Privacy Policy

ByNoon (sole proprietorship / eenmanszaak, Netherlands), trading as Salsa Seda — info@salsaseda.com.

We process personal data only as far as needed to run the website, your account, your bookings, and payment processing. There is no ad tracking, and we set no analytics cookies.

The website is hosted by Vercel Inc. When you visit, the hosting provider automatically processes technical data (IP address, browser type, access time) in server log files to deliver the site securely. Videos and larger media files are delivered through Cloudflare R2 (Cloudflare, Inc.), which processes technical connection data including your IP address. Legal basis: legitimate interest in stable, secure operation (Art. 6(1)(f) GDPR).

On your first visit we ask what may be set. We keep your choice only in your own browser, never on our servers, and you can change it at any time. Technically necessary session cookies for signing in are always set and carry no tracking (§ 25(2) no. 2 TDDDG). We currently set no analytics or advertising cookies; if we ever introduce analytics, it will run only after your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Bookings require an account. We process your email address, name, language preference and — if you set one — a password (stored only as a cryptographic hash). Account and booking data are stored with Supabase (EU region). To look after you properly we may keep internal notes on your account, for example arrangements we have made; they are visible only to us. Legal basis: performance of contract (Art. 6(1)(b) GDPR) and, for the notes, legitimate interest in running the classes reliably (Art. 6(1)(f) GDPR).

For a purchase we process product, price, payment status and — for subscriptions — subscription month, next charge, and plan. We keep an account of your hours: all hours you receive (purchase, subscription month, extra hours), every booking and cancellation with the hours it used, every reservation, and the validity of each. Your current balance and your history in your account are derived from it. Payment itself is handled by Stripe Payments Europe, Ltd.; your card details never reach us. Stripe receives the data needed for the payment (email, amount, payment method) and, for subscriptions, stores your payment method for recurring charges. Refunds are made the same way. Legal basis: performance of contract (Art. 6(1)(b) GDPR). Details: Stripe's privacy policy.

Booking confirmations, receipts, and account emails are sent via Resend (Resend, Inc.), which processes the recipient address and email content. As proof and for troubleshooting we also record which kind of email we sent, to which address, and when. Legal basis: performance of contract (Art. 6(1)(b) GDPR) and legitimate interest in traceable delivery (Art. 6(1)(f) GDPR). You can turn off confirmations for bookings made from your balance in settings; receipts and notices about your contract (e.g. charges, cancellations, price changes) are always sent.

We also show you purchases, the events of your contract, and new posts as notifications in your account (with time and read status). Legal basis: performance of contract (Art. 6(1)(b) GDPR).

If you write back to us, your email arrives in our mailbox at Google Workspace (Google Ireland Ltd.). We process its content and sender address there in order to reply. Legal basis: legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), or performance of contract where the enquiry concerns one (Art. 6(1)(b) GDPR).

We send the newsletter only with your consent using double opt-in: you are subscribed only after clicking the confirmation link. As proof we store the time, IP address, and browser of the sign-up and confirmation; a sign-up you never confirm is deleted after 7 days. Every email contains an unsubscribe link; consent can be revoked at any time. When you unsubscribe, we keep the time and IP address of it as proof. Deleting your account deletes your sign-up with it. Legal basis: consent (Art. 6(1)(a) GDPR).

If you cancel through the "Cancel contracts here" button, we process your email address, your name, the declaration itself, and any reason you give, along with the time, IP address, and browser. This is needed to confirm receipt as the law requires and to match the cancellation to your contract. Legal basis: performance of contract and legal obligation (Art. 6(1)(b) and (c) GDPR, § 312k BGB).

When you create an account and when you purchase, we log the acceptance of the then-current terms and privacy versions (with time, IP address, browser and a document snapshot) to meet legal evidence obligations. Legal basis: legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).

On request, your account provides a private calendar URL. Anyone who knows this URL can see your booked dates — do not share it, and regenerate it in settings if needed.

Contact buttons open WhatsApp or Instagram (Meta Platforms Ireland Ltd.) in your own app or browser; the studio addresses link to Google Maps (Google Ireland Ltd.). None of these services is embedded. Data is processed by them only once you actively open a link; their own privacy policies then apply.

Some of the providers named above are based in, or process in, the United States — this concerns Vercel Inc., Cloudflare, Inc., Resend, Inc., and, depending on the data centre, Google. Where personal data reaches a third country, we rely on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR, together with the technical and organisational measures agreed in each contract; where a provider is certified under the EU-US Data Privacy Framework, on an adequacy decision under Art. 45 GDPR. We have data processing agreements under Art. 28 GDPR with every provider. Copies of the safeguards are available on request at info@salsaseda.com.

Our database and file storage (Supabase) are in the EU (Frankfurt), and payments run through Stripe Payments Europe, Ltd. in Ireland.

Fonts are served from our own hosting — no requests are made to third-party font services when you visit.

We store account, booking, and hours data as well as notifications for as long as your account exists. Invoice and payment data are subject to statutory retention periods. Records of consents and cancellations are kept for as long as they are needed as proof. You can delete your account yourself in settings; we then erase your personal data unless retention obligations require otherwise.

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection supervisory authority. Consent you have given can be revoked at any time with effect for the future.

Questions? info@salsaseda.com