Privacy statement

1Who is responsible for your data?

DuduM Esthetica is the data controller within the meaning of the General Data Protection Regulation (GDPR). This means we determine which data is processed and for what purpose.

DuduM Esthetica is a small studio and is not legally required to appoint a data protection officer. Privacy questions go directly to Dudu.

2In short

We only process the data needed to treat you properly and safely, and to keep our records in order. We never sell your data, we do not use it for advertising and we do not track you across the internet.

• This website sets no cookies of its own and uses no analytics or tracking software. More in our cookie statement.
• There is no contact form on the site: you reach us by phone, WhatsApp, email or the booking system.
• Fonts are loaded from our own server, not via Google Fonts.
• We process your treatment records only with your explicit consent and never share them with third parties.

3When do we process your data?

There are four moments at which we process your personal data:

• When you make an appointment, online or by phone, WhatsApp or email.
• When you come to the studio for an intake or treatment.
• When we invoice you and maintain our records.
• When you visit our website.

Below we describe each moment separately: which data is involved, why we need it and on what legal basis we process it.

4Making an appointment

To schedule an appointment we process your name, phone number, email address, the chosen treatment and the time, plus any note you add yourself.

If you book online, this happens in the booking system Salonized, shown in a frame on our appointment page. Salonized processes your data as a processor on our behalf, solely to schedule your appointment, send you a confirmation and remind you of it by email or text message. Salonized is a Dutch provider. Appointments are automatically passed on from Salonized to Dudu’s Google Calendar, so she has her schedule in one place. This means your name, the chosen treatment and the time, and possibly your phone number, are shared with Google. Within that frame, Salonized may use its own cookies or similar techniques needed to make the booking process work.

The legal basis is the performance of the agreement with you and the steps preceding it (article 6(1)(b) GDPR). Without this data we cannot schedule an appointment.

5Contact by phone, WhatsApp or email

If you get in touch, for example with a question about a treatment or because you are interested in renting the salon chair, we process your name, your phone number or email address and the content of your message, so we can answer your question. Email to us is received and stored on the mail server of our provider Mijndomein.

The legal basis is the performance of the agreement or its preparation (article 6(1)(b) GDPR), and for general questions our legitimate interest in being reachable and handling questions properly (article 6(1)(f) GDPR).

Please note: if you choose WhatsApp, your message travels via the service of WhatsApp Ireland Limited (part of Meta). We have no influence over the data WhatsApp itself processes about that traffic. Prefer email or phone if you would rather avoid this. Please do not share detailed health information via WhatsApp; we prefer to discuss that in the studio.

6Your intake and treatment records (health data)

To treat you safely and effectively, Dudu records information about your skin or scalp: the findings of the analysis, your skin type and condition, complaints, allergies, medication, pregnancy or breastfeeding, contraindications, the treatments performed, the products used and the aftercare advice.

This is data concerning health: a special category of personal data for which the GDPR sets stricter requirements (article 9 GDPR). We process this data solely on the basis of your explicit consent (article 9(2)(a) GDPR), which you give during the intake.

You may withdraw that consent at any time. This does not affect processing that took place before withdrawal. If you withdraw consent, we may no longer be able to treat you responsibly, because we can then no longer assess whether a treatment is safe for you.

This data is not shared with third parties. It is not stored in the booking system and is not used for marketing. Only Dudu has access to it.

7Photographs of treatment results

Sometimes a before-and-after photograph is valuable, for example to follow your progress. Such photographs are also health data.

We take and use these photographs only with your explicit, written consent. You give separate consent for taking the photograph and, where relevant, for publishing it on the website or social media. Consent for one never automatically implies consent for the other.

You can withdraw your consent at any time. We will then remove the photograph from our own channels as quickly as possible. Please bear in mind that material others have already shared or saved may be beyond our reach.

8Invoices and administration

For our bookkeeping we process your name, the treatment purchased, the amount and the payment date.

The legal basis is compliance with a legal obligation (article 6(1)(c) GDPR). Dutch tax law requires us to keep these records for seven years, under article 52 of the Dutch State Taxes Act.

Our bookkeeper or accountant may have access to these records, solely for bookkeeping and tax returns.

9Visiting this website

This website is deliberately built to be lean. We do not measure your behaviour and we do not build a profile of you.

As with any website, the servers of our hosting provider Vercel record standard technical data in log files: your IP address, the time, the page requested, the status code and your browser type. This data is needed to deliver the site, detect faults and prevent abuse. The legal basis is our legitimate interest in a working and secure website (article 6(1)(f) GDPR).

The homepage shows a map indicating where the studio is located. To display it, your browser retrieves two things from external services: the map software from the open-source network jsDelivr and the map imagery from OpenFreeMap, a free mapping service based on OpenStreetMap. Both receive your IP address and browser details, because that is technically necessary to deliver files. They do not set cookies and we receive no data about you from them. Here too the basis is our legitimate interest: clearly showing visitors where to find the studio.

The map is not required to use the site: if you block these services, the rest of the page still works and you simply see the address.

10Cookies and similar techniques

DuduM Esthetica sets no cookies of its own and stores nothing in your browser’s local storage. We use no analytical cookies, no tracking pixels and no advertising networks. That is why this site needs no cookie banner.

The Salonized booking frame on the appointment page may use functional cookies within its own environment that are needed to make booking work. Exactly which techniques are involved and how to manage cookies is explained in our cookie statement.

11Who do we share your data with?

We do not sell your data and we do not pass it on for advertising purposes. We share data only with parties that help us deliver the service, or where the law obliges us to. We conclude a data processing agreement with parties that process data on our behalf.

Your treatment records and result photographs are explicitly excluded from this: we share those with no one.

12Transfers outside the European Economic Area

Wherever possible we choose parties that process data within the European Economic Area (EEA). Salonized and Mijndomein are Dutch providers.

For European users, Google Calendar is provided by Google Ireland Limited. Google may also process data in the United States; Google participates in the EU-US Data Privacy Framework and also uses the European Commission’s standard contractual clauses.

The website is hosted by Vercel Inc., based in the United States. Vercel delivers the site through a worldwide network of servers, so when you visit, your IP address and the technical data in the server log files may be processed in the United States. We do not collect appointment or treatment data through the website itself, so none of that goes to Vercel. Vercel participates in the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision; in addition, Vercel’s data processing agreement includes the European Commission’s standard contractual clauses.

When delivering the map, a file may be served by a server outside the EEA, because these networks operate globally and always use the nearest server. This concerns only your IP address and browser details at the moment of loading, not your appointment or treatment data.

Where a transfer outside the EEA does take place, it is based on the European Commission’s standard contractual clauses or another valid instrument under chapter V of the GDPR. If you would like to know which safeguards apply, email info@dudumesthetica.nl.

13How long do we keep your data?

We do not keep your data longer than necessary for the purpose for which we received it, unless a statutory retention obligation requires longer.

14How do we protect your data?

• The website works exclusively over an encrypted connection (HTTPS).
• Only Dudu has access to treatment records; digital systems are secured with strong passwords and, where available, two-factor authentication.
• Data on paper is kept in a locked place in the studio.
• We deliberately collect as little data as possible, because what we do not record cannot leak.
• If you suspect something is wrong with the security of your data, please tell us immediately. In the event of a data breach we act in accordance with articles 33 and 34 GDPR and report it where necessary to the Dutch Data Protection Authority and to you.

15What rights do you have?

The GDPR gives you a number of rights. You can ask us for:

• Access to the data we process about you (article 15 GDPR).
• Rectification of data that is incorrect or incomplete (article 16 GDPR).
• Erasure of your data, insofar as we are not legally required to keep it (article 17 GDPR).
• Restriction of processing, for example while a correction is pending (article 18 GDPR).
• Portability of the data you provided yourself, in a common file format (article 20 GDPR).
• Objection to processing based on our legitimate interest (article 21 GDPR).
• Withdrawal of your consent, at any time and without giving reasons.

Send a request to info@dudumesthetica.nl or simply raise it in the studio. We respond within one month. To prevent us handing data to the wrong person, we may ask you to identify yourself.

If you disagree with how we handle your data, we would like to hear it from you first so we can put it right. You also always have the right to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch supervisory authority (autoriteitpersoonsgegevens.nl).

16Minors

If you are under sixteen, we only process your data with the consent of your parent or legal guardian, who is preferably also present at the intake.

If you suspect we hold data about a minor without such consent, please contact us and we will delete it.

17What we do not do

• We never sell or rent your data to third parties.
• We do not send newsletters and do not use your data for advertising, unless you explicitly ask us to.
• We do not track you across other websites and do not build profiles.
• We do not make decisions about you based on automated processing or profiling.
• We do not place advertising or analytics cookies.

18Changes to this statement

If anything changes in the way we handle data, for example because we start using a new system, we will update this statement. The version number and the date of the most recent change are always shown at the top.

Any questions after reading this? Feel free to get in touch via info@dudumesthetica.nl or +31 6 42 48 88 01.