Privacy Notice

Status of this document

This draft still contains company and policy details that Lonsa must confirm. It must not be used as the final agreement.

1. Controller and contact

[TO CONFIRM] legal entity name, trading as Lonsa, is controller for account, website, contract, and support data. Contact privacy@lonsa.nl; address [TO CONFIRM] registered address.

2. Data we process

• Account, business, service, schedule, booking, support, session, and security data.
• Connected Google identity, WhatsApp Business number, and encrypted provider credentials.
• Salon-customer name, phone, appointment, and conversation state processed for the salon.

3. Purposes and legal bases

• Contract: providing accounts, scheduling, bookings, integrations, and support.
• Legitimate interests: security, fraud prevention, diagnosis, and proportionate improvement.
• Legal obligations: records, competent requests, and incident handling.
• Consent only for genuinely optional processing, with a right to withdraw it.

4. Salon-customer data

The salon is generally controller for its customer data; Lonsa processes it on documented instructions. Appointment and rights requests may first be directed to the relevant salon.

5. Recipients and international transfers

[TO CONFIRM] confirm subprocessors, locations, purposes, and transfer safeguards for hosting, database, email, Meta, Google, Cloudflare, and mobile push.

6. Retention

[TO CONFIRM] confirm periods for accounts, bookings, customers, messages, webhooks, logs, audits, backups, and deletion requests. Data is not kept longer than necessary or legally required.

7. Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction, portability, or object. You may complain to the Dutch Data Protection Authority. We may verify identity before acting.

8. Security and changes

Lonsa uses tenant isolation, access control, encryption for provider secrets, TLS, redacted logging, and recovery controls. Material changes are published with a new version and communicated where appropriate.