the map and, while you are booking, the appointment you are making. More on this in article 16 and in the Cookie Statement.

3.4 Content from other parties. Some pages have your browser fetch something from another party. That party then receives your IP address, directly from your browser:

• fonts from Google Fonts, on the salons' pages, on some of the other pages and on the newsletter pages;
• the map on a salon's page: map tiles from OpenStreetMap; if the salon's position is not yet known, your browser looks it up at Nominatim (also OpenStreetMap's) by the salon's address;
• Google reCAPTCHA on the newsletter form and the contact form (articles 7 and 8). reCAPTCHA looks at your IP address and at signals from your browser to judge whether you are a human, and sets cookies to do so;
• sample photos from Unsplash on one of the booking pages.

Ground: legitimate interest (a website that works well and is readable, and forms that are not flooded with spam). These parties are themselves responsible for what they do with your IP address; read their own privacy statements for that.

3.5 The app. You need no account for the app, and the app does not ask for your contact details. Your favourite salons, your language and whether you have already put the app on your home screen are stored by the app on your own device only. The app also stores fonts and images on your device so that it loads faster. If you allow the app to use your location, the app uses it on your device only, to centre the map on your surroundings; your location does not reach us. Your browser does then fetch the map tiles of that area from OpenStreetMap. The app also loads fonts from Google Fonts and sample photos from Unsplash; those parties receive your IP address too. You can withdraw permission for your location at any time in your browser's or phone's settings.

3.6 Measuring on a salon's pages. In the back office a salon can connect its own Google Analytics or Meta Pixel. On that salon's pages on the website (its salon page and booking with that salon) we then first ask you in a cookie notice whether you agree. If you say yes, your browser loads Google Analytics' software (with consent to analytics cookies) or the Meta Pixel's (with consent to marketing cookies). It sends your IP address, details of your browser and device, the address of the page and what you do there to Google or Meta: that you start a booking, that you join the waitlist, and a booked appointment with its treatments and their price. Your name, e-mail address, phone number, note and booking reference never go with it, and nothing is measured on your account, when you manage an appointment, when you write a review or on a preview of a salon page. Basis: your consent.

The salon decides whether to measure, holds the account with Google or Meta and decides what happens to the data there and how long it is kept; the salon is responsible for that, together with Google or Meta. Saloon receives and keeps nothing of what is measured: we put the software only on that salon's pages, and only after your consent. Your own browser keeps your choice, for 6 months; our server does not keep it. You can withdraw your consent at any time through "Cookie settings" at the bottom of the salon's page; the software then no longer loads and we remove its cookies. If you want to know what was measured about you, or want it deleted, ask the salon; you can also come to us and we will help you find your way. More about this, and which cookies these are, is in article 8 of the Cookie Statement.

3.7 How often salons' pages are viewed. Per salon and per day, we count how often its page on the website was viewed and how many visitors reach each step of booking, so we can see where people give up and improve the website. These are counts only: your browser only reports that a page or step was reached, no cookie goes along, your browser keeps nothing for it, and we do not link a count to you or to your IP address. We do not count a preview of a salon page or the booking module on a salon's own website. Ground: legitimate interest (improving our website). We keep a day's counts in our temporary storage for 40 days; after that only as a count in our statistics.

4. Booking an appointment or joining the waitlist

4.1 What data. When you book an appointment through the website, we ask for your first and last name, your e-mail address and your phone number. We also record which treatments you choose, with which team member, on which day and time, whether it is your first visit, your note for the salon and a discount code if you enter one. If you join the waitlist, we also record on which days and at what times you are available. If you are signed in with your account with Saloon, we fill in your details from your account.

4.2 What happens to it. We put your appointment or your place on the waitlist in the salon's calendar, and the salon receives your details. From that moment on it is the salon's data and article 2.3 applies. The salon sends you a confirmation and, if the salon has set this up, reminders (article 10), unless the salon has switched those e-mails off. If a place opens up for the waitlist, you get an e-mail about it, unless the salon has switched that e-mail off. An appointment you book online does not give the salon permission to send you advertising.

4.3 Why. We need this data to make the appointment you ask for. Ground: contract; the appointment is a contract between you and the salon, and we pass on your details on the salon's behalf. With an account with Saloon we link the appointment to your account (article 5).

4.4 Your note. Write in your note only what the salon needs to know for your appointment. What you write there reaches the salon and is then part of the salon's records.

4.5 How long. While you are booking, your browser stores the appointment you are making, with your details and your note. That data disappears from your browser when you close the tab. How long the salon keeps your appointment and your details is for the salon to decide.

4.6 Changing or cancelling your appointment. The confirmation contains a personal link with which you can view, change or cancel your appointment. Anybody who has that link can do so. So do not forward the e-mail.

5. Your account with Saloon

5.1 What data. For your account with Saloon we keep your e-mail address, your first and last name, your phone number, your language, when you accepted the terms and this privacy statement, and the salons your account is linked to. If you fill in your date of birth, we keep it as well; it is optional. We keep your password only as a code from which the password cannot be recovered (a hash). If you sign in with Google, we also keep an identifier of your Google account. For every device on which you are signed in, we keep a session: the device's name and type (for example "Safari · iOS"), the city and country where you signed in, when you last used the session and when it expires. We look up the city and country on our own servers in a database from DB-IP; your IP address does not go to another party for it, and we do not keep it with the session.

5.2 Why. With your account you sign in, book without filling in your details again, and see and manage your appointments at every salon in one place. Ground: contract (the Saloon.nl Terms of Use). We also protect your account: after five failed sign-in attempts we block signing in for 30 minutes and send you an e-mail, and every time you use the account we check that your session is still valid. Ground: legitimate interest (protecting your account against misuse).

5.3 Linking to your details at a salon. A salon keeps its own customer card about you. We link your account to that customer card, but only where it is established that it is you:

• when you have confirmed your e-mail address and the salon has exactly one customer card with that address;
• when you book an appointment while signed in;
• when you open the link in an e-mail about your appointment while signed in, and that appointment is on the same e-mail address as your account.

Once linked, you see your appointments at that salon in your account, and you can choose per salon which messages the salon may send you. Your account and the customer card remain two separate things: the customer card remains the salon's (article 2.3).

5.4 Your date of birth. If you have filled in your date of birth in your account, we put it on your customer card at every linked salon where that card has no date of birth yet. That way the salon can, for instance, congratulate you on your birthday. A date of birth the salon has recorded itself, we do not change. Ground: consent; you choose whether to fill in your date of birth. If you later remove it from your account, it stays on the customer card, because that card is the salon's (article 2.3): ask the salon to remove it there as well.

5.5 Signing in with Google. If you choose "Continue with Google", Google gives us your e-mail address, your name and an identifier of your Google account. We accept only an e-mail address that Google has verified. Google then knows that you sign in to Saloon.nl. You can connect and disconnect Google under your details in your account. Disconnecting is only possible once you have set a password, as you could otherwise no longer sign in. Ground: contract.

5.6 Your devices. On the website you stay signed in on a device until 2 hours after your last click, or until you sign out (the saloon-session cookie in the cookie statement). The keys to your session are held only on the website's server; your browser holds only a session cookie. Under your details you see on which devices you are signed in, with the place and when you last used them. You can sign out one device there, or all other devices at once. If you change your password, we sign out the other devices as well.

5.7 Downloading your data. Under your details you can request a copy of your data. We then e-mail you a link. It works once, for one hour, and only while you are signed in to the same account. You get a ZIP file with an explanation, your account details, your appointments at the linked salons (in JSON and in CSV, which you can open in Excel), the linked salons with your choices for messages, and the devices on which you are signed in, with their place. We create the file at the moment you download it and do not keep it. What a salon keeps about you itself, such as notes, allergies and files, is not in it; you ask the salon for that (article 2.3).

5.8 Deleting your account. You can delete your account yourself under your details. If your account has a password, we ask for it to confirm. We then immediately sign out all your devices, remove the links to salons and anonymise your account: your e-mail address, name, phone number, password and the connection to Google are removed. We then send a confirmation to the e-mail address your account had. The salons keep their own customer card and your appointments with them; they keep those on their own ground. If you want those removed as well, ask the salon.

5.9 How long. We keep your account until you delete it. A registration you do not confirm cannot be used; we delete it after 30 days. We delete a session 30 days after you sign out or after it expires.

5.10 Help from Saloon. Saloon's staff can view your account, the salons it is linked to and your sessions in our own management system, to help you. They can sign out your sessions and send the e-mail confirming your address again. They can never see or set your password. Every time a staff member opens your account or does something, we record who, when and what; we keep that for two years. Ground: contract (your account) and legitimate interest (being able to show what happened to your account).

6. Reviews

6.1 Only after a visit. You can only write a review about an appointment that took place. After your visit you receive a thank-you e-mail from the salon with a personal link. That link works for 90 days. There is no other way to write a review, and you need no account for it.

6.2 What data. We keep your rating (1 to 5 stars), your text if you write one, the date, the appointment the review belongs to and the team member who helped you. The review belongs to the customer card the salon keeps about you.

6.3 What everybody sees. On the salon's page we show your first name with the first letter of your last name, your stars, your text, the date, the team member's name and the salon's public reply. We do not show your e-mail address, your phone number or the details of your appointment. Your stars count towards the average of the salon and of the team member.

6.4 What the salon sees and does. The salon sees your review in the back office, with your customer card, and gets a notification that there is a review. The salon can reply, publicly on the website or to you only, on behalf of the salon or of a team member. You receive a reply by e-mail, unless the salon has switched that e-mail off or you have switched off messages from the salon. The salon cannot change, hide or delete your review.

6.5 Changing and withdrawing. You can change your review until 30 days after posting it. You can always withdraw it: through the link in the thank-you e-mail while it works, and after that by e-mailing [not known yet]. A withdrawn review disappears from the website and from the averages at once, and cannot come back.

6.6 Why. Ground: legitimate interest. Honest reviews by real visitors help other people choose a salon and help the salon improve. That is why we show as little about you as possible, and why you can always withdraw your review.

6.7 How long. A review stays up as long as the salon uses the platform; after that article 18 applies. We no longer use a withdrawn review; we delete it no later than 30 days after it was withdrawn.

7. The newsletter

7.1 What data. If you sign up for the newsletter on the website, we keep your e-mail address, your language, when you signed up and when you confirmed it. Of your IP address and your browser we keep only a code we make from them with a secret key (a hash). That way we do not keep your IP address itself, but we can still recognise misuse of the form.

7.2 Confirm first. After you sign up, we send you an e-mail with a link to confirm. That link works for 48 hours. Only once you have confirmed do we send you the newsletter.

7.3 Why. In the newsletter we tell you about Saloon. The sender is Saloon ([email protected]). Ground: consent. The form is protected by Google reCAPTCHA (article 3.4).

7.4 Unsubscribing. Every e-mail we send you about the newsletter, from the confirmation on, has a link to unsubscribe. If you unsubscribe, we remove your details from the list at once.

7.5 How long. We keep your sign-up until you unsubscribe. We do not use a sign-up you do not confirm; we delete it after 30 days.

8. The contact form

8.1 What data. In the contact form you fill in your name, your e-mail address, the subject and your message, and your phone number if you wish. The form is protected by Google reCAPTCHA (article 3.4).

8.2 What happens to it. The website e-mails your message to our team, with your e-mail address as the address to reply to. The website does not keep your message itself. If sending fails, the website says so, and you can e-mail us directly.

8.3 Why. We use your details to answer your question. Ground: legitimate interest (answering your question), or contract if your question is about a contract with us.

8.4 How long. We keep your message in our mailbox until your question has been dealt with, and then for one year at most, in case you come back to it.

9. Salons and their users

This article is for the owner of a salon and for everybody who works in the back office with a login.

9.1 Your account. For your account we keep your e-mail address, name, phone number, gender, your language and your notification settings, and which salons you belong to, with your role. If you fill in your date of birth, we keep it as well; it is optional, and the salons you work for do not see it through this. We keep your password only as a hash. If you sign in with Google, Google gives us your e-mail address, your name and an identifier of your Google account. What you add to your profile yourself, such as a headline, a text about yourself, languages, interests, links to social media and a photo, we keep as well. Ground: contract (the General Terms for Salons, which also apply to every user).

9.2 The salon as our customer. Of the salon and its owner we keep the business details and the answers you gave when signing up and setting up your salon. We use them to set up the back office for you and to communicate with you about your subscription. Ground: contract.

9.3 Signing in and sessions. For every device on which you are signed in, we keep a session with the device's name and type, the IP address, the city and country, and when you were last active. That way you see in your account where you are signed in and can sign out a device you do not recognise. We look up the city and country on our own servers in a database from DB-IP; your IP address does not go to another party for it. Ground for the sessions: legitimate interest (securing your account and making suspicious sign-ins recognisable). You stay signed in until 7 days after your last use, or until you sign out; we delete a session 30 days after you sign out or last use it; one you marked as a trusted device, after a year without use. After five failed sign-in attempts we block signing in for 30 minutes and send you an e-mail.

9.4 Push notifications. If you allow notifications, we register your device with Google's Firebase Cloud Messaging, which delivers them. A notification may contain a customer's name and the time of an appointment. You can turn notifications off in your settings and in your browser. Ground: contract. We keep the registration as long as you use notifications on that device, and delete it 30 days after you turn them off there.

9.5 The salon's log. What you do in the back office, such as creating an appointment or completing a sale, is recorded in the salon's log: who, what and when. Of a change to someone's details, such as a name, a phone number, a note or an allergy, the log shows the salon only that it changed, not the details themselves. To be able to help the salon, we also keep the details as they were before and after the change. The salon does not see them; only our own staff can look at them, when the salon needs help. We erase them after 30 days. That log is part of the salon's records; the salon is responsible for it. Each entry is kept for two years, and the log is deleted with the salon's other data when the salon stops (article 18.3).

9.6 Invitations. If a salon invites you, the salon enters your name and e-mail address and we send you an invitation on the salon's behalf. The link in it works for one day. If you accept the invitation, you create an account (article 9.1).

9.7 What your employer keeps about you. What the salon keeps about you as a team member, such as your schedule, your absence (sickness included), your turnover and your staff card, is the salon's records; we process it on its behalf (article 2.2). For that data, go to the salon. If the salon puts you on its page on the website, we show your name and your photo there; the salon decides that.

9.8 What else the back office uses. When you type an address, Google Maps completes it; what you type goes to Google for that. In the map with which you point out an address, your browser fetches the map tiles from OpenStreetMap. Your preferences, such as language, display and your last chosen location, are stored by your browser on your own device.

9.9 Doing it yourself. You change your profile, view and sign out your devices, and connect or disconnect Google yourself in your account. There you also request a copy of your data: we e-mail you a link that works once, for one hour, and only while you are signed in to the same account. You get a ZIP file with an explanation, your account details, your devices, your notification settings and the salons you belong to: per salon only its name, since when, whether you are the owner and your role. What a salon keeps about your work is not in it; you ask the salon for that (article 9.7). You also delete your account yourself there (article 18.2).

9.10 How long. We keep your account until you delete it, and the salon's data until the salon stops using the platform. After that article 18 applies.

9.11 Help from Saloon. Saloon's staff can view your account, the salons you belong to with your role, and your sessions in our own management system, to help you or your salon. They can release your sign-in after a lock-out, sign out your sessions and send the e-mail confirming your address again. They can never see or set your password or your PIN. Every time a staff member opens your account or does something, we record who, when and what; we keep that for two years. Ground: contract (your account) and legitimate interest (being able to show what happened to your account).

10. E-mails

10.1 E-mails on the salon's behalf. About your appointment you receive e-mails on the salon's behalf: a confirmation, reminders, a change or cancellation, a message if you did not show up, a thank-you e-mail with the invitation to write a review, a thank-you for a tip, a message about a gift card or a subscription that is ending, messages about the waitlist, and a reply to your review. The sender shows the salon's name, with the address [email protected]. The salon decides which messages it sends. If you no longer want certain messages, tell the salon; with a Saloon.nl account you can also set this yourself per salon (article 5.3).

10.2 Delivery, no opens or clicks. Of the e-mails of article 10.1 we record whether the e-mail was sent and delivered, whether it bounced or was blocked, and whether you reported it as spam or unsubscribed through it. Our sending service Mailjet reports this to us. We do not measure whether you open an e-mail or click a link: our e-mails contain no invisible image and the links go straight to where they point. The same holds for our own e-mails (article 10.3). The salon sees the delivery in the message overview on your customer card, so it knows whether, for example, a reminder arrived. The salon is responsible for this too (article 2.3); the overview is kept as long as the salon keeps your customer card.

10.3 Our own e-mails. We ourselves send e-mails that belong to your account: to confirm your e-mail address, reset your password or change your e-mail address, when your account is blocked after too many sign-in attempts, with the link to your data or to the data of a salon you closed, when your account has been deleted and when a sign-in has put it back. Users also receive invitations and notifications from the back office. These e-mails belong to your account. Ground: contract.

10.4 How we send e-mail. All the platform's e-mails go through Mailjet. Mailjet receives your name, your e-mail address and the content of the e-mail for that.

10.5 Nothing from outside. The platform's e-mails load nothing from other parties: they use the font already on your device, and their images travel inside the e-mail itself. So when your e-mail program shows the e-mail, nobody receives your IP address because of it.

10.6 No advertising. The platform currently sends no advertising on behalf of salons. The platform sends no text or WhatsApp messages. Push notifications go to users only (article 9.4).

11. Who we share data with

11.1 We do not sell personal data. We work with the parties below. Some of them work on our behalf, such as Railway, Cloudflare, Mailjet, Sentry and Firebase. Other parties, such as Google for Fonts and reCAPTCHA, receive your IP address directly from your browser and are themselves responsible for what they do with it. Google Analytics and the Meta Pixel receive data only on the pages of a salon that has connected them, and only after your consent; the salon is responsible for that (article 3.6).

Party	What for	What they receive
Railway	Hosting the platform: servers, database and the website	All data in this statement
Cloudflare	Storing files and photos; hosting the back office and the app; passing on requests	Files and photos; your IP address with every request
Mailjet (Sinch)	Sending all e-mail; reporting delivery, bounces, spam reports and unsubscribes (not opens or clicks)	Name, e-mail address and the content of the e-mail
Sentry	Error reports	Technical details of the error, the page, data derived from your IP address; in the back office the identifiers of your account, salon and location, on a salon's pages the address of that page (article 3.2)
Google: Sign in with Google	Signing in with your Google account	E-mail address, name, identifier of your Google account
Google: Firebase Cloud Messaging	Push notifications to users	Identifier of the device; title and text of the notification
Google: Maps	Completing addresses in the back office	What you type in the address field
Google: reCAPTCHA	Spam protection for the newsletter and the contact form	IP address and signals from your browser; sets cookies
Google: Fonts	Fonts on part of the website and in the app	IP address
Google: Analytics, of a salon	Measuring on the pages of a salon that has connected it, after your consent (article 3.6)	IP address, details of your browser, the page and what you do there; sets cookies
Meta: Pixel, of a salon	Measuring what a salon's advertising brings in, on its pages, after your consent (article 3.6)	IP address, details of your browser, the page and what you do there; sets cookies
OpenStreetMap	Map tiles in the back office, on a salon's page and in the app; looking up a salon's position (Nominatim)	IP address; the salon's address (Nominatim)
Unsplash	Sample photos in the app and on a booking page	IP address

11.2 The salon receives the details you give when booking, on the waitlist or in a review (articles 4 and 6).

11.3 If the law requires us to hand over data, for instance by order of a court, we do so, and no more than necessary. Ground: legal obligation.

12. Data outside the European Economic Area

12.1 Our servers and our database are in the European Union. Even so, some data ends up outside the European Economic Area (EEA):

• Google, Meta, Railway and Unsplash are American companies;
• Cloudflare passes requests through a network with servers all over the world.

12.2 Where data goes on our behalf to a country outside the EEA without an adequate level of protection, we do so only under the EU-US Data Privacy Framework, where the party has joined it, or under the European Commission's standard contractual clauses.

12.3 For Google Fonts, reCAPTCHA, a salon's Google Analytics and Meta Pixel, the map services and Unsplash, your browser fetches something from that party itself; your IP address then goes directly from your browser to them.

13. Security

13.1 We protect personal data with measures that fit what is at stake. The main ones:

• each salon's data is shielded in the software from that of other salons, and within a salon a user's role decides what they may see and do;
• we keep passwords only as a hash (argon2id);
• connections are encrypted;
• we limit the number of sign-in attempts and requests, and on shared devices the back office can be locked with a PIN;
• files are kept in shielded storage per salon;
• we keep personal data out of logs and error reports as far as possible;
• our servers are in the European Union.

13.2 No security is perfect. If you notice something that is not right, e-mail [not known yet].

14. No automated decisions

We take no decisions about you that are made by a computer alone and that have legal effects for you or otherwise affect you significantly. We do not create a profile of you.

15. Minimum age

You can create an account with Saloon or an account for the back office if you are 16 or older.

16. Cookies

16.1 We use only cookies and browser storage that are needed for the platform to work: to keep you signed in, protect forms, remember your preferences and hold on to an appointment while you book. No consent is needed for that. We ourselves use no cookies for statistics or advertising.

16.2 On the newsletter form and the contact form, Google reCAPTCHA sets its own cookies, for spam protection (article 3.4).

16.3 On the pages of a salon that has connected its own Google Analytics or Meta Pixel, Google or Meta set cookies for that salon, but only if you consent to it in the cookie notice (article 3.6).

16.4 Which cookies and storage these are exactly is set out in the Cookie Statement.

17. Your rights

17.1 For the data we are responsible for, you have these rights:

• access: you may know what data we hold about you and what we do with it;
• rectification: if your data is wrong, we correct it;
• erasure: you may ask us to delete your data, except what the law requires us to keep;
• restriction: you may ask us not to use your data for the time being, for instance while we assess an objection;
• portability: you may receive your data in a file a computer can read, to take it with you;
• objection: you may object to use based on legitimate interest; we then stop, unless we have a compelling reason to continue;
• withdrawing consent: if you have given consent, such as for the newsletter, you can always withdraw it.

17.2 Doing it yourself. With an account with Saloon, you change your details yourself, download a copy, delete your account, sign out devices and connect Google (article 5). As a user you change your profile, download a copy of your data, manage your devices, connect Google and delete your account yourself in the back office (articles 9.9 and 18.2). You unsubscribe from the newsletter with the link in every newsletter.

17.3 By e-mail. For everything else, e-mail [not known yet]. To prevent somebody else from requesting your data, we may ask you to confirm that it is you, for instance by replying from the e-mail address we know you by. We answer within one month. If your request is complex or we receive many, it may take two months longer; we then tell you so within the first month. A request costs you nothing.

17.4 A salon's customer. If your request is about what a salon keeps about you, the salon decides on it (article 2.3).

17.5 Complaint. If you are not satisfied with how we handle your data or your request, let us know. You may also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

18. Ending, closing and deleting

18.1 Your account with Saloon. If you delete your account with Saloon, we anonymise it at once (article 5.8).

18.2 Your account as a user. You delete your back-office account yourself, under your login and security settings. You confirm it with your password, or, if you only sign in with Google, with a code we e-mail you. If you own a salon, you first hand it over to another user or close the salon. We then take your account out of the active platform at once: you are signed out everywhere, your devices no longer receive notifications and you no longer belong to any salon. We confirm this by e-mail. Within 30 days you can still change your mind: if you sign in again, your account stays; you no longer belong to a salon by itself, but a salon can invite you again. After those 30 days we permanently delete your personal data or anonymise it so that it can no longer be traced back to you. The salons keep their own record of your work there, without your private details. Your name may remain on receipts you completed at a salon, as part of that salon's financial records (article 18.4).

18.3 A salon that stops. When a salon closes its workspace, it closes at once: the salon's pages go offline and the users can no longer get in. Within 30 days the owner can undo the closure, and until then the owner can ask for an export of the salon's data; while that export is being prepared, we wait with deleting. After that, at the latest 60 days after the end of the agreement, we delete or anonymise the salon's personal data, such as customers, appointments, notes, files and the team.

18.4 Financial data. Under tax law a salon must keep its sales, receipts and payments, with the details on them, for 7 years. We therefore keep that data for the salon, for 7 years. During that time we use it only for that legal obligation and for nothing else. After that we delete or anonymise it.

19. Changes

19.1 We may change this statement, for instance when the platform changes. Every version carries the date on which it takes effect; earlier versions remain readable on the website.

19.2 If we use your data for a new purpose, or give it to a new kind of recipient, we announce that at least 30 days in advance on the website and, if you have an account, by e-mail.