Privacy policy
Last updated: 5 August 2026.
This is a courtesy translation. The Dutch version of this policy is the legally binding one — if anything reads ambiguous in English, the Dutch version prevails.
1. Who I am
Tefi Nail Art is a one-chair nail studio at Prinsegracht 20, 2512 GA Den Haag, the Netherlands. I'm the data controller. Questions or requests? Email tefi@tefinails.nl.
2. What I collect
When you book through this website, by WhatsApp or by email, I ask for:
- First and last name
- Email address
- Phone number
- Any notes you leave — for example allergies, inspiration or references
When you visit the website, my hosting provider (Vercel) automatically collects limited technical data — IP address, browser type, page visits — for functionality and security. This data isn't used for profiling and isn't kept longer than 30 days.
To detect misuse of the booking form, I also keep the time, country code, outcome and a non-reversible hash of the IP address for up to 30 days. The original IP address is not stored in the booking log.
On the separate Salonized booking page, I retain the original IP address and IP network for fraud prevention for up to 30 days, together with the approximate location derived by Vercel (country, region and city), time, browser and session IDs, device and browser information, referrer, visit frequency and limited interaction data such as time on page and the number of input actions. I create a secret-protected hashed device signature from technical characteristics such as platform, screen properties, language, time zone, memory/processor indicators and graphics chip. I don't generate canvas images or use audio signals for this. The signature is used only to identify likely recurring misuse when an IP address changes; it does not prove a person's identity. When a booking is submitted, this security log may be linked to the name, email address and phone number entered in the booking. I use this information only to investigate and block misuse.
3. Why I use this data
- To plan, confirm, reschedule or cancel your appointment.
- To send you a reminder shortly before the appointment.
- To follow up if I have questions about your treatment or need to shift the schedule.
- For my own bookkeeping and the statutory retention period required by the Dutch tax authority.
4. Legal basis
- Performance of a contract (Article 6.1.b GDPR) — for delivering your appointment.
- Legal obligation (Article 6.1.c GDPR) — for retaining records under Dutch tax law.
- Consent (Article 6.1.a GDPR) — for any optional communication outside of the appointment, such as posting a photo of your nails on Instagram.
- Legitimate interest (Article 6.1.f GDPR) — for securing the booking system and investigating fraudulent bookings.
5. How long I keep it
- Customer data linked to an appointment: up to 7 years after the appointment (statutory retention period for the Dutch tax authority).
- Contact details without an appointment: until you ask me to delete them.
- Technical web logs: up to 30 days.
- Security logs from the Salonized booking page, including the original IP address: up to 30 days.
6. Who I share with
I don't sell data to third parties. I do use a few standard business services that technically process your data:
- Google Workspace (Google Ireland Ltd., EU) — for receiving and sending mail and managing appointments.
- Vercel Inc. (United States) — for hosting this website. Vercel is GDPR-compliant via the EU Standard Contractual Clauses.
- Salonized — for the separate online booking widget and processing and managing appointments made through that widget.
- The Dutch tax authority (Belastingdienst) — when legally required.
7. Cookies
This website doesn't set tracking or marketing cookies. On the Salonized booking page, a random browser ID, session ID, first-visit date and visit count are stored in browser storage for fraud prevention and to link recurring booking attempts. Salonized may also use technically necessary storage to make the booking widget function.
8. Your rights
Under the GDPR you have the right to:
- Access your data
- Have inaccurate data corrected
- Request deletion ("right to be forgotten")
- Object to processing
- File a complaint with the Dutch Data Protection Authority
Send a request to tefi@tefinails.nl. I'll reply within four weeks.
9. Security
Your data is transmitted over encrypted connections (HTTPS / TLS). My mail account is on Google Workspace with two-factor authentication, and I don't store sensitive data on unencrypted devices.
10. Changes
This policy may be updated as I add new tools or as the law changes. The current version always lives on this page.