Privacy Policy
Your privacy matters. This policy explains how Golden Age Rituals collects, uses, and protects your personal data in line with the AVG/GDPR.
Last updated: April 2026
Our Commitment to Your Privacy
At Golden Age Rituals, we are committed to protecting your privacy and the confidentiality of your personal and health information. This Privacy Policy sets out how we collect, use, and safeguard your data in accordance with the General Data Protection Regulation (GDPR / AVG) and applicable Dutch privacy law.
Controller:
Golden Age Rituals, Roetersstraat 41, 1018 WB Amsterdam — hello@goldenagerituals.com
We do not appoint a formal Data Protection Officer (DPO) as we are not required to under Art. 37 GDPR. For any privacy-related requests, please contact us directly at the address above.
1. Data We Collect
Personal Identification Data
- ·Full name, email address, and phone number — provided when booking or contacting us.
- ·These are necessary to confirm and manage your appointment (Art. 6(1)(b) GDPR — performance of a contract).
Health & Wellness Information
- ·Health details relevant to your sessions (e.g. pregnancy, physical concerns, contraindications) — provided voluntarily before or during your appointment.
- ·This is special category data under Art. 9 GDPR. We process it solely to ensure safe and personalised service, on the basis of your explicit consent (Art. 9(2)(a) GDPR).
- ·You are never obligated to share health information, but withholding relevant details may limit the care we can offer.
Booking & Payment Data
- ·Appointment history and session records — processed and stored via Salonized, our GDPR-compliant booking platform.
- ·Payment data (including transaction amounts and confirmation status) — processed securely via Mollie, a licensed Payment Service Provider under PSD2. Golden Age Rituals does not store raw card data.
Website Usage Data
- ·Anonymised analytics data (page views, traffic sources) collected via cookies, to improve our website.
- ·This data does not identify you personally and is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
2. How We Use Your Data
To confirm, schedule, and manage your appointments — legal basis: performance of a contract (Art. 6(1)(b)).
To personalise your massage experience based on your preferences and health information — legal basis: explicit consent (Art. 9(2)(a)).
To communicate regarding your sessions, reminders, and aftercare — legal basis: performance of a contract and legitimate interest.
To process payments and maintain legally required financial records (7-year Dutch tax retention obligation) — legal basis: legal obligation (Art. 6(1)(c)).
To send marketing communications, newsletters, or wellness tips — only with your prior, freely given consent. You may withdraw consent at any time.
To comply with Dutch and EU legal and regulatory obligations.
3. How We Protect Your Data
All personal data is stored and processed using industry-standard encryption (TLS/SSL in transit, AES-256 at rest where applicable).
Booking data is securely managed via Salonized, which operates in compliance with GDPR and stores data within the European Economic Area (EEA).
Payment data is handled exclusively by Mollie B.V. (Amsterdam), a regulated PSP, and is never stored on our own systems. Mollie is PCI-DSS certified.
Access to personal data is strictly limited to authorised personnel on a need-to-know basis.
We do not sell, rent, or share your personal data with third parties for marketing purposes.
In the unlikely event of a data breach affecting your rights and freedoms, we will notify you and the Dutch Data Protection Authority (AP) within 72 hours, as required under Art. 33 GDPR.
4. Your Rights Under the AVG/GDPR
You have the following rights regarding your personal data
- ·Right of access (Art. 15): You may request a copy of all personal data we hold about you.
- ·Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
- ·Right to erasure (Art. 17): You may request deletion of your data, subject to our legal retention obligations (e.g. financial records).
- ·Right to restriction of processing (Art. 18): You may request that we limit how we use your data in certain circumstances.
- ·Right to data portability (Art. 20): You may receive your data in a structured, machine-readable format.
- ·Right to object (Art. 21): You may object to processing based on legitimate interests, including direct marketing.
- ·Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- ·Right to lodge a complaint: You may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
To exercise any of these rights, please contact us via the details below. We will respond within one calendar month, as required under Art. 12 GDPR.
5. Third-Party Processors
We work with the following carefully selected processors
- ·Salonized (salonized.com) — Appointment scheduling and client record management. GDPR-compliant, EEA-based. Data Processing Agreement in place.
- ·Mollie B.V. (mollie.com) — Payment processing. PCI-DSS certified, regulated by De Nederlandsche Bank (DNB). Data Processing Agreement in place.
- ·Analytics providers — Anonymised website traffic analysis. No personal data is shared.
- ·Email service providers — Used solely for appointment confirmations and communications you have requested.
All third-party processors are contractually bound by Data Processing Agreements (verwerkersovereenkomsten) in accordance with Art. 28 GDPR. Data is not transferred outside the EEA without appropriate safeguards.
6. Cookies
We use the following types of cookies
- ·Essential cookies: Required for core website functionality (e.g. session management). These cannot be disabled.
- ·Analytics cookies: Help us understand how visitors use our site. Used in anonymised, aggregated form. Placed only with your consent.
- ·Preference cookies: Remember your language or display settings.
You can manage cookie preferences via your browser settings at any time. Disabling non-essential cookies will not affect your ability to browse or book.
A cookie consent banner is shown on your first visit to obtain your consent for non-essential cookies, in compliance with the Dutch Telecommunicatiewet and ePrivacy Directive.
7. Data Retention
Client and appointment records are retained for up to 2 years after your last appointment, unless a longer period is required by law.
Financial and payment records are retained for 7 years to comply with Dutch tax and accounting obligations (Belastingdienst).
Health information shared during consultations is retained for the duration of your client relationship and deleted upon verified request, unless retention is required by applicable law.
Marketing consent records are retained for as long as you remain subscribed, and for up to 1 year after unsubscription as proof of consent.
8. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated version on our website and update the 'Last updated' date at the top of this page.
For significant changes affecting how we use your data, we will notify you directly where required by law.
Questions About Your Privacy?
If you have any questions, wish to exercise your rights, or have concerns about how your data is handled, please contact us. We aim to respond within one calendar month.
You also have the right to lodge a complaint with the Dutch Data Protection Authority: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl