Privacy statement
Which of your data we use, why, how long we keep it and what say you have in it.
In short
- We use your data to arrange and take payment for your visit, treatment or order.
- You only get the newsletter if you say yes to it yourself. You can unsubscribe any time in one click.
- On the website we measure anonymously how it is used. Only if you accept do we recognise you on a later visit.
- The booking page uses a few small cookies that do not know who you are.
- Only with your consent do we let Google and Meta measure which ads work, and may they show you our ads.
- We never sell your data.
- You can always ask which data we hold about you, and have it corrected or deleted.
Who we are
Thermen Binnenmaas is the trading name of FS Wellness B.V. We are responsible for what happens to your data (in law this is called the controller).
FS Wellness B.V., trading as Thermen Binnenmaas
Strijenseweg 109, 3295 KN 's-Gravendeel, the Netherlands
Chamber of Commerce (KvK) number 98124102
Do you have a question about your privacy? Please contact Cherise Krowinkel at cherise@thermenbinnenmaas.nl.
Booking and ordering online
You book your visit, treatment or package on our booking page (boeken.thermenbinnenmaas.nl). There you can also buy gift cards and products to collect from us. For this we use:
- your first name and last name;
- your email address;
- your phone number, if you give it;
- what you book or order: the day, the time, the number of people, treatments and packages;
- your comment, if you write one, and the language of the page;
- for a gift card: the recipient's name and the personal message, if you add them.
We put your booking into our reservation system (xPlan) and send you a confirmation. Our front desk gets a daily list of that day's bookings. We need this data to carry out our agreement with you (article 6(1)(b) GDPR).
Please do not put health information in the comment field. If there is something about your health we should know, for example for a treatment, please tell the front desk or your therapist instead.
Is our reservation system briefly unavailable? Then we keep your paid booking for a short time, until it is in xPlan. That takes 30 days at most. In that case we sometimes send a request to the front desk first; you then get a payment link once the desk has confirmed your booking.
Payment
You pay online through Mollie. Mollie receives the amount, a description of your booking or order, your name and email address, and the payment details you enter on its payment page. Mollie is itself responsible for those payment details and has its own privacy statement on mollie.com. We do not give Mollie your gift card code.
Emails about your booking
After your booking or order you get the emails that go with it: a confirmation, a reminder, a thank-you after your visit and, if needed, a message about a refund. You always get these emails, even if you do not want the newsletter. For each email we keep for 12 months whether it arrived, not the full text.
When you call, email or WhatsApp us
The website has no contact form. If you call, email or message us, we use your name, phone number or email address and your message to help you. We keep your message no longer than needed to deal with your question.
When our front desk is very busy, we sometimes forward the phone to the reception of F-S Fitness, next door on Strijenseweg. Their staff then note your booking or call-back request on our behalf: your name, address (postcode and house number), phone number, email address and what you would like. They pass it on to our front desk and then delete it: 14 days after it has been dealt with, or after 30 days at the latest.
WhatsApp is a Meta service. If you send us a WhatsApp message, WhatsApp's own terms and privacy policy also apply.
Applying for a job
If you apply by email, we use your data only for your application. If you do not get the job, we delete your data no later than 4 weeks after the application process ends. With your consent we keep it for up to 1 year, for a future vacancy.
The newsletter
You can sign up for our newsletter on the website or while booking online. When booking, the box for it is not ticked; you choose it yourself. If you sign up on the website, we first send you an email with a link. You are only signed up once you click that link.
We send you offers, our events calendar and news, at most twice a month. We only do this with your consent (article 6(1)(a) GDPR and article 11.7 of the Dutch Telecommunications Act). You can withdraw your consent at any time with the unsubscribe link at the bottom of every newsletter.
For the newsletter we use:
- your email address, your name if you give it, and your language;
- the topics you sign up for;
- the proof of your signup: the time, your IP address, the technical description your browser sends along (the user agent, for example browser, version and operating system) and the address of the page with the form. If you sign up while booking, the proof is the payment number of that booking and the time;
- whether a newsletter arrived, and which links you click.
We use the links you click to make the newsletter better. We also use them to decide the order in which we send the newsletter. For subscribers from our previous newsletter service, we look at their last click or open there. If you do not respond for a long time, we will eventually stop sending you the newsletter.
We want to know which newsletters work. So we compare the email address of every booking with the addresses in our newsletter list. We do that with an irreversible code (hash) of the email address. If the address does not belong to anyone on the list, we delete that code straight away. If it does, we link the booking to that person: the amount, the time, the type of product, the date of the visit and the booking number. If you clicked a link in a newsletter in the seven days before, we also link the booking to that email. We do this for every booking, also if you have unsubscribed but are still on our list. We do this based on our legitimate interest: knowing whether the newsletter works (article 6(1)(f) GDPR). You can object to it.
A small part of the subscribers (about 10%) deliberately does not get the newsletter for a while. That way we can measure what the newsletter achieves.
To keep our newsletter list up to date and to measure how often guests come back, we use a few details from our reservation system every day: your customer number, email address, the type of customer, whether you gave consent for the newsletter, and the date of your last and next visit.
Statistics
On this website
We want to know how visitors use the website, so we can improve it and see which pages lead to a booking. For this we use PostHog (servers in Frankfurt). At the bottom of the page you choose whether you agree.
- As long as you do not choose, or if you decline, we measure anonymously. Nothing of ours stays on your device, we keep no IP address and we cannot recognise you on a later visit. We see which pages are viewed and where buttons are clicked, such as Book or Call us. As long as you do not choose, links to the booking page carry the code of the ad click that brought you here (gclid, fbclid or msclkid); after Decline or with Do Not Track they do not. The booking page only keeps that code if you accept ads there. We do this based on our legitimate interest: a website that works well (article 6(1)(f) GDPR).
- If you accept statistics, we place a random number in your browser. That way we recognise you on a later visit and see which campaign or ad first brought you to us. If you click through to the booking page, we pass that number along, so we see your visit to the website and your booking as one visit. We only do this with your consent (article 6(1)(a) GDPR).
Links to the booking page always carry the campaign tags (utm_) of the address that brought you here, so we see which page or campaign led to a booking. If your browser sends Do Not Track or Global Privacy Control, we measure nothing unless you accept yourself. Names, email addresses and phone numbers never go into the statistics. You can change your choice at the bottom of every page under Cookie settings.
On the booking page
We want to know where visitors drop off, so we can make booking easier. That is why we measure how visitors move through the booking page, with PostHog (servers in Frankfurt). For this we use a random visitor code, not your name, email address or phone number. We do not keep IP addresses, we make no screen recordings and we do not store what you type into the forms. We do not try to find out who is behind a visitor code. We do this based on our legitimate interest: a booking page that works well (article 6(1)(f) GDPR). If you accepted statistics on the website, the booking page uses the same number as the website.
Sometimes we test two versions of the booking page side by side. You then always see the same version; that is what the cookies bf_bucket and bf_flags are for (see Cookies).
Ads (only with your consent)
We advertise on Google and on Facebook and Instagram (Meta). We want to know which ads work, so we only pay for ads that bring in guests. We also want to be able to show our ads to people who have already visited our website. For this we ask your consent on the booking page, with the question about ad measurement. It changes nothing about booking or ordering.
If you give consent, this happens:
- We load the Google tag and the Meta pixel. These are small programs from Google and Meta. They place cookies in your browser (see Cookies) and let Google and Meta know which pages you view and what you do. For example that you looked at the prices, clicked Book, signed up for the newsletter, started to check out or completed a booking.
- Google and Meta can link this data to an account you have with them. That way they can later show you our ads and measure whether an ad led to a booking.
- For 90 days we keep in your browser the code of the ad click that brought you here.
- When you complete a paid booking or order, we also send Google and Meta, from our own server, the amount excluding VAT, the click code and whether you have been with us before. We only send your email address and phone number as an irreversible code (hash). Your address or number cannot be read back from that code. Google and Meta can, however, use it to see whether you are someone they already know. So it is still personal data.
If you do not give consent, or choose nothing, we do not load the Google tag or the Meta pixel and we send nothing to Google or Meta.
We only do this with your consent (article 6(1)(a) GDPR). You withdraw your consent under Cookie settings at the bottom of the website, or with "Change ad measurement" at the bottom of the booking page. We then remove Google's and Meta's cookies from your browser. What Google and Meta have already received, they keep under their own rules. You stay in our ad lists at Google and Meta for 180 days at most.
For measuring bookings, Google is our processor. For showing ads to visitors of our website, Google is itself responsible, under the Google Ads terms. We and Meta are jointly responsible for collecting and passing on the data through the pixel and our server; what Meta does with it afterwards is described in Meta's privacy policy.
Cookies and storage in your browser
A cookie is a small file a website places in your browser. Below is what the website (thermenbinnenmaas.nl) and the booking page (boeken.thermenbinnenmaas.nl) place in your browser. Some of it only with your consent; that is stated with it.
| Name and place | What for | How long |
|---|---|---|
| bf_bucket booking page, cookie | Remembers which version of the booking page you see. Needed for the page to work. | 1 year |
| bf_flags booking page, cookie | Remembers which variant you saw, so it does not change during your visit. | Until you close the browser |
| bf_visit booking page, cookie | Random visitor code for the statistics. Only when statistics are on. | Until you close the browser |
| bf_consent booking page, cookie | Remembers your choice about ad measurement. | 6 months |
| bf_ads booking page, browser storage | The code of the ad click that brought you here. Only if you accepted ad measurement. | 90 days |
| bf_cart booking page, browser storage | Your basket with gift cards and products. | Until you order or empty the basket |
| Form and visitor code booking page, temporary browser storage | What you have already filled in, so you do not have to type it again, and the visitor code for the statistics. | Until you close the tab |
| tb_pop_… website, browser storage | Remembers that you closed a notice, so you do not see it again. | Until you clear your browser data |
| th_consent website and booking page, cookie and browser storage | Remembers your choice about statistics and ads, for the website and the booking page together. | 12 months |
| th_attr website, browser storage | The campaign or ad that first brought you here. Only after you accept statistics. | 12 months |
| ph_… website, PostHog cookie and browser storage | The random number we recognise you by. Only after you accept statistics. | 12 months |
| _ga, _ga_… website and booking page, Google cookie | Recognises your browser for Google. Only after you accept ads. | 2 years |
| _gcl_… website and booking page, Google cookie | Remembers which Google ad you clicked. Only after you accept ads. | 90 days |
| _fbp, _fbc website and booking page, Meta cookie | Recognises your browser for Meta and remembers which Meta ad you clicked. Only after you accept ads. | 90 days |
We do not ask consent for the cookies and storage without "only after you accept". They are needed for the page to work, or they only measure in a way that has little impact on your privacy.
The contact page shows a Google Maps map. It is loaded by Google. Google may receive your IP address and place its own cookies; this is described in Google's privacy policy. If you click the buttons for WhatsApp, Facebook or Instagram, you go to Meta's website or app and Meta's rules apply.
You can always delete cookies and browser storage yourself in your browser settings.
How long we keep your data
| Data | How long |
|---|---|
| Your bookings and orders in our reservation system | 7 years, because the law requires this for our accounts |
| A paid booking that is not yet in the reservation system | Until it is, 30 days at most |
| Record of the emails sent about your booking | 12 months |
| Booking or call-back request noted by F-S Fitness | 14 days after it is dealt with, 30 days at most |
| Your messages by phone, email or WhatsApp | As long as needed to deal with your question |
| Job application | 4 weeks after the process; with your consent up to 1 year |
| Newsletter subscription | Until you unsubscribe |
| A signup you do not confirm | 30 days |
| Proof of consent and unsubscription | 5 years after you unsubscribe. After that your email address remains only as an irreversible code on a block list, so we do not email you again |
| Delivery of newsletters and clicked links | 25 months |
| Link between a booking and you as a subscriber | 25 months; after that only the amount remains, no longer traceable to you |
| Data from the reservation system to measure return visits | Your customer number and visit dates: up to 25 months after your last visit. The daily export file: 7 days at most |
| Booking page statistics, with visitor code | 25 months, to compare year on year |
| Website statistics | 12 months |
| Your place in our ad lists at Google and Meta | 180 days at most. What Google and Meta keep themselves is in their own privacy policies |
Did you unsubscribe and then sign up again without confirming? Then we keep that request with the proof of your earlier consent and unsubscription, for the same period. If you ask us to delete your data, we erase it. We then keep only the irreversible code of your email address, the reason and the date, so we do not email you again.
Who else sees your data
We do not sell your data. We only share it with companies that help us. With the companies that process your data for us, we have a data processing agreement. It says they use your data only for us and keep it secure.
| Who | What for | Where |
|---|---|---|
| Dimbizz (xPlan) | Our reservation system and till | Netherlands |
| Mollie B.V. | Online payments. Mollie is itself responsible for the payment details | Netherlands and EU |
| Cleverly Automated | Builds and runs the website, the booking page and the newsletter | Netherlands |
| Vercel Inc. | Hosting of the website and the booking page | EU (Frankfurt), traffic through Vercel's worldwide network * |
| Amazon Web Services | Sending emails and storing the statistics | EU (Frankfurt) * |
| Neon Inc. | Newsletter database | EU (Frankfurt) * |
| PostHog Inc. | Website and booking page statistics, with a visitor code | EU (Frankfurt) * |
| Fly.io Inc. | Secure passage between the booking page and our reservation system. Sees only encrypted traffic and stores nothing | EU (Frankfurt) * |
| Google (Google Ads) | Ad measurement and ads to visitors of our website, only with your consent. Itself responsible for showing ads | EU and US * |
| Meta Platforms Ireland | Ad measurement and ads to visitors of our website, only with your consent. Jointly responsible with us | EU and US * |
| Mailchimp (Intuit) | Our previous newsletter service. After the switch we delete the list there | US * |
| F-S Fitness (FS Sport en ontspanningscentrum B.V.) | Notes your booking or call-back request when our phone is forwarded | Netherlands |
* These are American companies, or parts of them. Your data is stored in the EU, but these companies may also process it outside the EU, for example for maintenance or support. That is only allowed with a legal basis: the EU-US Data Privacy Framework (a decision of the European Commission) or the European Commission's standard contractual clauses. Amazon puts an email address that an email could not be delivered to, or that someone complained about, on its own block list, so it is not emailed again.
Sometimes we have to give data to the authorities, for example when the law or a court requires it.
Security
We keep your data well protected. All connections are encrypted. Only people who need your data for their work can access it. We do not make decisions about you that are taken by a computer alone and have major consequences for you.
Your rights
It is your data. That is why you have these rights:
- Access: you may ask which data we hold about you.
- Correction: if your data is wrong, we correct it.
- Deletion: you may ask us to erase your data. Data the law requires us to keep, such as for our accounts, we only erase once that is allowed.
- Restriction: you may ask us to stop using your data for a while.
- Objection: where we use your data based on our legitimate interest, such as for statistics and measuring the newsletter, you may object.
- Taking your data with you: data we use with your consent or for your booking, you can get on request in a common file format, so you can give it to someone else.
- Withdrawing consent: for the newsletter with the unsubscribe link in every email, for ad measurement with "Change ad measurement" at the bottom of the booking page. What we already did before stays valid.
Send your request to cherise@thermenbinnenmaas.nl. We reply within one month. Sometimes we first ask you to show it is really you, so we do not give your data to someone else.
A complaint
Are you unhappy with how we handle your data? Please tell us first, so we can find a solution together. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), at autoriteitpersoonsgegevens.nl.
Changes
If anything changes in how we handle your data, we update this privacy statement. At the top you can see when that last happened.