Privacy statement

2. Whose data we process

We process data about three groups of people:

• Visitors to our website.
• People who contact us through the contact form, email, phone, WhatsApp or social media.
• Clients who book an appointment and have a consultation or treatment with us.

3. Which data we use, and what for

We collect no more than we need for the purpose you give it to us for. Per situation:

• Booking an appointment (online, by phone, via WhatsApp or at the clinic): your name, email address, phone number, the treatment(s) you chose, date and time, any note you add and the language you use the site in. We use this to schedule and confirm your appointment and to send you a reminder 24 hours in advance. Legal basis: performance of our agreement with you.
• Contact form and messages: your name, email address, optionally your phone number, and your message. We use this to answer your question. Legal basis: our legitimate interest in responding to contact you initiate.
• Client record: your contact details, your appointments and visits, the treatments carried out, the practitioner's notes and your invoices. Legal basis: the agreement and our statutory bookkeeping obligation.
• Consultation and health data: your skin type (Fitzpatrick), hair colour and contraindications such as medication, pregnancy, skin conditions or recent sun exposure. This is special-category data; without it we cannot laser safely. We record it only with your explicit consent, which we ask for and register during the consultation. If you withdraw that consent, we erase this data.
• Photographs of the treatment area: only if you personally agree, we take photos for your record to follow the progress of your treatment. They are visible only to our staff in a restricted environment and are never published or shared without a separate, written consent from you.
• Offers by email: your first name, email address and language, so we can occasionally send existing clients a personal discount. You can object to this right when you book, and every promotional email carries an unsubscribe link. Legal basis: our legitimate interest in informing our own clients about our own treatments (article 11.7 of the Dutch Telecommunications Act); if you request a discount code for an email address yourself, that is your consent.
• Website technology and security: when you book or use the contact form we use your IP address to limit abuse. It is stored hashed (encrypted) straight away and cannot be traced back to you by us. Our hosting provider also keeps technical log files (IP address, time, requested page) for a short time to protect the site. Legal basis: legitimate interest.

4. What we deliberately do not do

A few things you need not expect from us:

• We never sell or rent your data and do not share it with advertisers.
• We use no tracking cookies, advertising pixels or third-party analytics on our website.
• We do not ask for a citizen service number (BSN) and store no payment details; you pay at the clinic.
• We make no decisions about you based on automated processing or profiling.

5. How long we keep your data

We keep data no longer than necessary. Specifically:

• Contact and appointment details: for as long as you are a client. If you ask us to delete them, we anonymise your client record straight away; future appointments then lapse.
• Consultation data, treatment notes and record photographs: for up to five years after your last treatment, so that at a follow-up treatment or a skin reaction we know what was done before. Earlier erasure is always possible at your request; if you withdraw your consent for the consultation data, we erase it immediately.
• Invoices: seven years, the statutory retention period of the Dutch tax authority. After your client details are deleted they remain in our records in anonymised form only.
• Messages sent through the contact form: until your question has been dealt with, and at most one year.
• Unsubscribing from offers: we remember that you unsubscribed for as long as you are a client, so you receive no more promotional email.
• Hashed IP addresses for abuse prevention: a few days at most. Hosting log files: briefly, according to our hosting provider's policy.

6. Who we share data with

We share data only with parties we need in order to deliver our services, and only what they need. We have a data processing agreement with each of our processors; for parties outside the EU the European Commission's standard contractual clauses apply.

• Supabase: our secure database and the restricted storage of record photographs, in a data centre in Frankfurt (EU).
• Vercel: hosting of our website and of online booking.
• Resend: delivery of our emails (confirmations, reminders, invoices and promotional emails).
• Google Maps: the contact page shows a Google map. As soon as it scrolls into view, your browser loads the map from Google, which may process your IP address and set cookies in doing so. Google's privacy policy applies to that.
• WhatsApp (Meta): only if you choose to contact us via WhatsApp. Meta processes the messages under its own terms; from a conversation we keep only what is needed for your appointment or record.
• Public authorities: only where the law requires it, for example the tax authority for our bookkeeping.

7. Cookies

Our website uses only functional cookies that are needed to make the site work. These require no consent, which is why you see no cookie banner here.

• celestia_locale: remembers whether you want to read the site in Dutch or English. Retention: one year.
• Login cookies for the admin area: only for our staff, never for visitors or clients.
• Fonts and images are served from our own website, not through Google or any other external network.
• We set no analytics, tracking or marketing cookies. Only the Google map on the contact page may bring cookies from Google with it (see above).

8. How we protect your data

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Among other things:

• All connections to our website and systems are encrypted (https).
• Your data is held in a secure database in the EU, with strict access rights per component.
• Your record is visible only to staff logged in to our admin area; every staff member has a personal login.
• Record photographs sit in restricted storage without public links; the admin area shows them through short-lived, secured links.
• We store IP addresses only in hashed form; raw IP addresses are not in our database.
• Should a data breach nevertheless occur that poses a risk to you, we report it to the Dutch Data Protection Authority and inform you.

9. Your rights

Under the GDPR you have the following rights:

• Access: to ask which data we hold about you.
• Rectification: to have incorrect or incomplete data corrected.
• Erasure: to have your data deleted, except what we are legally required to keep (such as invoices).
• Restriction and objection: to have processing restricted or to object, for example to offers by email.
• Portability: to receive the data you gave us yourself in a common file format.
• Withdrawal of consent: for example for the consultation data or record photographs, without affecting what was lawfully processed before.

10. Making a request or filing a complaint

Send your request to info@celestiaclinic.nl or call 06 4119 6103. To avoid handing data to the wrong person, we may ask you to identify yourself. We respond within one month.

If you are unhappy with how we handle your data, we would like to hear it from you first. You also always have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

11. Minors

Our treatments and our website are intended for adults. We treat people under 18 only with the written consent of a parent or guardian who attends the consultation. We do not knowingly collect data from children under 16 without their parents' consent; if we find that we have, we delete that data.

12. Changes

We may amend this privacy statement, for example when we start using a new service or supplier. The current version is always on this page, with its version date. In the event of significant changes we inform our clients by email.