Privacy Policy

How Pro Beauty World (pbw.life) handles personal data

Last updated: 2026-10-24

1. Who is responsible?

The data controller is Pro Beauty World (pbw.life), a sole proprietorship (eenmanszaak) registered with the Dutch Chamber of Commerce under KvK number 42107799 (VAT ID NL005498975B56), registered address Ronsseweg 115, 2803 ZS Gouda, the Netherlands. For privacy questions and to exercise your GDPR rights, contact our privacy contact atinfo@pbw.life.

Pro Beauty World has not appointed a data protection officer (DPO). That appointment is mandatory under GDPR Art. 37 for large-scale or systematic monitoring, or for special categories of personal data, neither of which applies here. The privacy contact above handles all privacy questions and requests.

On pbw.life there are two roles:

• The studio (salon or independent specialist) is the controller for its own client data: your appointments with that studio, your contact details and address for the appointment, and the studio's notes. Pro Beauty World processes that data as aprocessor on the studio's behalf, under theData Processing Agreement. You can ask the studio about that data; we help the studio with it, and you can always contact us as well.
• Pro Beauty World is itself the controller for: your account in the pbw.life app and on app.pbw.life, the booking statistics we keep across all studios (section 7), events (section 8), the AI assistant (section 9), data about prospective customers (section 10), the accounts of studios, specialists and organizers, and this website.

2. What data we process

• Name, email address and phone number (when booking an appointment or requesting an invite).
• Professionals' business details: business name, address, KvK number, contact details (when registering as a professional).
• Booking and appointment data, including the booking statistics described in detail below.
• Technical data such as IP address and browser type, collected by our hosting infrastructure for security and reliability.
• Anonymous, aggregated usage statistics via Plausible (cookieless - see our Cookie Policy).
• The messages you type into our AI assistant, if you use it (see section 9).
• Account data if you create an account in the pbw.life app or on app.pbw.life: name, email address, phone number, saved addresses and your booking history. In the mobile apps also a device code for push notifications.
• Data about beauty professionals we contact ourselves (see section 10).

3. Purposes and legal bases

• Handling and managing appointments and deposits (basis: performance of the contract).
• Sending confirmations and reminders (basis: performance of the contract).
• Creating and managing your account in the apps (basis: performance of the contract).
• Limiting no-show losses via booking statistics kept across all studios (basis: legitimate interest of Pro Beauty World and the studios - see section 7).
• Contacting beauty professionals for whom pbw.life may be relevant (basis: legitimate interest - see section 10).
• Improving the platform and understanding usage (basis: legitimate interest; analytics is cookieless and processes no personal data).
• Answering the questions you ask our AI assistant and keeping its answers correct (basis: legitimate interest - see section 9).
• Complying with legal obligations, including the fiscal retention duty (basis: legal obligation).

4. Who processes your data (sub-processors)

We use the following parties, under data processing agreements where required:

• Auth0 (Okta) - identity and authentication.
• Microsoft Azure - cloud infrastructure and storage; through Azure Communication Services, delivery of transactional email (confirmations, reminders, verification codes); and, through Azure Notification Hubs, sending push notifications to the mobile apps. Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) deliver these push notifications to your device. Push notifications contain no client names.
• Mollie B.V. (Amsterdam, Netherlands) - processing of deposit payments for professionals who chose Mollie, and of professionals' SaaS subscription payments. Mollie acts as an independent controller for payment data (per the Mollie Partner Agreement).
• Stripe Payments Europe, Ltd. (Dublin, Ireland) - processing of deposit payments for professionals who chose Stripe, and of seat payments for events paid online (see section 8). Stripe acts as an independent controller for payment data.
• Plausible - cookieless, EU-hosted analytics (processes no personal data).
• Anthropic Ireland, Limited (Dublin, Ireland; Claude) - generates the answers of our AI assistant from the messages you type into it (see section 9). The messages are processed in the United States under Anthropic's data processing addendum with EU Standard Contractual Clauses, kept for at most 30 days and not used to train its models.
• MongoDB Atlas (MongoDB, Inc.) - database hosting for the platform; the data is stored in the Netherlands (Microsoft Azure, West Europe region).
• Zoho Corporation B.V. (Utrecht, Netherlands) - our business e-mail (info@, support@ and other pbw.life mailboxes), so the messages you send us; stored in Zoho's data centres in the EU.
• Sentry (EU region, Frankfurt) - error monitoring. When something in our software fails, Sentry receives a technical report: what broke, the request that triggered it, an IP-derived approximate location, and a pseudonymous account identifier. It never receives your name, e-mail address, phone number or booking contents - those are stripped before the report is sent.
  In your browser, error reporting runs only if you allow error monitoring in the cookie banner - its own choice there, separate from usage statistics; decline it and nothing is sent from your device. On our servers, error reports are processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in keeping the service working and secure - we cannot ask permission for a failure that has already happened, and would not be able to run the platform without knowing about it. You can object to this at any time (see “Your rights” below).

All data is stored in the European Economic Area (EEA). Some processors (such as Microsoft, Okta, MongoDB and Anthropic) have a parent company in the United States. Access or processing outside the EEA happens only under the EU Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework.

In addition, these parties receive data as independent controllers: the studio you book with (your booking and contact details), the organizer of an event (section 8), and Apple and Google when you download an app from their store.

5. Retention periods

• Appointments with a studio: name, email address and phone number are anonymised 3 years after the booking was made (counted from the date the booking was created, not the date of the visit). The anonymised booking row (date, service, amount) is deleted after 7 years. When the agreement with a studio ends, we delete or return its client data under the Data Processing Agreement.
• Studio notes and tags about a client: deleted 3 years after the client's last booking at that studio.
• Booking statistics: deleted automatically 24 months after the last change, or immediately after an objection or erasure request.
• Accounts of clients, studios, specialists and organizers: as long as the account exists; erased within one month of a deletion request.
• Events: seat bookings as for appointments (anonymised 3 years after the booking was made).
• Our own financial records (subscriptions, event platform fees, payouts): 7 years (Dutch fiscal retention duty, art. 52 of the General Tax Act).
• Server logs: 90 days; security and audit logs 1 year.
• Error reports (Sentry): 90 days.
• AI assistant conversations: 30 days.
• Email with us: as long as needed to handle your question, and no longer than 2 years after the last message.
• Prospective customers: 12 months after the last contact, unless you become a customer (section 10).

6. Your rights

You have the right to access, rectify, erase ("right to be forgotten"), restrict processing, data portability, and object (GDPR Art. 15 through 21). You can exercise these rights via the form further down this page or directly by email to info@pbw.life. You also have the right to lodge a complaint with the DutchAutoriteit Persoonsgegevens.

7. Booking Statistics (Conditional Deposit, Mode C)

Some beauty pros on pbw.life only ask certain clients for a deposit - those with an elevated risk of no-shows. Which clients fall into that group is determined by a simple automated check against their previous booking history.

The counters are kept across all studios on pbw.life: a no-show at one studio counts towards the check at another studio. Pro Beauty World is the controller for this processing.

What we store

We keep four counters per client, keyed against anpseudonymised version (a one-way hash) of the email address you used to book and, if you gave it, of your phone number:

• Total completed bookings (Completed)
• Number of no-shows (NoShow - failed to attend)
• Number of cancellations(LateCancel - every appointment you cancelled)
• Total bookings considered (the sum of the three above)

We do not store any per-booking detail - not the appointment date, not the pro, not the service, nothing. Just the four aggregate counts and the timestamp of the most recent change.

Why we do this

No-shows are a real cost to beauty pros - a missed slot cannot be re-sold. At the same time, we don't want to make every honest client jump through a deposit. The four counters let a pro set a threshold (e.g. "ask for a deposit when the no-show ratio exceeds X%") and only clients above that threshold see the deposit step.

The legal basis is the legitimate interest of Pro Beauty World and the studios (GDPR Art. 6(1)(f)) - limiting no-show losses without asking every client for a deposit - balanced against your privacy interest. We have recorded that balancing test in writing. If you wish to object (Art. 21), see below.

How long we keep it

The counters are deleted automatically 24 months after the last change, or immediately when you object or ask for erasure (see below).

Right of access (GDPR Art. 15)

You can request your own counters at any time. We email you a 6-digit code to confirm the address belongs to you, and the website then displays the four counters along with the timestamp of the most recent change.

The access page lives atbooking.pbw.life/clientstatsand is also reachable from the booking widget via the "My booking statistics" link. No account is needed - just the email address you booked with.

8. Events (group sessions)

Organizers can offer group events through pbw.life with a minimum number of participants and a decision deadline. See theEvent terms for participants.

• What data: when you book a seat, your name, email address, phone number (if you give it), language, number of seats, your payment status with Stripe's payment references and the version of the terms you accepted. From organizers: business details and the link to their Stripe account.
• Purposes and legal bases: handling your booking, counting the seats at the decision deadline, telling you about confirmation or cancellation, refunds and payouts to the organizer (performance of the contract); recording which terms you accepted and tax records (legal obligation and legitimate interest).
• Who is responsible: Pro Beauty World is an independent controller for booking, counting, payment, refunds and payouts within the platform; these are our own tasks under the participant terms. The organizer is an independent controller for the data it receives to run the event. There is no joint controllership.
• Sharing with the organizer: the event's organizer receives your name, email address, phone number, language, number of seats and payment status to run the event. The organizer is the controller for its own use of that data and may not use it for marketing without your consent.
• Payments: for an event paid online, Stripe processes your payment and acts as an independent controller for payment data. For an event paid on site, you pay the organizer directly and no payment data passes through pbw.life; we only record the reservation.
• Retention: the same as for appointments (section 5): anonymised 3 years after the booking was made, deleted after 7 years.

9. AI assistant (chat)

On pbw.life you can ask questions to an AI assistant. It is a computer program, not a person: it answers from the pbw.life help center and can make mistakes. Our terms and your studio have the final word. If you would rather talk to a person, write tosupport@pbw.life.

• What data: the messages you type, the assistant's answers and the language. Your browser keeps a random conversation number and the chat text in its session storage until you close the tab (see our Cookie Policy). We do not store your IP address with the conversation, set no cookies for the chat and do not link it to an account. Our servers use your IP address briefly to limit the number of requests; it appears only in the normal server logs (section 5).
• Please do not type personal details such as your name, phone number, allergies or other health information. The assistant does not need them and cannot look up bookings.
• Purpose and legal basis: answering the questions you ask, and checking that the answers are correct and the service stays within its budget. Basis: our legitimate interest (Art. 6(1)(f) GDPR) in helping visitors who ask us something. You can object at any time (section 6).
• Who processes it: your messages are sent to Anthropic (Claude), which generates the answer as our processor (section 4).
• In the studio, master and organizer portals: the Help panel has an "Ask the assistant" tab that works the same way. You need to be signed in, but the conversation is not stored with your account: we keep the screen you had open and the type of portal (studio, master or organizer). To limit the number of questions per person per day we keep a counter under a one-way code made from your account number and the date; it cannot be turned back into your account and is deleted the next day. The assistant cannot see your account, bookings or clients. Please do not type client names, contact or health details.
• Retention: conversations are deleted automatically after 30 days. Because they are not linked to you, we usually cannot find your conversation for an access or erasure request; if you send us the text of your messages we will look for it and delete it earlier.

10. Prospective customers (beauty professionals)

We contact beauty professionals in the Netherlands for whom pbw.life may be relevant. For that we keep a list.

• What data: your (business) name, city and specialty, the business contact details you published yourself (email address, phone number, Instagram account or website), and when and how we were in touch and what you answered.
• Source: public business profiles, such as your website, Instagram, online business directories and the Dutch Trade Register.
• Purpose and legal basis: contacting you with an offer that fits your work and keeping track of what we already sent. Basis: our legitimate interest (Art. 6(1)(f) GDPR) in bringing pbw.life to the attention of professionals for whom it is relevant.
• Retention: 12 months after the last contact, unless you become a customer. After that we delete your data automatically.
• Objection: if you do not want to hear from us again, reply to our message or email info@pbw.life. We delete your data and keep only a one-way code of your contact details, so we do not contact you again.

11. Minors

pbw.life is intended for people aged 16 and over. If you are under 16, please have a parent or guardian make the booking. Consent, such as in the cookie banner, can only be given by someone aged 16 or over (art. 5 of the Dutch GDPR Implementation Act).

Contact our privacy contact

For any GDPR right (access, rectification, erasure, restriction, portability, objection - Articles 15 through 21) you can use the form below or emailinfo@pbw.life directly.

Response window: we respond within one month of receiving your request (Art. 12(3) GDPR). For complex or voluminous requests this period may be extended by a further two months; if so, you will be informed within one month of the extension and the reason for it.

Identity verification. To prevent abuse we first send a 6-digit verification code to the email address provided. Where we have reasonable doubts about identity (for example, when the email address does not match anything in our records) we may request additional identification per GDPR Recital 64.

What an erasure request (GDPR Art. 17) actually deletes

We perform a cascaded erasure across: client profiles, booking statistics counters, any active verification codes, event seat bookings and the personal-data fields on your bookings (name, email and phone are anonymised; the booking rows themselves remain for the records). We confirm the result by email.

What remains. The booking rows themselves (date, service, amount - without your personal data) remain for up to 7 years for the records of the studio and of us. Only after that period are they finally deleted. Your booking statistics counters auto-expire after 24 months of inactivity even without an erasure request.

Objection (GDPR Art. 21)

If you object to processing on the legitimate-interest basis we erase your booking-statistics counters and ensure they are not re-created from future bookings. Select "Object to processing (Art. 21)" in the form above.

Automated check and your rights

Whether you are asked for a deposit is decided automatically: the system compares your counters with the threshold the studio has set. That decision has no legal effect and does not similarly significantly affect you within the meaning of Art. 22 GDPR: you can still book, the deposit is deducted from the price and you get it back under the cancellation rules. If you disagree, contact the studio or us. You can also object (above); we then erase your counters.

A data protection impact assessment (DPIA, GDPR Art. 35) and a legitimate-interest assessment have been written for this processing. The date of this version is at the top of the page.