Privacy Policy

The data controller responsible for your personal data is:

We collect the following categories of personal data:

• Booking data — name, email address, phone number, chosen studio, date and time of booking, and any notes you provide.
• Account data — if you create an account via Clerk (our authentication provider), we store your email address and any profile information you provide.
• Communication data — emails and messages you send us.
• Technical data — IP address, browser type, and pages visited, collected via cookies and server logs (see our Cookie Policy).

We do not collect sensitive special-category data (e.g. health information) unless you voluntarily provide it in a booking note.

We process your data on the following legal bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)) — to process and manage your studio booking.
• Legitimate interests (Art. 6(1)(f)) — to operate and improve our service, prevent fraud, and ensure security.
• Consent (Art. 6(1)(a)) — for optional analytics cookies and marketing communications, where you have opted in.
• Legal obligation (Art. 6(1)(c)) — to comply with Dutch tax and accounting requirements.

We retain personal data only as long as necessary:

• Booking records — 7 years (Dutch tax law requirement).
• Account data — until you delete your account, plus 30 days.
• Marketing communications — until you unsubscribe.
• Server logs — 90 days, then anonymised.

We do not sell your data. We share it only with trusted third-party processors:

• Clerk — authentication and account management (US/EU, SCCs in place).
• Supabase — database hosting (EU region).
• Vercel — hosting provider (EU region selected).

All processors are bound by data processing agreements (DPAs) in accordance with GDPR Chapter V.

Under GDPR, you have the following rights:

• Right of access — request a copy of your data.
• Right to rectification — correct inaccurate data.
• Right to erasure — request deletion ("right to be forgotten").
• Right to restriction — ask us to pause processing.
• Right to portability — receive your data in a machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — at any time, for consent-based processing.

To exercise any right, email us at privacy@tegusta.nl. We will respond within 30 days.

We use cookies in accordance with the Dutch Telecommunications Act (Telecommunicatiewet). Essential cookies are placed without consent. Analytics and preference cookies are only placed after your explicit opt-in via our cookie banner.

You can withdraw consent at any time by clicking "Cookie settings" in the footer, or by clearing your browser cookies.

We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, access controls, and regular security reviews. No transmission over the internet is 100% secure, however, and we cannot guarantee absolute security.

If you believe we have processed your data unlawfully, you have the right to lodge a complaint with the Dutch supervisory authority:

We would, however, appreciate the chance to address your concerns first — please contact us at privacy@tegusta.nl.

We may update this policy from time to time. Material changes will be communicated via a notice on our website. The "last updated" date at the top of this page always reflects the most recent version.