Privacy Policy

How Pro Beauty World (pbw.life) handles personal data

Last updated: 2026-08-01

1. Who is responsible?

The data controller is Pro Beauty World (pbw.life), a sole proprietorship (eenmanszaak) registered with the Dutch Chamber of Commerce under KvK number 42107799 (VAT ID NL005498975B56). For privacy questions and to exercise your GDPR rights, contact our privacy contact atinfo@pbw.life.

Pro Beauty World has not appointed a data protection officer (DPO). That appointment is mandatory under GDPR Art. 37 for large-scale or systematic monitoring, or for special categories of personal data, neither of which applies here. The privacy contact above handles all privacy questions and requests.

2. What data we process

• Name, email address and phone number (when booking an appointment or requesting an invite).
• Professionals' business details: business name, address, KvK number, contact details (when registering as a professional).
• Booking and appointment data, including the booking statistics described in detail below.
• Technical data such as IP address and browser type, collected by our hosting infrastructure for security and reliability.
• Anonymous, aggregated usage statistics via Plausible (cookieless — see our Cookie Policy).

3. Purposes and legal bases

• Handling and managing appointments and deposits (basis: performance of the contract).
• Sending confirmations and reminders (basis: performance of the contract).
• Limiting no-show losses via booking statistics (basis: legitimate interest — see the section below).
• Improving the platform and understanding usage (basis: legitimate interest; analytics is cookieless and processes no personal data).
• Complying with legal obligations, including the fiscal retention duty (basis: legal obligation).

4. Who processes your data (sub-processors)

We use the following parties, under data processing agreements where required:

• Auth0 (Okta) — identity and authentication.
• Microsoft Azure — cloud infrastructure and storage, and, through Azure Communication Services, delivery of transactional email (confirmations, reminders, verification codes).
• Mollie B.V. (Amsterdam, Netherlands) — processing of deposit payments and of professionals' SaaS subscription payments. Mollie acts as an independent controller for payment data (per the Mollie Partner Agreement).
• Plausible — cookieless, EU-hosted analytics (processes no personal data).
• Sentry (EU region, Frankfurt) — error monitoring. When something in our software fails, Sentry receives a technical report: what broke, the request that triggered it, an IP-derived approximate location, and a pseudonymous account identifier. It never receives your name, e-mail address, phone number or booking contents — those are stripped before the report is sent.
  In your browser, error reporting runs only if you allow error monitoring in the cookie banner — its own choice there, separate from usage statistics; decline it and nothing is sent from your device. On our servers, error reports are processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in keeping the service working and secure — we cannot ask permission for a failure that has already happened, and would not be able to run the platform without knowing about it. You can object to this at any time (see “Your rights” below).

All processors are located in the EU or operate under EU Standard Contractual Clauses (SCCs). [REVIEW: confirm the full list of sub-processors and their country of establishment.]

5. Retention periods

• Personal data on individual bookings is anonymised after 3 years (name / email / phone erased).
• Booking rows are hard-deleted after 7 years — matching the Dutch fiscal retention requirement.
• Booking-statistics counters expire after 24 months of inactivity, or sooner on an erasure request. See the details below.

[REVIEW: finalise retention periods during the legal review.]

6. Your rights

You have the right to access, rectify, erase ("right to be forgotten"), restrict processing, data portability, and object (GDPR Art. 15 through 21). You can exercise these rights via the form further down this page or directly by email to info@pbw.life. You also have the right to lodge a complaint with the DutchAutoriteit Persoonsgegevens.

7. Booking Statistics (Conditional Deposit, Mode C)

Some beauty pros on pbw.life only ask certain clients for a deposit — those with an elevated risk of no-shows. Which clients fall into that group is determined by a simple automated check against their previous booking history.

What we store

We keep four counters per client, keyed against anencrypted (hashed) version of the email address you used to book:

• Total completed bookings (Completed)
• Number of no-shows (NoShow — failed to attend)
• Number of late cancellations(LateCancel — cancelled within 24 hours of the appointment)
• Total bookings considered (the sum of the three above)

We do not store any per-booking detail — not the appointment date, not the pro, not the service, nothing. Just the four aggregate counts and the timestamp of the most recent change.

Why we do this

No-shows are a real cost to beauty pros — a missed slot cannot be re-sold. At the same time, we don't want to make every honest client jump through a deposit. The four counters let a pro set a threshold (e.g. "ask for a deposit when the no-show ratio exceeds X%") and only clients above that threshold see the deposit step.

The legal basis is the pro's legitimate interest(GDPR Art. 6(1)(f)) — the commercial interest in protecting against no-show losses — balanced against your privacy interest. If you wish to object (Art. 21), see below.

How long we keep it

The counters persist as long as you have an active booking history on the platform. They are subject to the same retention cycle as the rest of pbw.life:

• Personally-identifiable fields on individual bookings (name, email, phone) are anonymized after 3 years.
• The booking rows themselves are hard-deleted after 7 years — matching the Dutch fiscal retention requirement.
• The booking-statistics counters are deleted the moment you submit an erasure request (see below) or as part of the same 7-year hard-delete pass.

Right of access (GDPR Art. 15)

You can request your own counters at any time. We email you a 6-digit code to confirm the address belongs to you, and the website then displays the four counters along with the timestamp of the most recent change.

The access page lives atbooking.pbw.life/clientstatsand is also reachable from the booking widget via the "My booking statistics" link. No account is needed — just the email address you booked with.

Contact our privacy contact

For any GDPR right (access, rectification, erasure, restriction, portability, objection — Articles 15 through 21) you can use the form below or emailinfo@pbw.life directly.

Response window: we respond within one month of receiving your request (Art. 12(3) GDPR). For complex or voluminous requests this period may be extended by a further two months; if so, you will be informed within one month of the extension and the reason for it.

Identity verification. To prevent abuse we first send a 6-digit verification code to the email address provided. Where we have reasonable doubts about identity (for example, when the email address does not match anything in our records) we may request additional identification per GDPR Recital 64.

What an erasure request (GDPR Art. 17) actually deletes

We perform a cascaded erasure across: client profiles, booking statistics counters, any active verification codes, and the personal-data fields on your bookings (name, email and phone are anonymised; the booking rows themselves remain for our fiscal records). We confirm the result by email.

Statutory retention. The booking rows themselves (date, service, amount — without your personal data) are retained for up to 7 years per article 52 of the DutchAlgemene Wet inzake Rijksbelastingen (General Tax Act). Only after that period are they finally deleted. Your booking statistics counters auto-expire after 24 months of inactivity even without an erasure request.

Objection (GDPR Art. 21)

If you object to processing on the legitimate-interest basis we erase your booking-statistics counters and ensure they are not re-created from future bookings. Select "Object to processing (Art. 21)" in the form above.

No automated decision-making with legal effect

The deposit check is informational only: even when your statistics exceed the threshold, the pro still manually confirms the booking. There is therefore no automated decision producing legal effects in the sense of GDPR Art. 22.

A data protection impact assessment (DPIA, GDPR Art. 35) has been written for this processing. It has not yet been externally reviewed; a legally-reviewed version will be in place before the first paying customer signs up to the platform. The date of this version is at the top of the page.