Good to know
Privacy policy
How GRW Digital handles information about website visitors, salons and business contacts, and separates it from salons’ client and patient data.
1. Who is responsible?
Sovado is a brand and product of GRW Digital, registered with the Dutch Chamber of Commerce under number 42042001. Postal address: De Haar 55, 7823 CT Emmen, the Netherlands. This is a postal address only, not a visiting address. Email: info@sovado.nl. Company website: grwdigital.nl.
GRW Digital is the controller for its own website, business relationship management, account and billing administration and its own marketing. For content that a salon manages in Sovado about its clients, patients or staff, we generally act as processor on the salon’s behalf. We do not silently assume a different role.
2. What information and sources?
We distinguish information about a salon as a business from information about natural persons. A salon name, sole trader, personal business email address or home address can also be personal data. Calling information “business data” does not remove GDPR protection.
We receive information when you contact us, open an account or subscription, complete your business profile or supply information for publication. An authorised salon administrator may provide business contact and user details. A public source does not give us unrestricted reuse rights; when using another source, we inform the individual under Article 14 GDPR, within one month at the latest and earlier if we contact them or disclose the information.
- Business relationship and account information: salon name, business contact, email address, account identifier, permissions, selected plan and correspondence.
- Administrative information: business and billing details, Chamber of Commerce and any VAT information, invoices and payment statuses needed for our own services.
- Public profile information: only information the salon makes available for publication, such as trading name, logo, website, description, services, opening hours and a public business location or town.
- Technical and preference information: including IP address, browser information, requested page, cookie choice, time and evidence of consent, withdrawal or objection, insofar as necessary for the relevant purpose.
3. Purposes and legal bases
We connect each use to a specific purpose and a valid legal basis. A contractual licence for a logo or business profile is not automatically consent to processing personal data. A privacy notice describes processing; reading or accepting it is not general consent.
- Handling a request and performing an agreement: Article 6(1)(b) GDPR where you are the contracting party or request pre-contractual steps. For contacts and employees of a business customer, where appropriate we use Article 6(1)(f) GDPR: our interest in proper business communication and management of the customer relationship.
- Our own billing, tax administration and legal obligations: performance of the agreement and Article 6(1)(c) GDPR where a specific legal obligation applies.
- Secure operation, prevention of misuse and handling legal claims: Article 6(1)(f) GDPR, after assessing necessity, less intrusive alternatives and the interests of individuals. This does not justify unrestricted monitoring.
- Public profiles, customer references and direct marketing: only within the limits below and on a separately assessed legal basis. Where consent is required, we use Article 6(1)(a) GDPR and request specific, freely given consent in advance.
4. Salon directories, listings and booking platforms
GRW Digital may use business profile information made available by the salon for publication in its own public salon directories, listings and booking platforms. The purpose is to make salons discoverable and comparable and allow visitors to open a profile, website or booking option. Published information is visible to visitors and may be indexed by search engines.
Before first publication, the salon receives information about the relevant service, the information to be shown and how to request correction or opt out. We do not use non-public contact details, private addresses, financial information or internal business information for this purpose. For information identifying a person, we separately assess the legal basis; optional publication of personal profile information requires prior specific consent.
This is not permission to sell salon information to third parties, use it through another independent operator or use it for a new incompatible purpose. Republishing this notice alone does not release existing information for new purposes. Correction, withdrawal or opting out is available free of charge at info@sovado.nl.
5. Customer references and advertising
Where validly agreed, we may use a public salon name and logo supplied for publication to identify the business customer relationship with Sovado. This permission for brand use does not cover invented endorsements, client records, individual staff members, portraits, results or case studies. Such additional publications require a separate agreement.
Electronic advertising requires prior consent unless the statutory exception for our own similar services to existing customers applies. In that case, the address must have been obtained during a sale and an opt-out must be available at collection and in every message. Having an account, requesting information or accepting general terms does not itself constitute advertising consent.
You can easily unsubscribe in every advertising message or email info@sovado.nl. If you object to direct marketing, we stop processing for that purpose, including related profiling. Withdrawing consent is free and as easy as giving it. Withdrawal is not retroactive; necessary service messages may still be sent.
We do not upload salon client or patient databases to advertising platforms or use that information for our own marketing. Cookie choices are separate from email consent and consent to publish personal data.
6. Salon client and patient data
Client names, salon clients’ contact information, appointments, treatment information, health data, photographs, payment information and notes managed by a salon in Sovado are not public salon information for our marketing. The same applies to staff records. This information is processed for the salon in accordance with its lawful instructions and the data processing agreement.
For questions or rights concerning a salon record, contact the salon first. We assist the salon and do not independently decide what happens to its records unless the law requires it. Use of that content for our own advertising, public listings or training general-purpose AI models is excluded.
7. Website, contact and cookies
The demo and pilot forms send the contact and salon details you enter from this website to Sovado by email. We use your details and explanation to review your application and contact you. The pilot also asks about your salon type, team size, current workflow and motivation. An application does not create an account. Separate email links open your own email application. Do not include more personal data than necessary or include client or patient records in your application.
When you visit the website, the web server receives technical request information, including your IP address. The current first-party code of this commercial website contains no active analytics service or advertising pixel. The homepage loads the Font Awesome icons from this website, without connecting to an external icon service. Exact logging, retention and any international transfers involving hosting still require confirmation.
Help centre search filters locally while you type. If you submit a search, the query appears in the URL and may enter browser history and server logs. Do not use client or patient data as search terms. Your language choice appears in the URL. The cookie policy describes the necessary preference cookie and the session cookies that protect the demo and pilot forms.
8. Recipients and international transfers
Appropriate hosting, email, payment and support services may be used to provide the service. They receive access only for their necessary task. Providers processing personal data on our behalf require processing agreements. A payment provider may act as an independent controller for its own legal duties. Actual providers, roles and locations are not yet specified in this overview.
A public salon profile or customer reference is shared with the public within the limits described above. Those publication provisions do not release confidential salon data. We may disclose information to comply with a specific legal obligation or a necessary legal claim, limited to what is required.
Personal data may be transferred outside the European Economic Area only with a valid transfer basis, such as an applicable adequacy decision or standard contractual clauses with the required assessment and supplementary safeguards. This notice does not confirm a particular storage location or existing transfer arrangement. You can request information about applicable safeguards and a copy of them at info@sovado.nl.
9. Retention and security
Information is not retained longer than necessary for its purpose. Where an exact period has not yet been established, the criteria below apply; actual deletion periods and the backup cycle still require checking. A possible future marketing wish is not a reason to retain all system data indefinitely.
We must apply appropriate technical and organisational safeguards, restrict access to authorised persons and handle incidents under the GDPR and processing agreements. This notice does not guarantee that security incidents are impossible or confirm any unverified certification, encryption method or backup frequency.
- Requests and correspondence: as long as needed to handle the enquiry and substantiate relevant agreements or claims; not automatically added to a marketing database.
- Account and contract information: during the customer relationship and afterwards only for necessary closure, a specific statutory retention duty or a legal claim.
- Our own basic tax records: generally seven years from the legally relevant starting point; any applicable longer statutory period takes precedence. This concerns our administration, not a general retention period for salon client records.
- Public profiles and references: while the agreed purpose, legal basis and consent or licence remain valid. Following withdrawal or expiry of the purpose, we stop new use and remove publications under our control without undue delay.
- Marketing preferences: for the permitted marketing purpose until unsubscribe or loss of the legal basis. Afterwards, we retain only minimal evidence and a suppression record where necessary to respect your objection and demonstrate compliance; this is not an active marketing profile.
- Cookie preference: 180 days after a saved choice. Information processed on behalf of salons: in accordance with their lawful instructions, the data processing agreement and agreed deletion from active storage and backups.
10. Your rights and objections
Subject to statutory conditions, you can request access, correction, deletion, restriction and portability of your personal data. You can object to processing based on legitimate interests. Your right to object to direct marketing is unconditional; we then stop using that information for that purpose.
Email your request to info@sovado.nl. We respond without undue delay and at the latest within one month of receipt. If complexity or the number of requests legally permits an extension of up to two further months, we inform you within the first month and explain why. We request further identification only where necessary and proportionate; do not send a full identity document without being asked.
You can complain to the Dutch Data Protection Authority or another competent supervisory authority. Information necessary for a contract or legal duty may be required to provide the service. Optional publication or marketing is not a condition of normal use of Sovado. These marketing provisions do not authorise solely automated decisions with legal or similarly significant effects.
11. Changes
The version date is shown at the top. We inform individuals about material changes before new processing starts and request fresh consent where required. Amending this notice does not automatically expand existing consents, contractual licences or processor instructions.