Privacy policy

1. Who is responsible

The controller of your data is Ubuntu Barbershop, Stationsstraat 216, 9880 Aalter, Belgium.

You reach us at [email protected], by phone on 0468 51 29 12, or on WhatsApp. We are a small shop and do not have a data protection officer; the owner answers privacy questions personally.

2. What this covers

This policy covers the website ubuntuisforever.be, the online booking, the customer account, and the emails we send about appointments. It does not cover Instagram, TikTok, Facebook or Google, which have their own policies.

3. What we collect

Identity and contact: your name, phone number and email address.

Booking: the service, the barber, the date and time, the price at the time of booking, the language you booked in, any note you typed, the booking code, and whether you asked for a reminder.

Account, only if you sign in: your login method (email code, Google, Facebook or passkey), the account id that Google or Facebook gives us, the public key of a passkey, and the sessions you opened with their IP address and browser type.

Communication: which appointment emails we sent you, when, and whether the email service accepted them.

Shop notes: what the barber writes about your preferences, and a count of appointments you did not turn up to.

Technical: server logs with IP address, time and requested page, kept for security, and short-lived counters that stop abuse of the booking form.

We do not collect payment details online. You pay at the shop.

4. Why we use it and on what basis

To run your appointment: booking it, sending the confirmation with a calendar invite, a reminder the day before if you asked for one, and telling the barber. Legal basis: performance of a contract, Article 6(1)(b) GDPR.

To keep the shop running: the agenda, the record of no-shows, notes about how you like your cut, statistics about how busy the shop is. Legal basis: our legitimate interest in running a barbershop, Article 6(1)(f).

To ask how it went: one email after your visit with a link to leave a review. Legal basis: legitimate interest in feedback on our own service, Article 6(1)(f). Tell us once and we stop.

To keep the booking form safe: limits on how many bookings one connection or one phone number can make, and the option to refuse online booking to someone who repeatedly does not turn up. Legal basis: legitimate interest, Article 6(1)(f). A person, not a computer, decides on any block.

To meet our obligations: keeping sales records for the periods Belgian accounting and tax law require. Legal basis: legal obligation, Article 6(1)(c).

We do not send newsletters or advertising, and we do not use your data for profiling or automated decisions.

5. Children

Kids' cuts are booked by a parent or guardian in their own name. We do not create accounts for children under 13 and we do not knowingly collect data from them. If you think a child gave us data directly, tell us and we remove it.

6. Who sees it

Our hosting provider, which runs the server in the European Union where the database lives.

Resend, the service that delivers our emails. Resend is a US company. Emails and the addresses they go to are processed under Resend's data processing terms with the European Commission's Standard Contractual Clauses.

Google and Meta, only when you choose to sign in with Google or Facebook. They act as independent controllers for the sign-in itself and give us only your name, email and an account id.

The barbers, who see the agenda and the bookings on their own chair.

Nobody else. We do not sell data, share it with advertisers, or use analytics trackers.

7. Where it lives

Your data lives in the European Union. The one exception is email delivery through Resend, which may process email content in the United States under Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

8. How long we keep it

Bookings: kept while you are a customer and for three years after your last visit, the Belgian limitation period for claims. After that the name, phone, email and notes are erased and the booking stays as an anonymous line in the agenda history.

Account: until you delete it. You can do that yourself on your account page.

Sessions: 7 days, or until you sign out.

Email delivery records: 12 months.

Server logs: 30 days. Abuse counters: at most one hour.

Sales records: as long as Belgian accounting law requires, which is seven years, in a form that no longer identifies you where that is possible.

9. Your rights

Access: ask for a copy of what we hold about you.

Rectification: your name and phone number can be changed on your account page or by telling us.

Erasure: delete your account yourself, or ask us. We remove your login and blank your name, phone, email and notes on every booking. The appointment itself stays as an anonymous record, because the shop's agenda and sales history must stay complete.

Restriction and objection: you can object to the review email and to the shop notes at any time.

Portability: ask and we send your bookings as a file.

Send requests to [email protected]. We answer within one month and may ask you to confirm it is really you, for example by replying from the email address on the booking.

If you are not happy with our answer you can complain to the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels, [email protected], www.gegevensbeschermingsautoriteit.be.

10. Cookies

We use only cookies the site cannot work without: one that keeps you signed in for 7 days, one that lives a few minutes while a passkey is being checked, and one that remembers your language. Belgian law does not require consent for these, so there is no cookie banner.

We set no analytics, advertising or social media cookies. The Google and Facebook sign-in buttons only contact those companies when you tap them.

11. Security

The site runs over HTTPS only. Sign-in tokens are random and stored hashed, passkeys never leave your device, and staff see only what their role needs. Access to the server is limited to the people who maintain it.

If a breach ever puts your rights at risk we notify the Data Protection Authority within 72 hours and tell you directly.

12. Changes

This is version 2026-09-16. When we change something that matters we post the new version here with a new date. Continuing to book after that date means the new version applies.