Data.
Privacy.
Data controller
Contact VitalitySpa at info@vitalityspa.nl with questions about your information or a privacy request.
Profile and enquiry
For your initial enquiry we ask for six details: weekly working hours, your main wish, available time, town or city, name and email address. Budget, further work and visit preferences and wellbeing answers are optional. Only answers you provide are stored. On submission we also keep the language, reference and the date and version of your consent. We use this information to handle your enquiry, prepare a proposal and communicate with you. Information necessary for the service you request is processed to take steps at your request before an agreement and, after acceptance, to perform that agreement.
Wellbeing information
Questions about energy, sleep, feeling rested and switching off from work are voluntary. Weekly check-ins and personal reviews are optional too. These answers may reveal information about your health, so we ask for separate, explicit consent. We use them only for your personal profile, your own overview and agreed personalisation and follow-up. You can skip questions and sign up without these wellbeing answers. The form does not ask for diagnoses, medication, weight or medical records. Please do not provide these in free-text fields.
How answers are assessed
Your answers reflect your own experience. We do not diagnose, calculate a medical health score or make solely automated decisions with legal or similarly significant effects. Proposals and written reviews are prepared by an authorised administrator.
My VitalitySpa, visits and follow-up
We retain the profile, dated and versioned changes, shared proposals and the customer’s response. Confirmed bookings include the date, time, venue and practical visit information. Further visit requests record their handling status. Visit feedback, optional check-ins and published reviews remain linked to the account. Internal notes are not automatically visible to the customer.
Access and security
A personal email link opens My VitalitySpa. The link can be used once and expires after no more than 30 days. A new link replaces previous access. After opening, the secure session remains active when the page is refreshed. It ends after 30 minutes of inactivity, after a maximum of eight hours, or on sign-out. The access code is removed from the address bar; a necessary session cookie identifies the signed-in user. Account information is not kept in browser storage. Do not share access links. Enquiries and account information are stored in a protected area of the hosting server. Authorised administrators use secured administration. Hostinger provides hosting and email and processes the technical information needed for those services.
Data sharing
Your intake, check-ins and full history are not automatically sent to spas or other providers. Before a booking, we explain which information is needed and which provider receives it. Any additional sharing of wellbeing information or a staff report requires separate arrangements and your specific consent. Employers do not receive access to your individual profile, wellbeing answers or personal reviews. We do not sell your information.
App updates, partners and companies
A separate app-updates registration collects your email address and region. With your consent, we use these for news about the future app. Partner and company enquiries collect a company name, contact details, region and optionally a website and message. We use these for the requested communication about working together. These enquiries do not provide consent to the processing of personal wellbeing information. You can withdraw permission by email.
Withdrawing consent
You can withdraw consent to wellbeing information in My VitalitySpa or by emailing info@vitalityspa.nl. We then stop processing based on that consent and remove the relevant wellbeing answers, check-ins and personal review text from the active account record. Practical enquiry and booking details may remain for the requested service or a legal obligation. Email us to request deletion of the entire account. Withdrawal does not affect the lawfulness of earlier processing.
Retention
Personal enquiry and account information is retained for 365 days after the latest genuine customer activity. This includes an enquiry, a saved profile change, submitted check-in or feedback, recorded customer contact and a completed visit. For bookings, the latest confirmed visit date, booking confirmation, cancellation or completion also counts. This keeps a future confirmed booking available. After cancellation, the cancellation date counts rather than the cancelled future visit date. Internal drafts, simply opening the account, reminders and an open status do not extend the period. App-update, partner and company enquiries are retained for 180 days after receipt. Expired records are removed during a subsequent enquiry, administration session or account action. Email and exports are also reviewed for retention. Legally required administrative records may have a different retention period. Earlier deletion can be requested.
Technical information
To limit misuse, the application temporarily uses protected derivatives of the IP address, email address and account reference. These limit excessive submissions, emails and account actions. The hosting provider may keep technical access and security logs. We use no advertising or analytics trackers. Secured administration counts existing enquiries, proposals, visits and follow-up tasks to organise the service. See our cookie information.
Privacy rights
You can request access, correction, deletion, restriction or transfer of your information and object where applicable. We may ask for information to verify your identity and normally respond within one month. You can complain to the Dutch Autoriteit Persoonsgegevens.