Version 2.0 · September 2026 · Convenience translation — the German version governs.
ByNoon (sole proprietorship / eenmanszaak, Netherlands), trading as Salsa Seda — info@salsaseda.com.
We process personal data only as far as needed to run the website, your account, your bookings and payment processing. There is no ad tracking and there are no analytics cookies.
The website is hosted by Vercel Inc. When you visit, the hosting provider automatically processes technical data (IP address, browser type, access time) in server log files to deliver the site securely. Legal basis: legitimate interest in stable, secure operation (Art. 6(1)(f) GDPR).
Bookings require an account. We process your email address, name, language preference and — if you set one — a password (stored only as a cryptographic hash). Account and booking data are stored with Supabase (EU region). Legal basis: performance of contract (Art. 6(1)(b) GDPR). We set technically necessary session cookies for sign-in; they contain no tracking. Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(b) GDPR.
For a booking we process product, date, price and payment status. Payment itself is handled by Stripe Payments Europe, Ltd.; your card details never reach us. Stripe receives the data needed for the payment (email, amount, payment method) and, for subscriptions, stores your payment method for recurring charges. Legal basis: performance of contract (Art. 6(1)(b) GDPR). Details: Stripe's privacy policy.
Booking confirmations, receipts and account emails are sent via Resend (Resend, Inc.), which processes the recipient address and email content. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
We send the newsletter only with your consent using double opt-in: you are subscribed only after clicking the confirmation link. As proof we store the time, IP address and browser of the sign-up and confirmation. Every email contains an unsubscribe link; consent can be revoked at any time. Legal basis: consent (Art. 6(1)(a) GDPR).
When you create an account and when you purchase, we log the acceptance of the then-current terms and privacy versions (with time, IP address, browser and a document snapshot) to meet legal evidence obligations. Legal basis: legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR).
On request, your account provides a private calendar URL. Anyone who knows this URL can see your booked dates — do not share it, and regenerate it in settings if needed.
Contact buttons open WhatsApp or Instagram (Meta Platforms Ireland Ltd.) in your own app or browser. Data is processed by these services only once you actively open them; their own privacy policies then apply.
Fonts are served from our own hosting — no requests are made to third-party font services when you visit.
We store account and booking data for as long as your account exists. Invoice and payment data are subject to statutory retention periods. You can delete your account yourself in settings; we then erase your personal data unless retention obligations require otherwise.
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection supervisory authority. Consent you have given can be revoked at any time with effect for the future.
Questions? info@salsaseda.com
