This notice explains in full detail what personal information YourBookingPlatform collects when you book an appointment, why we collect it, how it is used, who it may be shared with, how long we keep it, and what rights you have. We believe you deserve complete transparency — so we've left nothing out.
YourBookingPlatform (referred to as "YBP", "we", "us", or "our") is a technology company registered and operating in the Netherlands. We provide a software-as-a-service (SaaS) booking and business management platform used by beauty salons, nail studios, barber shops, clinics, and other appointment-based businesses across the Netherlands and internationally.
When you book an appointment through a business that uses our platform — such as Ezoncs Nail Studio or Evolve Clinic — you interact with YBP's software. In that context:
This privacy notice applies to all personal data processed through the YourBookingPlatform booking system, whether you book online, via a booking link, through a business's website, via WhatsApp automation, or through our AI receptionist Zoe.AI.
We only collect personal data that is necessary to provide you with a booking experience and the services you have requested. Below is a full breakdown of every category of data we may collect about you:
We process your personal data for the following clearly defined purposes. We never use your data for anything beyond what is listed here without first obtaining your explicit consent:
| Purpose | Description |
|---|---|
| Booking Management | To create, confirm, update, and manage your appointments with the business |
| Appointment Reminders | To send you reminders via email, SMS, or WhatsApp before your appointment so you don't miss it |
| Booking Confirmations | To send you a confirmation when a booking is made, changed, or cancelled |
| Birthday Messages | To send you a personalised birthday message and/or discount offer on or around your birthday (only where you have provided your date of birth and consented) |
| Loyalty Programme | To track and manage loyalty points, cashback rewards, and VIP tier status where the business offers this |
| Client History | To allow the business to view your appointment history and preferences, so they can provide a consistent and personalised service |
| Marketing & Newsletters | To send promotional emails, offers, or news from the business — only where you have explicitly opted in (see Section 13) |
| WhatsApp Automation | To send automated booking-related messages or allow you to interact with a business via their WhatsApp chatbot — only where you have opted in to WhatsApp communication |
| AI Receptionist (Zoe.AI) | To handle your booking enquiries automatically via AI on behalf of the business — see Section 6 for full details |
| Fraud Prevention & Security | To detect and prevent fraudulent bookings, chargebacks, and abuse of the platform |
| Platform Improvement | To analyse aggregated, anonymised usage data to improve the performance and features of the platform |
| Legal Obligations | To comply with legal requirements such as financial record-keeping, tax obligations, and responding to lawful requests from authorities |
Under the General Data Protection Regulation (GDPR), we are required to have a valid legal reason — called a "lawful basis" — for every type of personal data processing we carry out. Here is a complete breakdown:
| Processing Activity | Lawful Basis | GDPR Article |
|---|---|---|
| Creating and managing your appointment | Performance of a contract | Art. 6(1)(b) |
| Sending appointment reminders & confirmations | Performance of a contract / Legitimate interests | Art. 6(1)(b)/(f) |
| Storing your booking history | Legitimate interests (service continuity) | Art. 6(1)(f) |
| Sending birthday messages / discounts | Consent (explicit, given at time of data collection) | Art. 6(1)(a) |
| Loyalty points and rewards tracking | Performance of a contract / Consent | Art. 6(1)(b)/(a) |
| Sending marketing emails / newsletters | Consent (explicit opt-in required) | Art. 6(1)(a) |
| WhatsApp automated messages | Consent (explicit opt-in to WhatsApp communication) | Art. 6(1)(a) |
| AI Receptionist (Zoe.AI) interactions | Performance of a contract / Legitimate interests | Art. 6(1)(b)/(f) |
| Security, fraud detection, abuse prevention | Legitimate interests | Art. 6(1)(f) |
| Platform analytics (anonymised) | Legitimate interests | Art. 6(1)(f) |
| Legal compliance and record-keeping | Legal obligation | Art. 6(1)(c) |
We take data sharing seriously. Your personal data is only accessible to those who have a genuine need to see it to deliver the service you requested. Here is a full and transparent account of who may access your data and why:
The salon, clinic, or business whose booking system you used can see your full profile within their YBP account. This includes your contact details, appointment history, notes, loyalty points, and payment status. They use this to manage your appointments and provide you with a great service.
Authorised staff members of the business — such as receptionists and service providers — may access your booking information within the platform. Access is role-based, meaning staff only see what is relevant to their role.
YBP's technical and support staff may access data in limited, controlled circumstances — for example, to resolve a technical issue, investigate a security incident, or provide platform support. All such access is logged and subject to strict confidentiality obligations.
YBP uses a small number of trusted third-party service providers ("sub-processors") to help deliver the platform. These providers only process your data as instructed by YBP and are contractually bound to strict data protection standards. Current categories include:
An up-to-date list of our sub-processors is available at yourbookingplatform.com/legal or by emailing help@yourbookingplatform.com.
If the business you book with is part of a franchise or multi-location network using YBP, your data may be accessible to authorised staff at other locations within that same business network — but only for the purpose of managing your appointments across those locations. Your data is never shared with unrelated third-party businesses.
We may disclose your personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so — for example, in response to a court order, a legal obligation, or to protect the safety and rights of individuals. We will only disclose the minimum amount of data necessary.
YourBookingPlatform offers businesses an AI-powered virtual receptionist called Zoe.AI. If the business you are booking with has enabled Zoe.AI, you may interact with an automated AI system rather than (or in addition to) a human member of staff.
Conversation logs are retained for up to 90 days for quality assurance purposes, after which they are permanently deleted, unless a shorter retention period has been requested by the business.
Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing if that decision significantly affects you. In the context of Zoe.AI, this means:
Some businesses using YBP operate an automated WhatsApp chatbot for bookings and communications. If you message a business via WhatsApp and they have this feature enabled:
YourBookingPlatform is based in the Netherlands and primarily processes data within the European Economic Area (EEA). However, some of our sub-processors (such as certain cloud infrastructure or AI providers) may be located outside the EEA, including in the United States.
Where data is transferred outside the EEA, we ensure that appropriate safeguards are in place to protect your personal data, including:
For UK users, all international transfers also comply with the UK GDPR and the UK International Data Transfer Agreement (IDTA) framework.
You can request details of the specific safeguards in place for any particular transfer by contacting us at help@yourbookingplatform.com.
We do not retain your personal data longer than is necessary for the purposes it was collected. Below is a detailed breakdown of our data retention periods:
The security of your personal data is a top priority for us. We implement multiple layers of technical and organisational safeguards to protect your data against unauthorised access, disclosure, alteration, loss, or destruction:
Under the General Data Protection Regulation (GDPR) and other applicable data protection laws, you have a comprehensive set of rights in relation to your personal data. We take these rights seriously and will always respond to your requests promptly and fully.
You have the right to request a copy of all personal data we hold about you, along with information about how and why we process it. We will provide this free of charge within 30 days.
If any of the personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. You can update most of your details directly in the booking system, or contact us.
Also known as the "right to be forgotten" — you can request that we delete your personal data. We will action this within 30 days, subject to any legal obligations to retain certain data (e.g. financial records).
In certain circumstances, you can ask us to temporarily stop processing your personal data — for example, while you contest its accuracy or object to our use of it.
You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g. CSV or JSON), so you can transfer it to another service provider if you wish.
You have the right to object to processing based on legitimate interests or for direct marketing purposes. If you object to direct marketing, we will stop immediately and without question.
Where processing is based on your consent (e.g. birthday messages, newsletters, WhatsApp messages), you can withdraw that consent at any time. Withdrawal won't affect past processing.
You have the right not to be subject to decisions based solely on automated processing (including AI) that significantly affect you, and the right to request human review of any such decision.
If you believe we have mishandled your personal data, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your country of residence.
When you visit our booking page or website, we may use cookies and similar technologies to enhance your experience, remember your preferences, and understand how you use the platform.
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Core platform functions — login sessions, security tokens, booking flow continuity. Without these, the booking system cannot function. | No — essential |
| Functional | Remember your language, region, and preferences so you don't have to re-enter them each visit. | Yes |
| Analytics | Anonymised data on how the booking page is used, to help us improve it. No personally identifiable data is shared with analytics providers. | Yes |
| Marketing / Tracking | May include Meta Pixel or Google Ads cookies to measure advertising effectiveness. Only placed with your explicit consent. | Yes — consent required |
When you first visit our website or booking page, you will be shown a cookie consent banner where you can choose which categories of cookies to accept. You can update your preferences at any time via the cookie settings link in the footer.
You can also manage cookies directly through your browser settings — most browsers allow you to block or delete cookies. However, please note that disabling strictly necessary cookies will prevent the booking system from functioning correctly.
YourBookingPlatform's services are not directed at or intended for children under the age of 16. We do not knowingly collect personal data from children under 16 without verifiable parental consent.
Under GDPR Article 8, where consent is the lawful basis for processing, children under 16 require parental or guardian authorisation. If a business using YBP provides services to minors (e.g. a children's haircut appointment), it is the responsibility of that business — as the Data Controller — to ensure appropriate consent is obtained from the parent or guardian.
If we become aware that we have inadvertently collected personal data from a child under 16 without proper consent, we will delete that data promptly. If you believe we have collected data from a child in error, please contact us immediately at help@yourbookingplatform.com.
We and the businesses using our platform take your marketing preferences seriously. Here is everything you need to know about how we handle promotional communications:
You will only ever receive promotional emails from a business using YBP if you have explicitly opted in — either at the time of booking, by ticking a consent checkbox, or by subscribing directly. We do not add you to mailing lists without your active agreement.
Every marketing email you receive will include a clear and easy "Unsubscribe" link at the bottom. Clicking this will remove you from that business's mailing list immediately. Your unsubscribe request will be processed within 5 working days.
If you provided your date of birth during booking and the business has a birthday marketing feature enabled, you may receive a birthday message and/or discount offer on or around your birthday. This is based on your consent given at the time of providing your date of birth. You can opt out of birthday messages at any time by contacting the business or emailing help@yourbookingplatform.com.
Appointment reminder texts are sent as part of the service you booked (not marketing), based on legitimate interests. You may opt out of SMS reminders by contacting the business directly or updating your preferences in your booking profile.
You will only receive WhatsApp messages from a business if you have initiated contact or explicitly opted in to WhatsApp communication from that business. To stop receiving WhatsApp messages, reply "STOP" to any message, or contact the business directly.
If you have any questions, concerns, or requests relating to this privacy notice or how your personal data is handled, please don't hesitate to get in touch. We are committed to responding promptly and transparently.
We will respond to all privacy requests within 5 business days for general queries, and within 30 days for formal data rights requests (extendable to 3 months for complex cases, with prior notification).
If you believe your personal data has been mishandled and you are not satisfied with our response, you have the right to lodge a complaint directly with the Dutch data protection authority:
We may update this privacy notice from time to time to reflect changes in law, platform features, business practices, or to provide greater clarity. When we make changes, we will:
Your continued use of our booking platform after the effective date of an updated notice constitutes your acknowledgement of the changes. We encourage you to review this notice periodically.
The most current version of this notice is always available at: yourbookingplatform.com/privacy
| Version | Date | Summary |
|---|---|---|
| v1.0 | November 2023 | Initial end-customer privacy statement published on the booking platform |
| v3.0 | April 2026 | Full rewrite — GDPR-compliant with lawful basis table, retention timelines, Zoe.AI disclosure, WhatsApp policy, children's privacy, cookie policy, full rights guide, and supervisory authority contacts |