Legal
Privacy policy
BODYFIX respects your privacy and handles your personal data carefully. This policy explains what data we process, why and how. Questions? Email info@bodyfix.nl.
1. Data controller
BODYFIX (sole proprietorship of Agnieszka Kadula)
Chamber of Commerce number: 85741485
Legmeerplein 7H, 1058 NJ Amsterdam (main location and reception)
Haarlemmermeerstraat 115H, 1058 JV Amsterdam
Telephone: +31 6 5580 4938
Email: info@bodyfix.nl
BODYFIX is not required to appoint a Data Protection Officer (DPO), because we do not fall within the categories in Article 37 GDPR. For data protection questions, contact the email address above.
2. What data do we process?
a) Data you provide
- Name, address and contact details (telephone, email)
- Date of birth (for pregnancy treatments and age verification)
- Photos and videos — only with your explicit consent, for before/after documentation or promotional purposes
- Your appointments: which treatment, when and where
- Messages you send us by email, WhatsApp, Instagram or Facebook
- Payment information (processed by the booking system and our payment provider; we do not store full payment details)
b) Automatically collected data (website)
- IP address, browser type and device information when visiting bodyfix.nl
- Your cookie choice, recorded in the necessary bodyfix_consent cookie. This does not measure browsing behaviour
- Page usage through statistics and marketing scripts — only if you consent in the cookie banner; see Section 6
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Performing the treatment agreement and keeping booking records | Performance of a contract (Article 6.1.b) |
| Tax administration (retention of invoices and payments) | Legal obligation (Article 6.1.c) |
| Client communication by telephone, email, WhatsApp, Instagram or Facebook | Performance of a contract (Article 6.1.b) |
| Marketing and promotion on social media (our own channels) | Legitimate interest (Article 6.1.f) |
| Reviews on our site: we show a selection of Google reviews, with the name displayed alongside the review. If you no longer want your review on our site, email us and we will remove it | Legitimate interest (Article 6.1.f) |
| Newsletter (if subscribed) | Consent (Article 6.1.a) |
| Use of photos/videos for promotional purposes | Consent (Article 6.1.a) |
| Functional website cookie (your cookie choice) | Legitimate interest (Article 6.1.f) |
| Statistics and marketing through tracking scripts (Google Tag Manager, Meta pixel) — see Section 6 | Consent (Article 6.1.a) |
4. Health information
We do not record information about your health. If you tell us something about your health before or during treatment, such as a pregnancy or procedure, we use it only to adapt your treatment. The name of a treatment you book, such as Lipoedeem Benen or postpartum massage, may reveal something about your health. These appointments are in our booking system. We use them only for your appointments and retain them for as long as your other client data (Section 8).
5. Processors and third parties
We share your data with third parties only when necessary to provide our services or when legally required. We enter into data processing agreements with all parties that process data on our behalf.
| Party | Purpose | Country |
|---|---|---|
| Da Vinci SalonSoftware (Bjootify online calendar, bjootify.com) | Booking system and till — appointment management, client records, payments | NL/EEA |
| Pay.nl | Payments: online payment when booking (iDEAL) and card payments at reception | NL |
| Hostnet | Email (info@bodyfix.nl) and our domain name | NL |
| Meta Platforms (WhatsApp, Instagram, Facebook) | Client communication: messages you send us through WhatsApp, Instagram or Facebook | US* |
| TikTok Ltd. | TikTok Login Kit and Content Posting API — access to and management of the official BODYFIX TikTok account for marketing purposes. OAuth tokens are processed by TikTok. | US/SG* |
| Google LLC (Google Tag Manager) | Measuring site usage. Our container (GTM-PG2T7VB4) also loads Google Analytics 4 (G-L86DEV3QK9) and Google Ads conversion measurement (AW-11411474037), connecting to google.com, google.nl, doubleclick.net and analytics.google.com. Loads only after you consent to statistics; Google Ads conversion measurement works only if you also allow marketing — see Section 6 | US* |
| Meta Platforms (Meta pixel) | Supports advertising measurement and personalised adverts (pixel 228475323323353, loaded through connect.facebook.net). Loads only after you consent to marketing — see Section 6. The pixel is not on our pages about legs & buttocks (cellulite), lipoedema, postpartum & C-section, pregnancy massage, after-liposuction massage and lymphatic drainage: no data is sent to Meta there, even with consent | US* |
* Transfers outside the EEA — see Section 7.
6. Cookies and tracking consent
By itself, bodyfix.nl places only one necessary cookie: the record of your cookie choice. This requires no consent and measures or shares nothing.
Measurement and marketing scripts (Google Tag Manager and the Meta pixel) are loaded only after you consent to the relevant category. Without consent, only the necessary cookie remains: those scripts are not on the page and no request is sent to googletagmanager.com, connect.facebook.net or facebook.com. Rejecting takes exactly as many clicks as accepting.
In fact, without consent, loading a page sends no requests at all to servers outside bodyfix.nl . Links you click yourself are excluded; they are listed below. This applies both before you make a choice and after clicking Reject all .
Each category is tied to one script and nothing else: statistics loads Google Tag Manager, marketing loads the Meta pixel. If statistics are off and marketing is on, Google Tag Manager will not load, and vice versa for the Meta pixel. Google Tag Manager also includes Google Ads conversion measurement: it counts a click on a booking button and works only if you allow both statistics and marketing.
One exception, in your favour: on our pages about Legs & buttocks (cellulite), Lipoedema, Postpartum & C-section, Pregnancy massage, After liposuction and Lymphatic drainage the Meta pixel is absent entirely, even if you enable marketing. Google Tag Manager does load on those pages if you consent to statistics.
If you click a booking button and have allowed marketing, the Meta pixel tells Meta that you have started booking (the InitiateCheckoutsignal). We do not add information such as the treatment name or what you book.
Some parts of the site take you to another provider, but only when you click them. That provider's privacy policy then applies:
- Google Maps. The map button on the contact page is an ordinary Google Maps link. There is no embedded map: opening a page does not load anything from Google Maps.
- Booking. The booking buttons open our online calendar on bjootify.com (Da Vinci SalonSoftware, see Section 5).
- WhatsApp, Instagram and Google reviews. These links open the Meta or Google service when you click them.
| Cookie or connection | Category | Purpose | Retention period |
|---|---|---|---|
| bodyfix_consent | Necessary | Records which categories you accepted or rejected. Stored as a cookie and in your browser's local storage | 6 months |
| Google Tag Manager | Statistics | Measures site usage. Loads only if you allow statistics — marketing alone is insufficient. The container then loads Google Analytics 4 and, if you also allow marketing, Google Ads conversion measurement, connecting to google.com, google.nl, doubleclick.net and analytics.google.com | See below* |
| Booking marker (local storage) | Statistics and marketing | Remembers for up to one hour that you clicked a booking button. If you arrive on our thank-you page within that hour, the site recognises a possible return from booking. This is not proof of a completed or paid appointment. Only works if you allow both categories. | 1 hour |
| _fbp, _fbc | Marketing | Meta pixel: links a visit to our site with the advert through which you arrived | Set by Meta* |
| Font (Mulish) | None — served by bodyfix.nl | The font is on our own server. No request is sent to Google Fonts, regardless of your consent choices. No cookie is placed for this | n/a |
* These retention periods are set by Google and Meta, not BODYFIX. We have measured which providers our Tag Manager container contacts; they are listed above and in Section 5. The cookies set by individual tags within that container have not yet been fully inventoried; this table will be updated once they have. If you withdraw consent, we remove at least _ga, _gid and _gat (statistics), and _fbp, _fbc, _gcl_au, _gcl_aw and _gcl_dc (marketing).
Changing or withdrawing your choice. We store your consent for up to six months, then ask again. You can change your choice at any time using the Cookie preferences button at the bottom of every page, or here: . If you withdraw consent, we remove the corresponding cookies and reload the page so that the scripts are also removed from memory.
7. Transfers outside the EEA
Some processors (Meta/WhatsApp, TikTok, Google) may process personal data outside the European Economic Area, including in the United States. These transfers are covered by Standard Contractual Clauses (SCCs) under Article 46 GDPR.
8. Retention periods
| Category | Retention period | Legal basis |
|---|---|---|
| Tax records (invoices, payments) | 7 years | Article 52 AWR (statutory retention requirement) |
| Your client record and appointments | 5 years after your last visit | Performance of your appointments and legitimate interest |
| Newsletter subscription | Until consent is withdrawn | Consent |
| Photos / videos (promotional) | Until consent is withdrawn | Consent |
9. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse. Our employees only have access to the data they need for their work.
10. Your rights
Under the GDPR, you have the following rights. You can exercise them via info@bodyfix.nl:
- Access — see which data we process about you
- Rectification — have inaccurate data corrected
- Erasure — request deletion of data (the right to be forgotten)
- Restriction — temporarily restrict processing
- Objection — object to processing based on legitimate interest
- Portability — receive your data in a commonly used format
- Withdrawal of consent — withdraw previously given consent (including for newsletters and photos) at any time
We will respond to your request within 4 weeks. If we refuse the request, we will explain why.
You also have the right to lodge a complaint with the supervisory authority: Dutch Data Protection Authority.
11. Minors
Our services are not aimed at people under 16. We do not knowingly process minors’ personal data without the explicit consent of a parent or legal representative (Article 5 UAVG).
12. No automated decision-making
BODYFIX does not use automated decision-making or profiling that has legal effects on you (Article 22 GDPR).
13. Required and optional data
The following data is required to provide a treatment and cannot be withheld: your name and telephone number. Without this information, we cannot book an appointment for you. When you book online, the booking system also asks for your email address to confirm your appointment.
Subscribing to the newsletter and consenting to promotional photos or videos is optional. If you book at reception, by phone or via WhatsApp, providing your email address is also optional.
14. Changes to this privacy policy
We reserve the right to change this privacy policy. The latest version is always available at bodyfix.nl/en/privacy. For material changes, we aim to inform you by email.
15. Contact
For questions about this privacy policy or to exercise your rights:
BODYFIX
Legmeerplein 7H, 1058 NJ Amsterdam
+31 6 5580 4938
info@bodyfix.nl
Lodge a complaint with the supervisory authority:
Dutch Data Protection Authority — autoriteitpersoonsgegevens.nl