Privacy Policy

1. Who are we?

Wellness, Coaching & Massage Sandra is a massage practice located in Tiel.

• Business name: Wellness, Coaching & Massage Sandra
• Address: Oude Medelsestraat 2, 4005 EK Tiel
• Phone: 06-14984438
• Email: relax@coachingandwellnessbysandra.com
• Website: coachingandwellnessbysandra.com
• Chamber of Commerce: 30236656

2. What personal data do we collect?

We process the following personal data when you use our services:

When booking an appointment:

• First and last name
• Email address
• Phone number
• Any health complaints or special circumstances (only if you provide them yourself)

When creating an account:

• First and last name
• Email address
• Password (stored encrypted)
• Date of birth (for a birthday gift)
• Gender (to better tailor the treatment)

When placing a shop order:

• First and last name
• Email address
• Phone number
• Delivery address (for shipping)
• Payment details (processed by Mollie, not stored by us)

When using the chatbot (ZEN):

• Chat messages you send
• Email address (only if you provide it yourself)

Automatically collected:

• IP address
• Browser type and version
• Pages visited and click behaviour (only with your consent via cookies)

3. Why do we collect this data?

We process your personal data for the following purposes:

• Service delivery: Scheduling and performing treatments
• Communication: Sending appointment confirmations, reminders and invoices
• Shop: Processing orders and payments
• Account: Managing your personal account, balance and appointment history
• Improvement: Improving our website and services
• Legal obligation: Meeting administrative and tax obligations

4. Legal basis for processing

We process your data based on:

• Performance of a contract: For delivering treatments and products
• Consent: For sending newsletters
• Legitimate interest: For improving our services
• Legal obligation: For tax administration

5. How long do we retain your data?

• Client data: As long as you are a client, plus a maximum of 2 years after last contact
• Invoice data: 7 years (legal retention obligation)
• Chat conversations: Maximum 1 year
• Account data: Until you delete your account
• Cookie data: Maximum 12 months

6. Sharing data with third parties

We only share your data with third parties when necessary for our services:

• Mollie: Payment processing (iDEAL, credit card). Mollie is our Payment Service Provider and processes your payment data in accordance with their own privacy policy.
• Supabase: We use Supabase for storing all client data, accounts, appointments, orders and passwords. The database servers are located in the EU (Frankfurt) and data is stored encrypted. Supabase processes exclusively on our behalf and in accordance with a data processing agreement.
• Vercel: Hosting of our website
• OpenAI: Processing of chat messages via our chatbot ZEN. Chat messages are processed in accordance with OpenAI's privacy policy and the Data Processing Addendum. No personal data is shared unless you mention it yourself in the chat conversation.
• Resend: Sending emails (appointment confirmations, reminders)

We never sell your data to third parties. With all external processors (Supabase, Vercel, Mollie, OpenAI, Resend) a data processing agreement (DPA) has been concluded in accordance with GDPR art. 28.

7. Cookies

Our website currently uses only functional cookies. We do not use analytics or marketing cookies and do not place tracking pixels from third parties.

Functional cookies (always active):

• Session cookies for logging in
• Shopping cart storage
• Theme preference (light/dark)
• Cookie preference itself

Should we introduce analytical or marketing cookies in the future, we will always ask for your consent first via the cookie banner.

No external trackers: our website does not load fonts, scripts or images from external CDNs (such as Google Fonts or Google Analytics). All assets are served from our own servers, so your IP address is not shared with third parties.

8. Your rights

Under the GDPR (General Data Protection Regulation) you have the following rights:

• Right of access: You may request which data we hold about you
• Right to rectification: You may have incorrect data corrected
• Right to erasure: You may request deletion of your data
• Right to restriction: You may request restriction of processing
• Right to data portability: You may request your data in a readable format
• Right to object: You may object to the processing
• Right to withdraw consent: You may withdraw previously given consent at any time

To exercise your rights you can contact us via relax@coachingandwellnessbysandra.com or call 06-14984438. We will respond to your request within 30 days.

9. Security

We take the protection of your data seriously and take appropriate measures to prevent misuse, loss and unauthorised access:

• Encrypted connection (HTTPS/SSL)
• Encrypted passwords
• Access security on the database
• Regular security updates
• Periodic review of vulnerabilities in our software dependencies

10. Complaints

Do you have a complaint about how we handle your data? Please contact us first. If we cannot resolve it together, you have the right to file a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl.

11. Changes

We reserve the right to modify this privacy policy. The most current version is always available on this page. In case of significant changes we will inform you by email.