Privacybeleid

1. Who we are

Zazie Beauty by Stephanie, established at Zwartkloosterstraat 67 bus 002, 2800 Mechelen, Belgium, registered under company number BE 0770.598.682, is responsible for the processing of personal data described in this policy.

Questions about privacy? Email zazie.by.stephanie@gmail.com or call +32 484 69 77 13.

2. What data we process

• Identification data (name, email address, phone number) — when you book an appointment, request a gift voucher or fill in the contact form.
• Appointment data (chosen treatment, date, time, any remarks) — to schedule and confirm your appointment.
• Technical data (IP address, browser type, pages visited) — collected automatically via server logs and, with your consent, via analytics cookies.
• Communication content — when you email, call or contact us through a form.

No special categories of personal data within the meaning of Article 9 GDPR are requested or stored. If you volunteer health information when booking (an allergy, for example), it is used solely to carry out the treatment safely.

3. Why we process it (legal basis)

• Performance of a contract (Art. 6.1.b GDPR) — to handle your appointment or gift voucher.
• Consent (Art. 6.1.a GDPR) — for analytics and advertising cookies, and for any newsletters.
• Legal obligation (Art. 6.1.c GDPR) — accounting retention duty.
• Legitimate interest (Art. 6.1.f GDPR) — securing the website and preventing misuse.

4. How long we keep it

• Contact and booking requests: no longer than 2 years after the last contact.
• Client records with an invoice: 7 years (statutory accounting retention).
• Server logs: 6 months.
• Cookies: see the table in article 8.

5. Who has access

Data is shared exclusively with:

• IT service providers for hosting, email and backups — as processors, under a data processing agreement.
• Google (Google Tag Manager and Google Analytics) — only when you consent to statistics cookies. Processing may take place in the EU and the US under the EU-US Data Privacy Framework.
• Competent public authorities — only where legally required.

Your data is never sold or rented to third parties.

6. Google reviews

This website shows reviews that clients have posted publicly on Google. These reviews are collected through an external service provider (DataForSEO) and may include the reviewer's first name and last initial, together with the text and rating of the review. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in giving prospective clients an honest picture of our services.

Are you the author of a review and would you rather it no longer appeared on this website? Email zazie.by.stephanie@gmail.com and we will remove it from the site. You can also edit or delete the review yourself on Google.

7. Your rights

• Right of access (Art. 15 GDPR) — to request which data is processed.
• Right to rectification (Art. 16) — to have inaccurate data corrected.
• Right to erasure (Art. 17) — to request deletion of your data.
• Right to restriction (Art. 18) — to have processing suspended.
• Right to portability (Art. 20) — to receive your data in a common format.
• Right to object (Art. 21) — to object to processing based on legitimate interest.
• Right to withdraw consent — at any time, without affecting earlier processing.

Send your request to zazie.by.stephanie@gmail.com. You will receive an answer within 30 days.

If you are not satisfied with how it is handled, you may lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels.

8. Cookies

By default this site places only functional cookies. Statistics and advertising cookies are placed only after you switch them on yourself via the cookie settings at the bottom of every page.

9. Changing or disabling cookies

You can change your preferences at any time via the Cookie settings button at the bottom of every page. Changes apply immediately. Cookies already placed can be removed through your browser settings.

10. Security

Data is protected by appropriate technical and organisational measures, including an encrypted connection (HTTPS), access control and regular backups. In the event of a data breach with a high risk, the individuals concerned and the Data Protection Authority are informed within 72 hours, in accordance with Article 33 GDPR.

11. Changes to this policy

This policy may be updated when our practices or the law change. The date of the last change is shown at the top of this page. Significant changes will be announced clearly on the website.

12. Language

This privacy policy was drawn up in Dutch. The English translation is provided as a courtesy; in the event of a difference in interpretation, the Dutch text prevails.