Privacy statement Cupmove

CUPMOVE is responsible for processing the personal data described in this privacy statement.

Trade name: CUPMOVE

Legal form: sole proprietorship

Owner: Nataliya Obraztsova

Chamber of Commerce number: 42169690

VAT ID: NL005553463B96

Email: info@cupmove.com

For questions about privacy or to exercise your privacy rights, please contact info@cupmove.com.

Depending on your contact with CUPMOVE, we may process the following data, among others:

Contact and identification data: name, email address, telephone number, date of birth if necessary and other data that you provide yourself.

Booking and customer data: treatment chosen, date and time of appointments, treatment duration, appointment history, packages, gift vouchers, discount codes, relocations, no-shows and necessary customer notes.

Payment and administration data: payment status, amounts paid, invoice data, transaction data to the extent that CUPMOVE receives it and data necessary for financial administration.

Communication data: content of emails, messages, booking requests, questions, complaints and other correspondence.

Technical data: insofar as this is processed via the website, booking environment or service providers used, for example necessary technical data for security, operation and fraud prevention. Information is provided separately for cookies and similar techniques, if applicable.

In order to assess whether a treatment can be carried out safely and responsibly, CUPMOVE may ask in advance about circumstances that are relevant to the treatment. This may, for example, concern pregnancy, medication use, blood thinners, allergies, skin problems or open wounds, thrombosis or vascular problems, cardiovascular problems, recent operations or medical procedures, relevant medical treatments, relevant oncological history and other circumstances that may affect the safety of the treatment.

Health data are special personal data and receive extra protection under the GDPR. CUPMOVE processes this health data only for the limited purpose of assessing and safely carrying out treatment, to the extent that this is necessary and there is both a valid GDPR basis for this and an applicable exception for special personal data.

For the regular intake of CUPMOVE, where the processing is based on it, explicit permission is requested. This consent is requested separately from the general terms and conditions and must be actively given by the customer.

You can withdraw consent for future processing at any time via info@cupmove.com. Withdrawal does not change the lawfulness of processing that took place before the withdrawal. If CUPMOVE cannot responsibly assess whether treatment is possible without the necessary health information, the treatment can be adjusted, postponed or refused.

CUPMOVE does not request more health information than necessary and does not make a medical diagnosis. The intake is not a medical file and CUPMOVE does not provide medical care.

CUPMOVE processes personal data only for clearly defined purposes and on an appropriate legal basis.

Booking and carrying out appointments and services: necessary for the execution of the agreement or to take steps at your request before concluding it.

Payments, invoicing and administration: execution of the agreement and, where applicable, legal obligations.

Intake and treatment safety: for ordinary personal data the applicable GDPR basis and, for health data, a valid exception for special personal data. Where CUPMOVE relies on explicit permission for this, this will be requested separately.

Questions, complaints and disputes: execution of the agreement and/or CUPMOVE's legitimate interest in good customer service and establishing, exercising or substantiating rights.

Security and business operations: CUPMOVE's legitimate interest in safe and reliable business operations, insofar as your interests and rights do not outweigh them.

Marketing: only when permitted under applicable rules and, where required, with prior consent.

CUPMOVE does not process more personal data than is reasonably necessary for the purpose in question. Where possible, unnecessary data is not requested or deleted.

CUPMOVE strives to keep personal data correct and up to date. You can have incorrect or incomplete data corrected.

Photos or videos in which a customer is recognizable will only be used for social media, website, advertisements or other promotional purposes if there is a valid basis for this and, where required, prior permission has been obtained.

Consent to recognizable marketing materials is voluntary, separate from consent to health data, and is not a condition for treatment. A refusal has no consequences for the service.

When use is based on consent, you can withdraw that consent for future use via info@cupmove.com. Withdrawal does not retroactively apply to previous lawful use. CUPMOVE will stop any future uses that required the revoked consent within its reasonable control.

CUPMOVE sends commercial electronic communications only when permitted by applicable regulations. If prior permission is required, it will be requested.

You can always unsubscribe via the unsubscribe option in the message or via info@cupmove.com.

CUPMOVE uses Salonized for online bookings and customer administration. In addition, CUPMOVE may use service providers for payment processing, accounting, email, hosting, IT, website functionalities and other supporting business services.

Depending on their role, these parties can act as processors of CUPMOVE or be independently responsible for certain processing operations. When a party processes personal data exclusively on behalf of CUPMOVE, CUPMOVE will make appropriate processing agreements where required.

CUPMOVE only shares personal data that are necessary for the service in question and assesses the efforts of suppliers based on privacy and security.

CUPMOVE does not sell personal data.

Data may, to the extent necessary and lawful, be shared with booking and IT service providers, payment service providers, accountant or administrative service providers, professional advisors and competent government authorities when a legal obligation requires this.

In the event of a legal dispute, relevant data may be processed or shared for the establishment, exercise or defense of legal claims, to the extent permitted by law.

It is possible that a supplier or a subprocessor engaged by that supplier processes personal data outside the European Economic Area (EEA).

Where a transfer occurs outside the EEA, CUPMOVE will ensure that a valid basis for transfer is used and, where required, appropriate safeguards apply, for example an adequacy decision or standard contractual clauses adopted by the European Commission.

You can request information about the safeguards that apply to a specific transfer via info@cupmove.com.

CUPMOVE does not store personal data for longer than is necessary for the purpose for which it was collected, unless a legal retention obligation or another valid reason requires longer storage.

Basic tax administration: data that are subject to the tax retention obligation are in principle kept for 7 years, calculated in accordance with the applicable tax rules.

Booking and customer data: are kept for as long as necessary for the customer relationship and service provision and then deleted or anonymized when they are no longer needed, unless a legal obligation or concrete legitimate interest makes longer storage necessary.

Intake and health data: are periodically assessed and not kept longer than necessary for treatment safety and the customer relationship. CUPMOVE uses a maximum of 2 years after the last treatment as a starting point, unless earlier removal is appropriate or longer storage is demonstrably necessary for a legal obligation or the establishment, exercise or substantiation of a legal claim.

Correspondence and complaints: are kept for as long as necessary for settlement and any subsequent legal questions and then deleted or anonymized when there is no valid reason for further storage.

Marketing consent: is kept for as long as necessary to demonstrate whether consent has been given or withdrawn and as long as the marketing processing in question is relevant.

Where personal data resides in different systems, deletion may take place in accordance with applicable backup and deletion cycles, provided that such data is not reused for normal business purposes in the meantime.

CUPMOVE takes appropriate technical and organizational measures to protect personal data against loss, unauthorized access, unauthorized modification, disclosure and other unlawful processing.

Security takes into account the nature, scope, context and risks of the processing. Health data is subject to increased requirements due to their sensitivity. Access is limited as much as possible to people and systems that need this data for their task.

CUPMOVE assesses a possible personal data breach in accordance with the GDPR. If a data breach is notifiable, it will be reported to the Dutch Data Protection Authority within the statutory period. When the GDPR requires that data subjects are informed, CUPMOVE does this as well.

To the extent that the GDPR provides for this in your situation, you have the right to information and access, rectification, deletion, restriction of processing, data portability and objection to certain processing. When processing is based on consent, you can withdraw that consent.

You have the right to object to direct marketing. After a valid objection, your personal data will no longer be used for direct marketing.

Privacy rights are not absolute in every situation. For example, CUPMOVE may be legally obliged to retain certain administrative data.

You can send a privacy request to info@cupmove.com. Please state clearly what your request relates to.

CUPMOVE may request additional information when reasonably necessary to verify your identity. No more information is requested than necessary.

In principle, CUPMOVE will respond within one month of receiving the request. If the GDPR allows an extension due to complexity or number of requests, you will be informed of that extension and the reason within the original deadline.

If you have a question or complaint about the processing of your personal data, please first contact info@cupmove.com so that CUPMOVE can investigate it.

You also have the right to file a complaint with the Dutch supervisory authority: the Dutch Data Protection Authority.

Not all requested information is mandatory. If certain information is necessary for the agreement, a legal obligation or to safely carry out a treatment, failure to provide this may mean that CUPMOVE cannot offer the service in question or cannot fully offer it.

You do not have to provide voluntary information.

CUPMOVE will not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or otherwise significantly affect you, unless this is later lawfully introduced and you are informed in advance in accordance with the GDPR.

When you provide personal data of another person to CUPMOVE, you are responsible for ensuring that you are lawfully providing this data. Do not provide personal data of others when this is not necessary.

The regular CUPMOVE bodywork treatments are aimed at adults. When CUPMOVE processes personal data of a minor in an individual situation, it is assessed which additional legal requirements apply, including any consent or involvement of a parent or legal representative.

CUPMOVE may adjust this privacy statement if the services, systems used, suppliers, legislation or data processing change.

The current version will be made available through the usual channels. If a change has significant consequences for those involved, CUPMOVE will inform them when this is legally required.

CUPMOVE

Owner: Nataliya Obraztsova

Chamber of Commerce number: 42169690

VAT ID: NL005553463B96

Email: info@cupmove.com

Version September 2026