Supplementary privacy notice for WhatsApp

1. Scope and controller

This supplementary privacy notice concerns the processing of personal data in connection with WhatsApp communication between you and New Yin & Yang (the Salon). It supplements the Salon’s general privacy notice. For the processing described here, New Yin & Yang (sole proprietorship, Dutch Chamber of Commerce no. 71941290), established at Amsterdamsestraatweg 193, 3551 CA Utrecht, the Netherlands, is the controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR). The Salon can be contacted at newyinenyang@gmail.com.

2. Categories of personal data

In this context, the Salon may process the content of your messages and our replies; your WhatsApp profile name; channel and message identifiers required for communication; timestamps, message statuses and data necessary to prevent duplicate processing; and your telephone number only to the extent that it is actually available.

The Salon does not automatically associate a WhatsApp identity with an existing customer record. A number available through WhatsApp is not automatically entered as the telephone number for an appointment. This occurs only if an expressly authorised Owner user verifies and records that number. Media files, including photos and voice messages, are not copied into the appointment system. Use of the WhatsApp Business app is separate from the storage in the appointment system described here.

The Salon does not diagnose medical conditions or provide medical advice. We do not specifically ask you to share health information through WhatsApp, and we do not extract a separate health record, health labels or lasting health attributes from your messages. Because WhatsApp allows free text, such information may nevertheless appear in a message; the raw message remains subject to the same restricted access and retention period. The Salon does not actively collect such information, does not ask for it, does not compile a health record or apply labels based on it, does not use it for advertising purposes or model training, and does not retain it for longer than any other message (no more than 48 hours). The basis for this is Article 9(2)(e) GDPR: the processing concerns personal data manifestly made public by the data subject through their own, unprompted message.

3. Purposes and lawful bases

3.1. When you request an appointment, the Salon processes the messages necessary to answer your request and prepare the appointment. Only the data needed for this purpose is processed: the message content, channel and message identifiers and, where available, the telephone number. The basis is Article 6(1)(b) GDPR: steps taken at your request before entering into a contract.

3.2. For other questions you send, such as opening hours or services, the Salon processes the correspondence necessary to answer you. The basis is Article 6(1)(f) GDPR: the Salon’s legitimate interest in answering an enquiry it receives. The specific interest is that the two expressly authorised Owner users can view and answer your message jointly and at the same time. This is necessary because relying solely on the WhatsApp Business app on one device does not allow both users to view and take over the same correspondence at once. Processing is limited to these two users; content remains accessible for no more than 48 hours and is not used for marketing or model training.

3.3. The Salon processes the necessary channel and message identifiers and statuses to deliver messages, establish delivery and receipt status, and prevent duplicate handling. A limited technical receipt without message content is retained for eight days. The basis is Article 6(1)(f) GDPR: the Salon’s legitimate interest in handling correspondence reliably and avoiding duplicate replies. The specific interest is to prevent a message re-sent by the provider from being treated as new or answered twice. Only a minimal identifier and status, without message content, is kept for this purpose; the eight-day period is aligned with the provider’s reasonably expected retry window.

3.4. The Salon does not use the content of WhatsApp correspondence for advertising profiles or training Flowdesk models, or include it in a marketing database. This clause concerns processing for which the Salon is responsible; WhatsApp/Meta and other providers’ own processing is governed by their applicable terms and privacy notices.

3.5. For an appointment that has been arranged, the Salon may send one reminder message on WhatsApp, shortly before it begins, to the mobile telephone number recorded for that appointment. Only the following is processed for this purpose: that telephone number, the name and address of the Salon, the date and time of the appointment, the language of the message, and the message identifier and status assigned by the provider. The message contains no advertising, no health information and no request for a reply. The basis is Article 6(1)(b) GDPR: the processing is necessary for the performance of the contract to which you are party, namely the appointment for which you have fixed a time. No reminder is sent if the appointment has been cancelled or deleted, if the number given cannot be established as a mobile number, or if the appointment was made within the period in which the reminder would be sent. At most one reminder is sent per appointment and start time.

4. Access, recipients and international transfers

Within the appointment system, access to recent correspondence is restricted to two expressly authorised users with the Owner role. Personal data may be processed by or made accessible to WhatsApp/Meta, 360dialog, Supabase and Vercel for the delivery of WhatsApp communication, technical storage and the appointment system.

According to the 360dialog Client Terms of Service applicable to the account (last updated 1 July 2026), the Salon has an agreement for this purpose with 360dialog GmbH, Tölzer Straße 1, 82031 Grünwald, Germany, which acts as processor under a separate data processing agreement concluded upon registration and administers the WhatsApp channels on the Salon’s behalf; the account accepted 360dialog’s latest customer terms on 21 September 2026. For that purpose, 360dialog exchanges data with WhatsApp/Meta, which operates the WhatsApp platform; the storage location currently registered for this channel is the United States.

Supabase hosts the technical processing and database applying the retention periods described below; the data processing agreement applicable to it forms part of its general terms. The Salon’s appointment system is hosted by Vercel. When the Salon sends you an appointment proposal on WhatsApp, the appointment system processes the details of that proposal, such as the treatment, the time and a name entered by the Salon, but not the content of your WhatsApp messages; Vercel may not process special categories of personal data. As far as currently known, no other recipients beyond those named above have been identified.

For the sending of the reminder message (clause 3.5), the telephone number, together with the message data referred to in that clause, is passed to 360dialog GmbH and WhatsApp/Meta on the same footing as described above.

Where personal data is transferred to the United States in this connection for the purposes of WhatsApp service delivery, WhatsApp LLC has publicly certified its participation in the EU-U.S. Data Privacy Framework (and the Swiss-U.S. Data Privacy Framework), which the European Commission recognises as an appropriate safeguard for transfers to certified U.S. recipients. The Salon’s direct agreement is with 360dialog GmbH (Germany, within the EEA).

5. Appointment proposals on WhatsApp

If the Salon sends you a proposal with reply buttons on WhatsApp, your selection is processed solely to handle that proposal. The proposal does not reserve the offered time. An appointment is formed only after you receive a separate final confirmation. The proposal is valid for five (5) minutes; its details remain readable for no longer than forty-eight (48) hours after expiry or handling and are removed from the online conversation record within one (1) hour after that period. A limited technical receipt without proposal content is retained for eight (8) days to recognise repeated selections. Once formed, the appointment is retained under the separate rules applicable to appointment records.

6. Retention periods

6.1. The content of each message remains readable in the appointment system for no longer than forty-eight (48) hours after receipt. Following that period, the content is removed from the online database within one (1) hour.

6.2. A limited technical receipt, without message content, is retained for eight (8) days to recognise repeated or delayed events. A completed appointment is a separate business record and is retained under the rules applicable to appointment records.

6.3. Removal from the online database does not alter backups already created at the same time. The most recent seven (7) days of daily database backups of the Supabase Pro project are accessible; a backup created before removal may therefore still contain the earlier content. Retention of the WhatsApp Business app itself, and of any platform or provider logs, is not separately managed, configured or archived by the Salon; these follow only the relevant application’s or provider’s own default settings and terms.

6.4. The Salon retains, in respect of a reminder sent, only a log entry containing the appointment, the start time, the status, the language and the provider’s message identifier, without telephone number and without message text. That log entry is retained for thirty (30) days and then removed. The retention periods of WhatsApp/Meta and 360dialog for the message itself are not managed by the Salon; their own terms apply.

7. Data subject rights

Subject to the applicable legal conditions, you may request access, a copy, rectification, erasure, restriction of processing or portability of your personal data. Where processing is based on a legitimate interest, you may object. Requests may be sent to newyinenyang@gmail.com. The Salon may require appropriate identity verification before handling a request. Data held in an existing appointment or in the WhatsApp Business app may require a separate assessment.

You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Amendments and effective date

The Salon may amend this supplementary privacy notice where changes in the service, processing activities or applicable law warrant it. The version published on the website will state the date on which it was last amended. This version takes effect on 30 September 2026.