Introduction
Ruby Pedicure takes the protection of your personal data seriously. This privacy statement explains which data we collect, why, how long we keep it and what rights you have. We process your data carefully and in accordance with the General Data Protection Regulation (GDPR).
Data controller
Ruby Pedicure, Botlek 22, 8032 CE Zwolle, the Netherlands. Email: info@rubypedicure.nl · Phone: +31 6 57 26 95 16.
What data do we collect?
Depending on the service you use, we process the following data:
- Name, address, phone number and email address
- Appointment data: chosen treatment, date and time, notes
- Account data: email address and (encrypted) password, or your account details when you choose to sign in with Google
- Payment data: amount, status and transaction reference (the payment itself is handled by a certified payment provider; we never receive full card or bank details)
- Health data from the intake form (special category data): e.g. blood thinners, allergies, medication and foot complaints — only with your explicit consent and solely for a safe treatment
- Technical data: language preference and strictly necessary cookies (see our cookie statement)
- Anonymous visit statistics: without cookies we keep anonymized statistics (pages viewed, approximate country, device type and referring source) to see how the site performs. This data contains no IP address or anything else that can personally identify you.
Purposes and legal bases
We process your data only for clear purposes, each with a valid legal basis under the GDPR:
- Scheduling and carrying out your appointment and treatment — performance of the contract
- Managing your account and appointment history — performance of the contract
- Processing payments and gift vouchers — performance of the contract and legal (tax) obligation
- Processing health data for a safe treatment — your explicit consent
- Sending confirmations, reminders and service messages — performance of the contract
- Complying with legal obligations (e.g. administration and invoicing) — legal obligation
- Securing and improving the website — legitimate interest
Health data
Health data is special category personal data that enjoys extra protection. We only process it when you complete the intake form and give explicit consent. It is used solely to carry out your treatment safely and responsibly. You may withdraw your consent at any time.
Who sees your intake form? Only Ruby. The answers can be viewed solely inside the password-protected admin area of this website, which only Ruby can log in to. Nobody else — no staff, no other clients, no outside parties — has access.
Where is it stored? In our secured database on servers within the European Union (Frankfurt, Germany). All traffic is fully encrypted (HTTPS) and your digital signature is additionally stored encrypted (AES-256).
Is it shared? No. Your health data is never sold, rented or used for marketing, and is not shared with our payment, newsletter or analytics providers. It is not even sent by email: when a new intake form arrives, Ruby only receives a notification that one was submitted, without the answers. You can of course request a copy (PDF) of your own form.
Please note: Ruby Pedicure is a beauty and pedicure salon, not a medical practice. For medical foot complaints we refer you to your GP, a medical pedicurist or a podotherapist.
Sharing with third parties
We never sell or rent your data. To deliver our service we use carefully selected service providers (processors). We have data processing agreements in place with these parties, and they may only use your data to perform that service on our behalf.
Specifically, the processors we use include: Mollie (online payments), our hosting provider (website hosting), our email provider (sending confirmation and reminder emails), Resend (newsletter management, only if you subscribe) and Plausible (privacy-friendly, cookieless website statistics). If you sign in with Google or contact us via WhatsApp, your data is processed by Google and Meta respectively under their own privacy policies.
Important: the health data from your intake form is shared with none of these parties. They are needed for payments, email, hosting and statistics — not for your treatment — so they never receive it.
Your data is processed within the European Union in principle. Where data is processed outside the EU, this is done with appropriate safeguards, such as EU standard contractual clauses. We otherwise only share your data when legally required or with your explicit consent.
Retention periods
We do not keep your data longer than necessary for the purposes for which it was collected:
- Appointment and treatment data: while you are a client and up to 2 years after your last appointment
- Intake/health data: while you are a client; you may request earlier deletion
- Invoice and payment data: 7 years (statutory tax retention obligation)
- Account data: until you close your account
- Gift vouchers: until validity expires plus the statutory retention period
Security
We take appropriate technical and organisational measures to protect your data. The website runs entirely over a secure connection (HTTPS). Passwords are stored encrypted (hashed), payments are handled via a certified payment provider, and our database runs on servers within the European Union (Frankfurt, Germany).
Access to personal data is limited to Ruby and goes through the password-protected admin area; only she holds those credentials. Your digital signature on the intake form is additionally stored encrypted (AES-256-GCM). Should a data breach occur despite our measures, we act in accordance with the statutory notification duty.
Your rights
Under the GDPR you have the following rights regarding your personal data:
- Right of access to your data
- Right to rectification (correction) of inaccurate data
- Right to erasure (‘right to be forgotten’)
- Right to restriction of processing
- Right to object to processing
- Right to data portability
- Right to withdraw consent at any time
- You can submit a request via info@rubypedicure.nl. We respond within 30 days. If you are not satisfied, you may lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
Changes
We may update this privacy statement from time to time. The most current version is always on this page. Last updated: 17 September 2026.