Draft
This privacy statement is a draft and is still being reviewed by Nano Web and preferably by a lawyer. No rights can be derived from it yet. Highlighted parts, such as [Chamber of Commerce number], still need to be completed or confirmed. This English text is a translation; if it differs from the Dutch version, the Dutch version prevails.
Contents
Privacy statement
SpaSlot privacy statement
Draft · version [date]
SpaSlot is an online booking system by Nano Web. In this statement you can read what personal data we process, why, for how long, and what rights you have. Part 1 covers visitors to spaslot.nl and our own customers. Part 2 covers the data of guests who book with our customers; for that data we are the processor and the sauna or spa is the controller.
Who we are
SpaSlot is a trade name of Nano Web, located at Rodezand 80, 3011 AN Rotterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 73062545. For the processing described in part 1, Nano Web is the controller within the meaning of the GDPR.
Do you have a question about privacy? Email info@spaslot.nl or call +31 10 321 68 61.
What data we process
We only process data that you give us yourself or that is needed to make the website and the service work.
2.1 Demo requests and contact
- Contact details: your name, email address and, if you fill it in, your phone number.
- Business details: the name of your sauna, spa or venue.
- Your message: the question or request you send us through the form or by email.
2.2 SpaSlot customers
If you become a customer, we also process:
- Account and user data: the name and email address of you and the staff members you give access, with their role and permissions.
- Billing details: company name, address, VAT number, contact person and payment details for the subscription.
- Contact and support: emails, notes of phone calls and support requests.
- Technical data: login data and log files of the management dashboard, needed for security and for resolving outages.
2.3 Website visits
Every time you visit spaslot.nl, the web server processes technical data such as your IP address, the time and the page requested. This is needed to display and secure the website. We do not use it to build profiles.
We do not process special categories of personal data, and the website is not intended for children under 16.
Why we do this
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your demo request or question | Contact, business, message | Your request (steps prior to entering into a contract) and our legitimate interest in replying |
| Providing and setting up SpaSlot | Account, users, billing | Performance of the contract |
| Invoicing and accounting | Billing details | Legal obligation (statutory tax retention requirement) |
| Providing support | Contact and support | Performance of the contract |
| Securing the website and dashboard | Technical data | Legitimate interest |
| Informing you about changes to the service | Customer contact details | Performance of the contract |
We do not send newsletters or marketing emails without your consent, and we do not sell data.
Who we share data with
We only share data with parties that help us provide the service. We enter into a data processing agreement with each of them.
| Party | Purpose | Location |
|---|---|---|
| [website hosting provider] | Hosting spaslot.nl and the form | [country] |
| [app hosting provider] | Hosting SpaSlot and the database | Amsterdam, the Netherlands |
| [email provider] | Sending email | [country] |
| [accounting software] | Invoicing and accounting | [country] |
We also provide data where the law requires us to, for example to the Dutch Tax Administration (Belastingdienst). Data is not transferred to countries outside the European Economic Area, unless stated otherwise above and appropriate safeguards are in place, such as the European Commission’s standard contractual clauses.
How long we keep data
| Data | Retention period |
|---|---|
| Demo request without becoming a customer | [12 months] after the last contact |
| Account and user data | For as long as you are a customer, then [3 months] for export and wrapping up |
| Invoices and accounting records | 7 years (statutory tax retention requirement) |
| Support emails | [2 years] after resolution |
| Server logs | [no more than 30 days] |
Security
We take appropriate technical and organisational measures to protect data. Connections to the website and the dashboard are encrypted (https). SpaSlot’s servers are located in a data centre in Amsterdam. Access to data is limited to staff who need it for their work. [add specific measures, such as backups and two-factor authentication, if in place]
Your rights
You have the right to access your data, to have it corrected or erased, to have its processing restricted, to object, and to have your data transferred (data portability). Send your request to info@spaslot.nl. We will respond within one month. We may ask you to confirm your identity, so that we do not give data to the wrong person.
Making a complaint
Not happy with how we handle your data? Let us know first at info@spaslot.nl and we will work out a solution together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Changes
We update this statement when our service or the law changes. The date at the top shows when it was last changed. We inform customers by email of any significant changes.
Contact
For questions, requests or complaints about privacy:
Nano Web, attn. SpaSlot privacy
Part 2 · Guest data
Data of guests who book through SpaSlot
Are you a guest booking with a sauna, spa or wellness venue that uses SpaSlot? Then that venue is responsible for your data. SpaSlot processes it on the venue’s behalf. Below you can read what that means.
Last updated: [date]
In short
- The sauna or spa you book with decides what happens to your data. We are the processor.
- We only use guest data to handle bookings, payments, emails and invoices for that venue. Not for ourselves.
- The data is stored on servers in Amsterdam and remains the property of our customer, who can export it at any time.
- We enter into a data processing agreement with every customer.
- Want to view your data or have it deleted? Contact the venue you booked with.
Who is responsible
The sauna, spa or other venue that uses SpaSlot is the controller of its guests’ data. Nano Web is the processor: we only process that data on behalf of and in accordance with the instructions of the venue, as set out in the data processing agreement. For guests, the venue’s own privacy statement prevails.
What guest data
Depending on how the venue has set up SpaSlot, we process:
- Contact details: name, email address and phone number.
- Booking details: date, time, room, number of guests per category (adults, children, babies), selected extras and packages, and any comments.
- Payment details: amount, payment status and payment method. Payments are processed by Mollie; we never see full bank or card details.
- Codes and credits: promo codes, gift cards and passes used.
- Customer account: email address and the login code sent by email, if the guest uses "my bookings".
- Reviews and feedback: the rating a guest gives, and the feedback if it is sent to the venue through the form.
- Invoice details: details that appear on an invoice, such as a company name if the guest provides one.
What we do with it
We only process guest data to provide the service for the venue:
- recording bookings and showing them in the venue’s calendar;
- initiating payments and tracking payment status;
- sending confirmations, reminders, where applicable an email about an unfinished booking, and review requests, as set up by the venue;
- creating and sending invoices, if the venue has turned this on;
- producing statistics and exports for the venue.
We do not use guest data for our own purposes, we do not send guests our own marketing and we do not sell data.
Where the data is stored
Guest data is stored on servers in a data centre in Amsterdam. The data remains the property of the venue, which can export it at any time, for example as an Excel file.
Sub-processors
We use other parties for part of the work. They only process what is necessary and are bound by the same agreements.
| Party | Purpose | Location |
|---|---|---|
| [app hosting provider] | Hosting SpaSlot and the database | Amsterdam, the Netherlands |
| [email provider] | Sending booking emails | [country] |
| Mollie | Online payments | The Netherlands [to be checked: role of Mollie] |
Retention periods
The venue decides how long guest data is kept. If the agreement with the venue ends, the venue is given the opportunity to export all data. We then delete the data within [period], unless the law requires us to keep it longer.
Security and data breaches
We protect guest data with the same measures as described in part 1, section 7. A venue’s staff only get access according to the role and permissions the venue sets. If we discover a data breach, we report it to the venue without undue delay, [within 48 hours], so that the venue can meet its notification obligation.
Data processing agreement
We enter into a data processing agreement with every customer. Among other things, it sets out the purpose of the processing, the security measures, the sub-processors, the arrangements for data breaches and what happens to the data when the collaboration ends. Customers can request the agreement via info@spaslot.nl.
Your rights as a guest
As a guest, do you want to view, correct or delete your data? Then contact the venue you booked with. The venue is responsible and can carry out your request. If you cannot resolve it with the venue, or if your request reaches us, we forward it to the venue and help it deal with the request.
Please note
SpaSlot never asks guests for passwords or payment details by email or phone. Payments are only made through the secure payment page. Received a suspicious message that appears to come from a SpaSlot venue? Report it to the venue or to info@spaslot.nl. [to be checked: does this match how we work?]