Privacy policy

1. Introduction

Salondesq is a collaboration between Build with Blocks and Clinic Agency. The service is provided by Build with Blocks, Heerbaan 115, 6566 EG Millingen aan de Rijn, Chamber of Commerce (KvK) 85551945, VAT number NL004113143B90. Contact: info@salondesq.nl.

In this privacy policy we explain which personal data we process, why we do so and what rights you have. We comply with the General Data Protection Regulation (GDPR).

2. Two roles

As controller we process data of salons that have an account with us, of visitors to our website and of people who contact us.

As processor we process data of the salon's end customers. The salon determines what happens to that data and is responsible for it. We process that data solely on the instructions of the salon. This privacy policy, together with our terms and conditions, serves as a data processing agreement within the meaning of Article 28 GDPR.

3. What data we process

From salons and their staff:

• name, email address, phone number and job title;
• business details such as company name, address, Chamber of Commerce (KvK) number and VAT number;
• account details, roles and permissions, login history;
• subscription and billing details, payment status;
• photo of the staff member if one is uploaded;
• technical logs such as IP address, time and browser details.

From the salon's end customers (on behalf of the salon):

• name, email address, phone number and, where applicable, address;
• date of birth, only if the salon uses this field;
• appointments, services, staff preferences and appointment history;
• notes that the salon itself records for the customer;
• payment and deposit status, gift vouchers and discount codes;
• communication preferences, messages sent and unsubscribes from marketing.

Salons can fill in note fields themselves. We expressly ask salons not to record special categories of personal data, such as health data, unless there is a valid legal basis for doing so. The salon is responsible for this.

4. Why we process data and on what legal basis

• Performance of the contract: creating and managing the account, providing the software, scheduling appointments, sending confirmations and reminders, invoicing and support.
• Legal obligation: retaining records and invoices under the statutory tax retention obligation.
• Legitimate interest: security, fraud prevention, troubleshooting, improving the service and maintaining the customer relationship.
• Consent: for marketing such as newsletters, birthday emails and review requests to end customers, and for non-essential cookies. Consent can be withdrawn at any time.

5. How long we keep data

• Account details and salon data: for as long as the account is active. After cancellation we keep the data for a maximum of one year, after which it is permanently deleted. A salon can ask us to delete it sooner.
• Invoices and financial records: seven years, under the statutory tax retention obligation.
• Technical logs: a maximum of twelve months.
• Marketing unsubscribes: we keep these for as long as necessary to ensure that someone no longer receives messages.

6. Who we share data with

We do not sell data. We engage the following processors, with whom we have concluded data processing agreements:

• Supabase: database, file storage and server functions, with storage in the European Union (Frankfurt).
• Vercel: hosting of the app and the website.
• Mollie B.V. (Netherlands): handling of subscription payments, deposits and the sale of gift vouchers.
• Resend: sending transactional emails and marketing emails.
• Anthropic: the AI assistant Desqie. Questions that salons ask Desqie and data about their plan and subscription are processed to provide an answer. Salons do not enter end customer data into Desqie.
• Google: retrieving a salon's Google Business Profile and review score, if the salon connects it.
• Clinic Agency: our partner, to the extent necessary for support and the development of the service.

We also share data with our accountant and, where we are legally required to do so, with competent authorities. Some of these parties are based in the United States or may process data there (Vercel, Resend, Anthropic and Google). In those cases we use an appropriate safeguard, such as the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.

7. Security

We take appropriate technical and organisational measures, including encryption of traffic via TLS, access based on roles and permissions, row-level security in the database so that a salon can only access its own data, and password hashing. Encrypted storage and backups are provided by our hosting provider. No security is complete; we do not guarantee that unauthorised access or loss of data will never occur.

In the event of a data breach, we will, where required, notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and inform the salons concerned without undue delay.

8. Sub-processors and instructions

We only engage sub-processors that offer a comparable level of protection. If our sub-processors change, we inform salons in advance so that they can object. We process end customer data solely in accordance with the salon's instructions and provide reasonable cooperation with data subject requests, audits and the assessment of security measures.

9. Your rights

You have the right to:

• access your data and receive a copy;
• have incorrect data corrected;
• have your data deleted;
• have the processing restricted or object to it;
• transfer your data in a commonly used format;
• withdraw consent you have given.

If you are a customer of a salon, please address your request to that salon in the first instance. We forward such requests to the salon concerned. Requests about your own salon account can be sent to info@salondesq.nl. We respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Cookies

We use functional cookies and similar technologies that are needed to log in, remember your session and keep the service working securely. These are essential and are placed without consent. On our website we measure visits with Vercel Web Analytics; this works without cookies and without data that would allow us to identify you personally. We only place analytics or marketing cookies with consent.

Salons can add tracking codes to their booking form themselves. The salon is then itself responsible for asking for consent and for informing end customers about this.

11. Liability

Build with Blocks, trading as Salondesq, and Clinic Agency exclude all liability for damage arising from or related to the use of the service and the processing of data, to the extent permitted by law. As the controller, the salon is itself responsible for the data it records, for the legal basis and consent for doing so, for the messages it has sent and for its communication with its end customers. Where exclusion is not permitted by law, the limitation of liability in our terms and conditions applies, including to our role as processor.

The salon indemnifies us against claims by end customers and against fines and measures imposed by supervisory authorities arising from its instructions, the data it records or the salon's failure to comply with the GDPR.

12. Changes

We may amend this privacy policy. The current version is always available on this page. In the event of significant changes, we will inform salons by email or via a notification in the dashboard.