How we handle
your data
Op dibaclinics.nl there are two forms: the contact form and the sign-up for the waiting list of the yearly promotion. What you fill in on the contact form reaches us as an email and nowhere else. Your email address for the waiting list goes to Mailchimp, and only if you sign up yourself. No profile we build, no field that quietly does something else.
Most of your data, by the way, sits somewhere other than this site. Below is where, and what happens there.
Weissenbruchlaan 166
3054 LS Rotterdam
Questions about your data go to info@dibaclinics.nl or by phone to 010-2038423. Do mention that it is a privacy request, so that it reaches the right person.
Where your data does end up.
With every place it says what sits there and where it goes.
Ours
This website
The choice you make on the cookie bar and the skin profile if you fill it in. Both stay in your own browser; that profile consists of choices from lists, without a name, email address or photo.
Where it goesNowhere. Clear your browser data and it is gone.
This website
The contact form
Your name, your email address, your phone number if you fill it in, the subject you choose and your message. Only if you send that form yourself.
Where it goesAs an email to the clinic, sent by Resend as processor. We keep the message in our mailbox and do not put it into a system or a list.
This website
The waiting list for the yearly promotion
Your email address, only if you sign up yourself on the page of the yearly promotion.
Where it goesTo Mailchimp, which we use to send our emails, as processor. Mailchimp may also process data outside the EU, with the safeguards the GDPR requires for that. You first get an email to confirm, and you can unsubscribe with one click at the bottom of every email.
Only with consent
Google and Microsoft
Which pages you view, where you get stuck and whether a visit through a Google ad leads to an appointment or an order.
Where it goesTo Google Analytics, Google Ads and Microsoft Clarity, not for personalised ads.
No cookie
Vercel
Which pages are viewed, from which country, via which site and on what kind of device. Without your name and without what comes after the address of a page.
Where it goesTo Vercel, which this website runs on, as processor. Vercel recognises a visit for 24 hours by a code made from your IP address and browser; after that only counts remain. Vercel may also process data outside the EU, with the safeguards the GDPR requires for that.
Booking system
Salonized
Your appointment details and the contact details you fill in when booking. Also the reviews you leave, because those are collected there.
Where it goesTo Salonized as processor, for scheduling appointments and tracking your programme.
Messaging
WhatsApp
What you send us, including photos if you attach them to a question about aftercare.
Where it goesVia WhatsApp, which has a privacy policy of its own that we do not control. If you want to share something sensitive, rather call.
Your file
At the clinic
What was discussed at the intake, what was measured, which treatments you have had and how your skin responded.
Where it goesThis stays in the clinic and is the only place where truly sensitive data sits. Only the people treating you look into it.
If you order something
The online shop
Your name, address, email address, phone number, what you order and whether the payment went through. You fill these in yourself on the checkout page of the online shop. On top of that, a cookie remembers the number of your basket for thirty days, so it stays there while you keep browsing. If you withdraw an order on the site, you fill in your name, your email address and your order number.
Where it goesTo Shopify, which runs the online shop and the checkout page for us, as processor. Shopify may also process data outside the EU, with the safeguards the GDPR requires for that. For delivery, your name and address go to PostNL. A withdrawal goes as an email to the clinic and as a confirmation to you, sent by Resend as processor. Payment goes through the payment service you choose; your card details never reach us. We do not link what you tell us in the clinic about your skin, your measurements or your photos to your order.
How longWe keep orders for seven years: an order is a sale, and sales fall under the tax retention obligation.
What is measuredIf you gave consent in the cookie bar on this site, your basket gets the number by which Google Analytics recognises your browser. That number is then also stored with your order. With that number, our measurement on the payment page passes your purchase on to Google Analytics: which products, the amount and a number for the order. That way we see whether a visit, for example through a Google ad, led to an order. If you withdraw your consent, the site removes that number from your basket. On the payment page, the cookies and the choice of that page also apply.
How long we keep your data
A medical treatment file has to be kept for twenty years, counted from the last time anything in it changed. That is not our choice: since 1 January 2020 it is in the law, in article 7:454 of the Dutch Civil Code. Before that it was fifteen years. What does not belong to such a file we keep for less time, and below it says per item why.
Your treatment file
Twenty years
Required by law under the Dutch Medical Treatment Contracts Act (article 7:454 of the Civil Code), counted from the last change in the file. This is not a period we are allowed to shorten.
Photos belonging to a treatment
Twenty years
Those belong to the file and fall under the same obligation. Photos you have separately allowed us to use outside your file are deleted as soon as you withdraw that permission.
Invoices and administration
Seven years
The retention obligation set by the Dutch tax authority.
What you message or email us
As long as the conversation runs, cleared out afterwards
No obligation; we keep it only as long as it serves a purpose.
Your sign-up for the waiting list
Until you unsubscribe
Your consent, which you give yourself by signing up and confirming. You can unsubscribe with one click at the bottom of every email, or by sending us a message.
Measurement data with your consent
At most fourteen months
Only if you have accepted the cookie bar. If you decline, Google and Microsoft measure nothing, so there is nothing for them to keep.
Vercel's visit count
24 hours for the code that recognises a visit
Our legitimate interest: knowing which pages help people, without following anyone. After that the code can no longer be traced back to your browser and only counts remain.
Six rights, wherever something sits.
You do not have to work out which party holds something. Put the question to us and we will find out.
Access
You may request which data about you exists and what happens to it.
Correction
If something is wrong, we have it changed.
Erasure
Where the law allows it. Parts of a treatment file are subject to statutory retention periods; we explain that rather than talking around it.
Objection
Against a processing you do not agree with.
Portability
Requesting your data in a readable file to use it elsewhere.
Complaint
If you do not reach an agreement with us, you can go to the Dutch Data Protection Authority. You always have that right, even without complaining to us first.
What we do with your data
No advertising profiles are built of you and nothing is sold on or traded. After your consent we measure how the site is used, and whether a visit through a Google ad leads to an appointment or an order. Google may not use that measurement for personalised ads. Without consent those scripts are not loaded; then only Vercel counts, without a cookie, which pages are viewed.
Your skin profile is deliberately not sent to us. That is the place where the temptation to ask for an email address is greatest, and so it does not happen.
Prefer to call? You can, on 010-2038423. See also the terms and conditions.