Privacy policy

1. Who is responsible

The Blue Elephant (Sport, Lifestyle & Massages by Nathan) is the controller for the processing of your personal data. Our company details are listed at the top of this page. For any privacy question you can reach us by phone or WhatsApp, or by email once our address is listed.

2. Which data we process

• Booking details: your name, phone number, email address (optional), address or city for home visits, the treatment or lesson you choose, the preferred date and time and any notes you add.
• Communication: messages you send us by WhatsApp, phone, SMS or email.
• Health information you choose to share (for example injuries, complaints or pregnancy) so that a massage or training can be given safely.
• Client administration: appointments, invoices and payments.
• Technical data: your IP address and browser information in server logs, used only to keep the website secure and working.

3. Why we process your data and on what legal basis

• To handle your booking request and to perform the agreed session — necessary for the (pre)contractual relationship (Art. 6(1)(b) GDPR).
• To contact you about your appointment, changes or cancellations — same basis.
• To keep our financial administration — legal obligation (Art. 6(1)(c) GDPR), including the Dutch 7-year tax retention duty.
• To protect the website against abuse and spam — our legitimate interest (Art. 6(1)(f) GDPR).
• Health information is a special category of personal data. We only process it with your explicit consent (Art. 9(2)(a) GDPR), which you give by sharing it with us, and only to provide a safe treatment. You can withdraw that consent at any time.

4. How long we keep your data

• Booking requests that do not lead to an appointment: deleted within 6 months.
• Client and health notes: for as long as you are a client and up to 2 years after your last session, unless you ask us to delete them earlier.
• Invoices and financial records: 7 years, as required by Dutch tax law.
• Server logs: a maximum of 30 days.

5. Who we share your data with

We never sell your data and only share it when necessary, with service providers who process it on our behalf under a data processing agreement:

• Our web hosting provider, with servers in the European Union.
• Cloudflare, which delivers and protects this website. Cloudflare may process data outside the EU under the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
• Our email provider, used to send and receive booking emails.
• WhatsApp (Meta): if you choose to contact us via WhatsApp, Meta processes your messages under its own privacy policy.
• Authorities, only when we are legally required to.

6. Cookies and similar techniques

This website does not use analytics, advertising or tracking cookies, and does not load fonts or scripts from third-party trackers. We only use strictly necessary techniques: a temporary value in your browser’s session storage for the language-switch animation, and security cookies Cloudflare may place to block bots. Because these are functional only, no cookie consent is required under the Dutch Telecommunications Act.

7. Security

We take appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), secured servers, limited access and rate limiting on the booking form.

8. Your rights

You have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have your data deleted (“right to be forgotten”);
• restrict or object to processing;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting earlier processing.

9. How to exercise your rights or complain

Send your request to the contact details above. We respond within one month and may ask you to confirm your identity. If you are not satisfied with how we handle your data, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

10. Children

Lessons for children under 16 are booked by a parent or guardian, who provides the child’s details and gives consent on the child’s behalf.

11. Automated decision-making

We do not use automated decision-making or profiling.

12. Changes

We may update this policy. The latest version is always published on this page, with the date of the last update.