Introduction
Ruby Pedicure takes the protection of your personal data seriously. This privacy statement explains which data we collect, why, how long we keep it and what rights you have. We process your data carefully and in accordance with the General Data Protection Regulation (GDPR).
Data controller
Ruby Pedicure, Botlek 22, 8032 CE Zwolle, the Netherlands. Email: info@rubypedicure.nl · Phone: +31 6 57 26 95 16.
What data do we collect?
Depending on the service you use, we process the following data:
- Name, address, phone number and email address
- Appointment data: chosen treatment, date and time, notes
- Account data: email address and (encrypted) password, or your account details when you choose to sign in with Google
- Payment data: amount, status and transaction reference (the payment itself is handled by a certified payment provider; we never receive full card or bank details)
- Health data from the intake form (special category data): e.g. blood thinners, allergies, medication and foot complaints — only with your explicit consent and solely for a safe treatment
- Technical data: language preference and strictly necessary cookies (see our cookie statement)
- Anonymous visit statistics: without cookies we keep anonymized statistics (pages viewed, approximate country, device type and referring source) to see how the site performs. This data contains no IP address or anything else that can personally identify you.
Purposes and legal bases
We process your data only for clear purposes, each with a valid legal basis under the GDPR:
- Scheduling and carrying out your appointment and treatment — performance of the contract
- Managing your account and appointment history — performance of the contract
- Processing payments and gift vouchers — performance of the contract and legal (tax) obligation
- Processing health data for a safe treatment — your explicit consent
- Sending confirmations, reminders and service messages — performance of the contract
- Complying with legal obligations (e.g. administration and invoicing) — legal obligation
- Securing and improving the website — legitimate interest
Health data
Health data is special category personal data that enjoys extra protection. We only process it when you complete the intake form and give explicit consent. It is used solely to carry out your treatment safely and responsibly, is accessible only to Ruby and is never shared with third parties for other purposes. You may withdraw your consent at any time.
Please note: Ruby Pedicure is a beauty and pedicure salon, not a medical practice. For medical foot complaints we refer you to your GP, a medical pedicurist or a podotherapist.
Sharing with third parties
We never sell or rent your data. To deliver our service we use carefully selected service providers (processors). We have data processing agreements in place with these parties, and they may only use your data to perform that service on our behalf.
Specifically, the processors we use include: Mollie (online payments), our hosting provider (website hosting), our email provider (sending confirmation and reminder emails), Resend (newsletter management, only if you subscribe) and Plausible (privacy-friendly, cookieless website statistics). If you sign in with Google or contact us via WhatsApp, your data is processed by Google and Meta respectively under their own privacy policies.
Your data is processed within the European Union in principle. Where data is processed outside the EU, this is done with appropriate safeguards, such as EU standard contractual clauses. We otherwise only share your data when legally required or with your explicit consent.
Retention periods
We do not keep your data longer than necessary for the purposes for which it was collected:
- Appointment and treatment data: while you are a client and up to 2 years after your last appointment
- Intake/health data: while you are a client; you may request earlier deletion
- Invoice and payment data: 7 years (statutory tax retention obligation)
- Account data: until you close your account
- Gift vouchers: until validity expires plus the statutory retention period
Security
We take appropriate technical and organisational measures to protect your data. The website runs entirely over a secure connection (HTTPS). Passwords are stored encrypted (hashed), payments are handled via a certified payment provider, and access to personal data is limited to Ruby. Should a data breach occur despite our measures, we act in accordance with the statutory notification duty.
Your rights
Under the GDPR you have the following rights regarding your personal data:
- Right of access to your data
- Right to rectification (correction) of inaccurate data
- Right to erasure (‘right to be forgotten’)
- Right to restriction of processing
- Right to object to processing
- Right to data portability
- Right to withdraw consent at any time
- You can submit a request via info@rubypedicure.nl. We respond within 30 days. If you are not satisfied, you may lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
Changes
We may update this privacy statement from time to time. The most current version is always on this page. Last updated: 12 June 2026.