Privacy Policy

1. Who we are

Lale Kapsalon (Lode Vleeshouwerslaan 15, 2900 Schoten, Belgium) uses the Callyndar platform to manage online reservations. This privacy policy explains how your personal data is collected and processed when you interact with our website and booking system.

2. Data controller

Lale Kapsalon is the data controller for the personal data collected through this website. Callyndar BV acts as a data processor on behalf of the restaurant.

For privacy inquiries, contact us at: info@kapsalon-lale.be

3. What data we collect

When you make a reservation, we collect:

• Your name and email address
• Phone number (if provided)
• Reservation details (date, time, party size)
• Special requests or dietary requirements

We also collect technical data such as your IP address, browser type, and device information for security and analytics purposes.

4. How we use your data

Your data is used for the following purposes, each with a specific legal basis under GDPR Article 6:

• Processing and confirming your reservation — performance of a contract
• Booking confirmations and reminders — performance of a contract
• Contacting you about changes — performance of a contract
• Security, fraud prevention, analytics — legitimate interest
• Legal compliance (tax records) — legal obligation

We do NOT use your data for automated decision-making or profiling (GDPR Article 22).

5. Data sharing

Your data is shared with Callyndar BV as our reservation platform provider under a GDPR-compliant Data Processing Agreement. We do not sell your personal data.

Sub-processors:

• Supabase (Germany, EU) — hosting & database
• Resend (US) — transactional email
• Stripe (Ireland/US) — payment processing (only if deposits)

6. International transfers

Some sub-processors (Resend, Stripe) may transfer data outside the EEA. All transfers are covered by the EU Standard Contractual Clauses (SCCs) adopted by the European Commission.

7. Data retention

Reservation data is retained for up to 24 months after your visit. Financial records are retained for 7 years per Belgian tax law. You may request earlier deletion — see Section 9.

8. Cookies

This website uses only strictly necessary cookies (session, language, CSRF). These do not require consent. No marketing or third-party tracking cookies without explicit opt-in.

9. Your rights under GDPR

As a data subject, you have the following rights — free of charge:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18)
• Portability (Art. 20)
• Objection (Art. 21)
• Withdraw consent (Art. 7(3))
• Complaint with the Belgian DPA

Contact us at info@kapsalon-lale.be to exercise any right. We respond within 30 days.

10. Security

We implement appropriate technical and organizational measures (TLS, encrypted storage, restricted access, audit logging). In the event of a breach, we notify you within 72 hours (GDPR Art. 33–34).

11. Platform provider

This website runs on Callyndar (callyndar.com). For platform-level questions, see callyndar.com/privacy.

12. Changes

We may update this policy. The date above reflects the latest revision. Material changes are communicated via email or a notice on this site.