Privacy Policy

Miriam Olivia Brinksma (Eenmanszaak), Archipel 35-39, 8224 HJ Lelystad, Nederland. Email: [email protected]. I have not appointed a data protection officer, as there is no obligation to do so.

When you access the website, technical data is processed automatically: IP address, date and time, page accessed, referrer, browser and operating system. This is necessary to deliver the website and protect it against attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, functioning operation).

Hosting & technical platform: Abacus.AI, Inc., 201 Mission Street, Suite 2240, San Francisco, CA 94105, USA. The servers are located in the USA. A data-processing agreement is in place with the provider; the transfer to the USA is safeguarded by the EU Standard Contractual Clauses included in it. Data is encrypted in transit and at rest.

Platform script: on every page view the website loads a technically necessary script from the hosting platform (apps.abacus.ai). In doing so, your IP address and browser data are transmitted to Abacus.AI, Inc. in the USA. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable and secure website); transfer to the USA based on the EU Standard Contractual Clauses.

Retention of log files: 7 days, except in the case of security incidents, until they are resolved.

I use Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) as a content delivery network and security service. Traffic runs via Cloudflare’s servers; in particular the IP address and technical connection data are processed. Cloudflare also protects email addresses on the website against spam bots.

Legal basis: Art. 6(1)(f) GDPR (security, fast delivery).

Third country: USA. Cloudflare is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses are additionally in place.

Necessary cookies (login, language choice, storing your cookie decision) are set without consent. All other cookies and similar technologies are set only with your consent via the cookie banner. Details are in the cookie policy.

Legal basis: for necessary cookies Art. 6(1)(f) GDPR and the exception for strictly necessary storage; for all others your consent, Art. 6(1)(a) GDPR.

Consent tool: self-developed. Your decision and its timestamp are stored.

Withdrawal: at any time via the “Cookie settings” link in the footer.

For the membership I process name, email address, password (only encrypted as a hash), language preference, membership tier and time of registration.

Legal basis: Art. 6(1)(b) GDPR (contract).

Service provider: Abacus.AI, Inc. (the same platform as the hosting, see section 2); server location USA, safeguarded by EU Standard Contractual Clauses.

Retention: until you delete your account; after that only where statutory retention obligations exist (see section 15).

Bookings (e.g. bridal make-up): when you reserve a date via the booking form, I process your name, email address, phone number, wedding date, region and venue/postcode, distance, chosen package, number of additional people, your notes, the calculated amount and the payment status of the deposit. I use this data solely to carry out the booking, block the date, confirm it to you and prepare the final invoice. Retention: until the assignment is completed and thereafter in line with tax retention obligations (7 years for invoice data). Unpaid, abandoned reservations are deleted after 30 days at the latest.

Beauty-line orders (once sales are open): I process name, email address, phone number where given, delivery and billing address, ordered products, amounts, payment and shipping status and your notes in order to perform the purchase contract, send you the order confirmation and ship the goods. For this I pass your name and delivery address to the commissioned shipping provider. Retention: 7 years for invoice data (tax retention obligation), other data until the warranty periods expire.

Gift vouchers: when you buy a voucher, I process your name and email address, the recipient’s name, your personal message, voucher type and value, the voucher code, validity, payment and redemption status. I use this data to send you the voucher by email and to redeem it later. Retention: until the voucher expires or is redeemed and thereafter in line with tax retention obligations (7 years for invoice data). You enter your full payment details (e.g. card number) directly with the payment provider; I do not store them.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax retention obligations).

Payment provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. The provider also processes data under its own responsibility, e.g. for fraud prevention; its own privacy policy applies: https://stripe.com/privacy.

Third country: Stripe may also process data in the USA; basis EU-US Data Privacy Framework / Standard Contractual Clauses.

Online coaching: online sessions take place via Google Meet (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Your name or display name, email address, IP address and the video and audio data of the call are processed. I do not record sessions. Legal basis: Art. 6(1)(b) GDPR (contract). Google may also process data in the USA; basis EU-US Data Privacy Framework / Standard Contractual Clauses.

If you sign up for the newsletter, the Makeup Emergency Guide or the beauty-line waitlist, I process your email address and, where applicable, your first name. The Makeup Emergency Guide is linked to the newsletter; I point this out in the form.

Beauty-line waitlist: here I only store your email address. You receive a welcome email and a message as soon as the products can be ordered. You do not receive a regular newsletter through it. You can remove yourself at any time by emailing me.

Double opt-in (newsletter and Makeup Emergency Guide): you receive an email with a confirmation link. Only after you click it are you added. I log the time of sign-up and confirmation as well as the IP address in order to be able to prove your consent.

Content: looks, tutorials, product tips and news about my beauty line, approx. 1–4 times per month.

Legal basis: Art. 6(1)(a) GDPR (consent); logging Art. 6(1)(f) GDPR (proof).

Service provider: Abacus.AI, Inc. (see section 2). Your address is stored in my database on this platform and emails are sent via the platform’s email service; server location USA, safeguarded by EU Standard Contractual Clauses. I do not currently use an external newsletter tool. If that changes, I will add it here beforehand.

Unsubscribe: at any time via the link in every email. After that I delete your address; to prove earlier consent I may keep it for up to three years in a blocklist (Art. 6(1)(f) GDPR).

When you write to me, I process your details (name, email address, subject, message) in order to answer your enquiry.

Legal basis: Art. 6(1)(b) GDPR where it concerns a contract or its initiation (e.g. a collaboration request); otherwise Art. 6(1)(f) GDPR (answering enquiries).

Retention: deletion once the enquiry is settled, at the latest after 12 months, unless a retention obligation exists.

Enquiries via forms. When you send me an enquiry through a form, I store your details so I can make you an offer and organise your appointment (Art. 6(1)(b) GDPR). Enquiries that do not lead to a booking are deleted at the latest 12 months after our last contact. Data on booked and paid appointments is kept for as long as statutory retention obligations require.

If you use the “Withdraw contract” or “Cancel subscriptions” functions, I process your details in order to carry out the withdrawal or cancellation and confirm receipt to you.

Legal basis: Art. 6(1)(c) GDPR (legal obligation).

Retention: until the limitation periods expire, generally three years after the end of the contract.

Comments you write as a member are visible to others with your display name. I process reports of content in order to review them and inform the reporting person of my decision.

Legal basis: Art. 6(1)(b) GDPR (contract); reports and moderation Art. 6(1)(c) GDPR (obligations under the Digital Services Act).

Retention: until you delete the post or your account; removed content and reports for up to 6 months for traceability.

Some product links are affiliate links (marked with *). If you buy via such a link, I receive a small commission; the price does not change for you. No data that identifies you is stored on my website in this respect, and no data is transmitted to the partners when the page loads. Only when you click a link do you reach the page of the shop or partner network. The link contains my partner ID; the shop or network sets its own cookies in order to attribute the purchase to me. I only receive aggregated statistics (e.g. number of clicks and sales), no data that identifies you.

My partner programmes: Amazon Associates (Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg) for amazon.de and amazon.nl – as an Amazon Associate I earn from qualifying purchases; bol Partner Programme (bol.com B.V., Papendorpseweg 100, 3528 BJ Utrecht, Netherlands); in addition, partner programmes of individual retailers and brands (e.g. Sephora, MAC) run via affiliate networks such as Awin (Awin AG, Eichhornstraße 3, 10785 Berlin, Germany) or Partnerize (Performance Horizon Group Ltd., London, United Kingdom).

Country-based shop links. So that product links take you to a shop that delivers to your country, I determine the country your request comes from when you click a product link. For this I use the country code that my service provider Cloudflare derives from your IP address. I do not store your IP address or pass it on to other services. For statistics I count the click anonymously (product, page, country, shop). You can choose the shop country yourself at any time; your choice is then stored in a cookie in your browser. The legal basis is my legitimate interest in working shop links that suit you (Art. 6(1)(f) GDPR).

The respective shop or network is responsible for processing after the click; its privacy policy applies. Whether cookies may be set there is up to you in that shop’s cookie banner. Some providers (e.g. Amazon) may also transfer data to the USA.

The website contains links to my Instagram profile. These are simple links; no data is transmitted to Instagram when the page loads. Only when you click a link do the privacy provisions of Meta Platforms Ireland Ltd. apply.

You can contact me via a WhatsApp link. This is also a simple link: no data is transmitted to WhatsApp when the page loads. If you message me on WhatsApp, I process your phone number, your name and the content of your message in order to answer your request (Art. 6(1)(b) and (f) GDPR). WhatsApp is provided by WhatsApp Ireland Ltd.; its privacy provisions apply. I delete messages as soon as they are no longer needed, unless statutory retention periods apply.

On some pages you can review me via Trustpilot. The provider is Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark. The Trustpilot widget is only loaded if you have chosen “Accept” in the cookie banner (Art. 6(1)(a) GDPR); in that case your IP address and browser data, among other things, are transmitted to Trustpilot and Trustpilot may set cookies. Without consent you only see a simple link, and no data is transmitted to Trustpilot when the page loads. You can withdraw your consent at any time via “Cookie settings” in the footer. When you write a review, Trustpilot’s privacy provisions apply. There is also a simple link to my Google Business Profile (Google Ireland Ltd.); only when you click it do Google’s privacy provisions apply.

Reviews on the website: reviews that clients have written about me on Google or Trustpilot are shown on my website as text with the first name (sometimes with the initial of the surname). No widget is loaded for this and no cookies are set; a link takes you to the respective profile. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing genuine client experiences). If you would rather your review was not shown here, just message me and I will remove it.

With your consent I use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to understand how the website is used. The IP address is shortened (anonymised) in the process. Without consent Google Analytics is not loaded.

Legal basis: Art. 6(1)(a) GDPR (consent). Withdrawal via “Cookie settings”.

Third country: Google may also process data in the USA; basis EU-US Data Privacy Framework / Standard Contractual Clauses.

I do not sell data. Personal data goes only to the service providers named here, who work on my behalf and according to my instructions (processing on behalf under Art. 28 GDPR), to authorities where I am legally obliged, and to my tax advisor. Overview (service — provider — location / third country — basis):

Hosting — Abacus.AI, Inc. — USA — Standard Contractual Clauses

CDN and security — Cloudflare, Inc. — USA — EU-US Data Privacy Framework, Standard Contractual Clauses

Account/database — Abacus.AI, Inc. — USA — Standard Contractual Clauses

Online coaching (video call) — Google Ireland Ltd. (Google Meet) — Ireland (poss. USA) — DPF / Standard Contractual Clauses

Payment — Stripe Payments Europe, Ltd. — Ireland (poss. USA) — DPF / Standard Contractual Clauses

Sign-in with Google — Google Ireland Ltd. — Ireland (poss. USA) — DPF / Standard Contractual Clauses

Analytics — Google Ireland Ltd. (Google Analytics 4) — Ireland / USA — DPF / Standard Contractual Clauses

Newsletter and email delivery — Abacus.AI, Inc. — USA — Standard Contractual Clauses

Shipping of orders (once the shop is open) — commissioned shipping provider — EU — performance of contract

Affiliate links (only after your click, under the partners’ own responsibility) — Amazon, bol, Awin, Partnerize — EU / United Kingdom / poss. USA — privacy policy of the respective partner

Server log files — 7 days

Account data — until account deletion

Invoices and accounting records — 7 years (Dutch tax retention obligation)

Newsletter address — until unsubscribe; proof of consent up to 3 years

Contact enquiries — until resolved, max. 12 months

Withdrawal and cancellation — generally 3 years after the end of the contract

For an account I need name and email address, for bookings and voucher purchases also the details marked as required in the form; without them I cannot conclude the contract. All other information is voluntary.

Membership is only possible from the age of 16.

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)). Simply write to me at [email protected].

Where I process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert, exercise or defend legal claims. You can object to processing for direct marketing at any time without giving reasons.

You can lodge a complaint with a data protection supervisory authority, in particular in the EU country of your residence, your workplace or the alleged infringement. The authority responsible for me is the Dutch Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl.