1. Who is responsible for your data?
Outerweb BV develops and operates My Beauty Salon as a software-as-a-service product. Outerweb is responsible for processing personal data needed to operate the platform, secure it, manage accounts, communicate with users, and comply with legal obligations.
Salons also enter and manage client, employee, service, and appointment information. A salon may act as an independent controller for its own client relationship. Where Outerweb processes salon data only on a salon’s documented instructions, the salon may be the controller and Outerweb may act as its processor under the applicable agreement.
2. Which data do we process?
- Account data, such as your name, email address, phone number, locale, email-verification status, password hash, and profile image.
- Salon and employee data, such as business details, roles, permissions, invitations, schedules, service settings, and salon profile content.
- Client and booking data, such as salon relationships, appointments, selected services, assigned employees, dates, times, prices, discounts, VAT information, status changes, and related communications.
- Reviews and user content, such as ratings, comments, replies, images, and information you choose to publish or share with a salon.
- Technical and security data, such as IP address, browser and device information, session identifiers, user-agent data, logs, and security events.
- Integration data, such as browser push-subscription details and encrypted Google Calendar authorisation data when you enable those features.
3. Why do we process your data?
- To create and manage accounts, provide the platform, process bookings, display salon information, and deliver the services you request. The legal basis is performance of a contract or taking steps at your request before entering into one.
- To send appointment confirmations, changes, cancellations, reminders, verification messages, password-reset messages, and other service communications. The legal basis is performance of the contract and, where applicable, our legitimate interest in operating a reliable service.
- To provide salon-management functionality, permissions, client relationships, schedules, reviews, and notifications. Depending on the relationship, the legal basis may be the contract with you, a salon’s instructions, or a salon’s own legal basis as controller.
- To protect accounts, prevent abuse, troubleshoot incidents, maintain the platform, and improve reliability. The legal basis is our legitimate interest in securing and improving the service.
- To comply with legal, tax, accounting, regulatory, and law-enforcement obligations. The legal basis is compliance with a legal obligation.
- To use non-essential cookies or other consent-based features only after you provide the required consent. You can withdraw that consent through the cookie controls.
4. Who receives your data?
- The salon and its authorised employees receive the client and appointment information needed to provide and manage a booked service. Information that you choose to publish on a salon profile or review may be visible to other visitors.
- Technology providers that help us host, store, secure, deliver, and maintain the platform, email, media, database, and notification services may process data on our instructions.
- Google may process information when an authorised employee connects Google Calendar. The integration is optional and can be disconnected.
- Browser and push-notification providers may process technical subscription data when you enable push notifications.
- Authorities, professional advisers, or other recipients may receive data where disclosure is required by law, necessary to establish or defend legal claims, or part of a corporate transaction.
- At the time this policy was last updated, My Beauty Salon does not use advertising trackers, analytics cookies, or an online payment processor in the booking flow.
5. Salon data and your responsibilities
Salons are responsible for entering accurate client and business information, giving clients the notices required by law, collecting any required permissions, and only sharing information with My Beauty Salon that they are authorised to use. Salons should not enter unnecessary health information or other sensitive personal data into free-text fields.
If your question concerns information collected directly by a salon, the salon may be the most appropriate first contact. We will assist with requests that concern processing for which Outerweb is responsible and will forward or coordinate requests where the salon is the controller.
6. How long do we keep data?
We retain personal data only for as long as it is needed for the purposes described in this policy, to provide the platform, to resolve disputes, to enforce agreements, or to meet legal and accounting obligations.
- Account data is kept while the account is active and is deleted, anonymised, or restricted when an account is closed, subject to legal and operational retention needs.
- Appointment and salon records may remain available to the relevant salon where needed for administration, customer support, accounting, or legal claims.
- Web sessions are short-lived and are currently configured with a 120-minute lifetime. The selected locale for a guest is kept in the server-side session and is not stored in a separate locale cookie.
- Push subscriptions remain until you remove them, withdraw permission, or the subscription becomes invalid. Google Calendar authorisation data remains until the integration is disconnected or the relevant account is removed.
- Backups and security records may remain for a limited additional period under our normal operational and legal processes.
7. International transfers
Depending on the production hosting, storage, email, notification, and integration providers configured for My Beauty Salon, personal data may be processed inside or outside the European Economic Area. Where a transfer requires protection under applicable data-protection law, we use an adequacy decision or appropriate safeguards such as standard contractual clauses and supplementary measures where required.
We can provide more information about the relevant providers and transfer safeguards on request, subject to confidentiality and security considerations.
8. How do we protect your data?
We use reasonable technical and organisational measures appropriate to the risk, including access controls, tenant and permission checks, password hashing, encrypted integration credentials, HTTPS in production, monitoring, backups, and secure development practices. No internet service can guarantee absolute security, so you should also protect your credentials and report suspected incidents promptly.
9. Your rights
Subject to the conditions and exceptions in applicable law, you may have the right to:
- access the personal data we process about you;
- correct inaccurate or incomplete data;
- request deletion of your data;
- request restriction of processing;
- object to processing based on legitimate interests or to direct marketing;
- receive data you provided in a portable format;
- withdraw consent where processing is based on consent. Withdrawal does not affect processing that was lawful before withdrawal.
10. Cookies and session storage
My Beauty Salon uses strictly necessary cookies for the session, form security, and storing your cookie-consent choice. Your selected language is stored in the server-side session for guest users and in the account for signed-in users. See the cookie policy for the current cookie names, purposes, and durations, and to reset your consent choice.
11. Changes and contact
We may update this policy when the platform, providers, or applicable law changes. The latest version is published on this page and the update date is shown above.
To exercise your rights or ask a privacy question, contact Outerweb BV using the details published below. We may ask for information needed to verify your identity and will normally respond within the period required by law.