Privacy Statement

When you call us or make an online appointment, we ask for your name and telephone number. We also ask new customers a number of questions about their situation, for example about the processing time or development time if you have previously had a (natural) hair colouring done. We record this information in a file we call a colour card.

You are not obliged to provide your personal data. If you do not want your personal data recorded, you can for example only give your first name or enter 0600000000 as your telephone number. In that case, Delia Natuurlijke Haarkleuring will not be able to send you an appointment confirmation or reminder by email and/or SMS.

When you make, reschedule or cancel an (online) appointment, we always confirm this by email. We also send you a reminder by email and SMS three days before the appointment. You can unsubscribe from this if you find it inconvenient. To unsubscribe from email, use the unsubscribe link at the bottom of the email you received. To unsubscribe from SMS, reply by SMS with the text "STOP".

The party responsible for data processing is Delia Natuurlijke Haarkleuring, Chamber of Commerce 67844065, Halfrond 73, 3071 PP Rotterdam.

The purpose of the processing of personal data is to maintain a colour card with information necessary for the performance of agreements concluded with you, based on the legal basis in Article 6(1)(b) GDPR. In addition, the processing of payment data serves to comply with laws and regulations (Tax Authority). The legal basis for this is Article 6(1)(c) GDPR. The transfer of your IP address to Squarespace and Google when loading the online calendar and spam protection rests on legitimate interest (Article 6(1)(f) GDPR). If it is necessary to note a (hyper)sensitivity or allergy to a particular (colour) substance in the colour card, the legal basis is explicit consent under Article 6(1)(a) GDPR together with Article 9(2) GDPR. You can withdraw consent at any time.

Send a WhatsApp, email, SMS or call to withdraw consent or to book an appointment without using the online calendar.

Delia Natuurlijke Haarkleuring processes data of its customers.

Delia Natuurlijke Haarkleuring processes the following (categories of) personal data: (a) surname and first name, (b) (mobile) telephone number, (c) email address, (d) date and time of an appointment, (e) information about the customer's specific situation (processing time, development time, type of colour treatment, mixing ratio, before/after photo, and where applicable a (hyper)sensitivity or allergy, and (f) payment data.

We keep data (a) to (e) (the colour card) for as long as you are a customer, or one year after the last appointment. We keep payment data (f) for seven years (Tax Authority).

We do not actively share your data with third parties for their own purposes. Squarespace does collect technical browsing data independently when your browser loads the booking page, which we describe below. We do use processors, such as Squarespace and Twilio Inc. (SendGrid). See the table in the 'Privacy by Design: the reverse proxy' section.

The appointment form of Acuity Scheduling uses Google spam protection (reCAPTCHA) to prevent abuse. Google acts as a processor under Acuity Scheduling's instruction since 2 April 2026. Acuity Scheduling holds the site key for that protection and is responsible for the associated data processing agreement with Google.

The online calendar runs on Acuity Scheduling by Squarespace Ireland Limited (Squarespace House, Ship Street Great, Dublin 8, Ireland). As a non-US user, Delia Natuurlijke Haarkleuring contracts with Squarespace Ireland Limited (Terms §1.2). For appointment data you submit, the DPA names Delia Natuurlijke Haarkleuring as controller and Squarespace as processor ("You are the controller and Squarespace is the processor of Your Controlled Data", DPA §4.1). The DPA applies automatically ("Our Data Processing Addendum forms part of this Agreement", Terms §7.2). Squarespace Ireland Limited stores data in the US, covered by Standard Contractual Clauses (Article 46 GDPR). Squarespace, Inc. also holds EU-US Data Privacy Framework certification (Article 45 GDPR). You can also book by email, WhatsApp, Signal, SMS, or telephone.

When your browser loads the booking page, Squarespace also collects technical browsing data automatically for its own purposes, including your IP address, browser and device details, pages you visited before, and how you interact with the page (Terms §7.3.3). That processing falls outside the DPA. The same IP address can therefore fall under two legal regimes at once, as appointment data where Squarespace is the processor. As browsing data, Squarespace becomes an independent controller.

The booking page also loads two fonts from Google servers in the US. Open Sans loads from fonts.googleapis.com and fonts.gstatic.com. The Google spam protection (reCAPTCHA) for the appointment form loads Roboto directly from fonts.gstatic.com. Each font request sends the visitor's IP address to Google. Delia Natuurlijke Haarkleuring does not load either font and cannot prevent this transfer to the US without replacing the online calendar altogether.

Opening the online calendar does trigger the collection and transfer of the IP address, and for that step Delia Natuurlijke Haarkleuring relies on its legitimate interest in offering the booking tool, under Article 6(1)(f) GDPR. Delia Natuurlijke Haarkleuring informs the visitor beforehand of the consequences of opening the online calendar. The transfer itself rests on the EU-US Data Privacy Framework, under which Google LLC is certified (Article 45 GDPR), and the Standard Contractual Clauses in Google's Cloud Data Processing Addendum provide a fallback (Article 46 GDPR). The same applies to the appointment confirmation emails (new appointment, change, cancellation, and reminder) and the reminder SMS that Twilio handles.

We serve the online calendar through our own reverse proxy, privacy.natuurlijkehaarkleuring.nl.

That proxy sits between your browser and Acuity, hosted in the EU. All API requests carrying booking data travel through the proxy to Acuity. That gives us control over the headers we forward.

The proxy removes the headers X-Forwarded-For, X-Real-IP, and Referer before forwarding a request to Acuity. It also uses a Content-Security-Policy to block the tracking scripts of Datadog, Sentry, and Stripe, and the business logo that Acuity loads from its own server (cdn-s.acuityscheduling.com). But a working booking page also needs scripts and stylesheets. Acuity loads those directly from assets.squarespace.com. For those requests, Squarespace receives your real IP address. That is a limitation of the current architecture.

Acuity Scheduling offers payment processing through Stripe, Inc. as a sub-processor. Delia Natuurlijke Haarkleuring does not use that functionality. Customers pay on the day of the appointment, directly to Delia Natuurlijke Haarkleuring. The calendar processes no payment data.

The website natuurlijkehaarkleuring.nl has an HTTPS security certificate. The online calendar also has an HTTPS security certificate. Both use current security settings.

We store your colour card in encrypted form. We use AES encryption with BitLocker for this. Each colour card has a unique and random AES encryption key to encrypt and decrypt the file.

We do not use automated decision-making. We record only the information the hair colouring needs, in consultation with you.

We use local storage, session storage, and two browser cookies. Local storage serves the display preference, language preference, technical settings for the video player and the booking page, and spam protection on the appointment form. The functional cookie (PHPSESSID) keeps the online calendar working and expires after one month. The spam protection places a second cookie (_GRECAPTCHA) which expires after six months. None of this tracks you across other websites or serves advertising.

Delia Natuurlijke Haarkleuring supports your privacy rights that you can exercise under the GDPR. You have the right to (a) access, (b) rectification and supplementation, (c) erasure (deletion), (d) data portability of your personal data, and (e) objection under Article 21 GDPR to processing that rests on legitimate interest, namely the transfer of your IP address to Squarespace and Google when the online calendar and the spam protection load.

Send a WhatsApp, email, SMS or call for this.