nailsmini
BookView courses

Privacy policy

Version dated 29 October 2026.

On nailsmini.nl you can sign up for the free checklist, buy or request a course, request an appointment at the salon and sign up as a model for a training day. To do that, we need some of your details. Below you can read, form by form, which details these are, what we use them for, who else gets to see them and how long we keep them. In doing so, we follow the General Data Protection Regulation (GDPR; in Dutch: AVG).

1. Who is responsible

The controller is Anna, who gives manicure courses and runs a salon in Tilburg under the name nailsmini.nl.

  • Trade name and KvK number (Dutch Chamber of Commerce): nailsmini, KvK number 86755633
  • Business address: Torenvalk 11, 5052 WD Goirle
  • Email for all questions about your data: [email protected]

2. What data we process for each form

Free checklist

  • Data: your email address and the language of the page (Dutch, Russian, Ukrainian or English). If you came through a campaign link, we also keep which campaign it belonged to.
  • Purpose: to send you one email with the download link. We don’t send you a newsletter or a series of tips emails.
  • Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by emailing us; we will then delete your address.
  • Retention: until you withdraw your consent, and for no longer than 24 months.

Course request and the online academy waiting list

  • Data: your name, how we can reach you (phone, WhatsApp, Telegram, Instagram or email — whatever you fill in), the course you’re interested in, your message and the language of the page. If you came through a campaign link, we also keep which campaign it belonged to.
  • Purpose: to answer your request, agree on dates, or let you know when the online academy opens.
  • Legal basis: steps you ask for before we enter into a contract (Art. 6(1)(b) GDPR); for the waiting list, your consent (point (a)).
  • Retention: up to 12 months after our last contact. If it leads to a course, we keep what is needed for the contract and the accounts (see Orders).

Appointment request at the salon

  • Data: the treatment and extras you choose (for some extras, the number of nails), the preferred date and time, your name, how we can reach you, your note (if you write one) and the language of the page. We also store the duration and the price the site calculated for your choice, so that later changes to the price list don’t change what you were quoted.
  • Purpose: to review your request and confirm the appointment by message or suggest another time. A request is not yet an appointment; nothing is put in a calendar.
  • Legal basis: steps you ask for before we enter into a contract, and after that, performing that contract (Art. 6(1)(b) GDPR).
  • Health: only write in the note what is necessary. If you mention something like an allergy of your own accord, we use it only to carry out the treatment safely, with your explicit consent (Art. 9(2)(a) GDPR).
  • Retention: up to 12 months after the appointment or after our last contact.

Signing up as a model for a training day

  • Data: your name, how we can reach you, your note (if you write one), the language of the page and, if you send them, up to 6 photos of your nails.
  • Purpose: to see whether your nails are suitable for a training day and to invite you once one is scheduled. The photos are not published and are not used for anything else. If Anna wants to show a photo of the result from the training day, she will ask you separately.
  • How we protect the photos: your browser makes each photo smaller before it is sent. On the server, we then remove all embedded data — such as the location (GPS), the phone model and the date taken — before the photo is stored or forwarded anywhere. The photos are stored in protected storage at Cloudflare (R2), which is not publicly accessible. Anna only receives a short notification of a new sign-up in Telegram, without your details or photos; she views your sign-up and the photos in a protected area of the site.
  • Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by ticking the box on the form. You can withdraw it at any time; we will then delete your sign-up and photos.
  • Retention: 90 days after you sign up. The photos in the Cloudflare storage are deleted automatically after that period. Anna deletes the rest of your sign-up herself, at the latest within the same period.
  • Under 16? Then only sign up with the consent of your parent or guardian.

Orders (online course and consultation)

  • Data: your email address, the language of the page, the product and option you choose, the payment status and the payment reference at Mollie, the country where you live (you choose it when you order; we need it for VAT) and the number of your payment receipt. For the consultation, also how Anna can reach you to arrange a time. If you came through a campaign link, we also keep which campaign it belonged to.
  • Purpose: to fulfil your order: after payment you receive access to the online course or a confirmation of the consultation by email, and Anna is notified of your order. After payment we send you a payment receipt with a sequential number; if you do not finish an order, we send you one reminder about that order, and nothing after that.
  • Your online course account: your email address is your account; there is no password. To log in, you ask for a login link on the site, which we send to you by email. The link works for 15 minutes and only once; we store only an encrypted (hashed) form of it, never the link itself. Once you are logged in, we set one login cookie (nm_session, 30 days). The course videos are played through Cloudflare Stream; Cloudflare sees your IP address when they play. We keep track of your progress: which lessons you marked as done and how far you watched each lesson (the playback position), so you can carry on where you left off. There is also a Telegram group for students of the course; joining is optional. If you join, Anna and the other members can see your Telegram name and profile, as in any Telegram group.
  • Retention (account): your course access (email address, order, chosen option, status) 3 years after your payment; login sessions 30 days; login links 15 minutes, deleted once used; your progress for as long as you have access to the course. If you ask us to delete your data, we also delete your account and your progress, except what we are legally required to keep.
  • Legal basis: performing the contract (Art. 6(1)(b) GDPR) and the legal retention obligation (point (c)).
  • Retention: 7 years, the tax retention period for the accounts.
  • Paying: you pay on Mollie’s payment page. Your bank details and card number go directly to Mollie; we never see them.

Questions about a lesson

  • Data: your question, if you wish, the moment in the video your question is about, and your first name. We link your question to your course account (your email address).
  • Who sees what: Anna sees your question, your first name and a shortened email address. Anna receives a notification in Telegram without the text of your question. Once Anna has answered your question, all students of the same course see your first name, your question and the answer. Nobody else sees your email address. You receive an email when Anna has answered.
  • Purpose: so that Anna can answer your questions about the lessons and other students can learn from the answers.
  • Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
  • Retention: as long as the course is offered. On request we delete your questions and your first name sooner.

Exam of the online course

  • Data: when you submit the exam of the online course, we process the photos and videos of your hands and your work, the name you enter for the certificate, your message to Anna and Anna’s feedback. We link your submission to your course account (your email address).
  • Purpose: to assess your exam and issue your certificate. You receive the result by email.
  • Who sees what: only Anna views your photos and videos. Anna is notified of your submission in her Telegram, with a shortened email address and without photos or videos. The photos are kept in protected storage at Cloudflare (R2) and the videos at Cloudflare Stream; neither is publicly accessible. On the certificate verification page, anyone with the link sees your name, the course, the date and the certificate number.
  • Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
  • Retention: photos and videos 180 days after upload, after which they are deleted automatically; your submission as long as you have access to the course; your certificate as long as it needs to be verifiable, or until you ask us to withdraw it.

When you visit the site

  • Hosting: Cloudflare delivers the site and in doing so processes technical data such as your IP address and browser type, to make the site work and keep it secure.
  • Security check: every form uses Cloudflare Turnstile to check that a human, not a bot, is filling it in. For this, Cloudflare checks technical data from your browser and your IP address.
  • Fonts: the site’s fonts are served from our own site; no data goes to a third party for them.
  • Map: the map on the For clients page is only loaded when you click Load map. Only then does data (such as your IP address) go to Google Maps.
  • Statistics (only with your consent): a banner asks whether we may use Google Analytics 4 to see how the site is used. If you say no, we do not load Google Analytics and set no statistics cookies. If you say yes, Google sets cookies (_ga and _ga_…, up to 2 years) and we count, among other things, page views, language, type of device and roughly which link you came through. Google uses your IP address for this but does not store it in the statistics. We do not use the data for advertising and do not build profiles. Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 11.7a Telecommunications Act). Retention: statistics data 14 months. Your choice is kept in your browser (localStorage, nm-consent); you can change it at any time via Cookie settings at the bottom of every page.
  • Cookies: without your consent we only set a login cookie, and only when you log in to your online course (nm_session, 30 days; without it you cannot stay logged in), and a country cookie (nm-cc, 24 hours). The country cookie holds only the two-letter code of the country you are browsing from (for example NL), which Cloudflare derives from your IP address, so the site can offer you the page in your language. It holds nothing else and is not shared with third parties. Your browser also keeps a few non-personal display preferences on your own device (localStorage): which lesson groups are open, the playback speed and whether captions are on. Your language choice (Dutch, Russian, Ukrainian or English) is kept there too, so the site doesn’t ask you again every time. If you came through a campaign link, we keep which campaign it belonged to during your visit, in sessionStorage or — if that is not possible — in a session cookie (nm_utm) that disappears when you close the browser. When you send a form or place an order, we store it with the form or order.

3. Who else processes your data

We never sell your data. We only use these service providers:

Service What for What the service processes
Cloudflare Hosting the site, the database (D1), the storage of model photos and exam photos (R2), the online course video and exam videos (Stream), the security check (Turnstile) and the database backups (Time Travel and a daily encrypted copy, kept for 14 days, without login sessions) All data from the forms above, technical data about your visit
Mollie Payments (iDEAL, Bancontact, card) Your payment and order details
Resend Sending emails (checklist, course access, login links, confirmation, the answer to your question, the result of your exam) Your email address and the content of the email
Telegram Notifications to Anna about requests, appointment requests, model sign-ups (without photos), orders, questions from students and submitted exams (without photos or videos); the Telegram group of the online course (if you join) The data from your form or order; your Telegram account if you join the group
Google The map, only after you click Load map; website statistics (Google Analytics), only after your consent Your IP address and technical data about your browser; with Analytics also how you use the site

For the payment itself, Mollie is also an independent controller, under its own privacy policy.

Outside the European Economic Area. Cloudflare, Resend and Google are American companies; Telegram is based outside the EEA. Where data goes to such a country, this happens on the basis of the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses, insofar as the service offers them. With Telegram, it happens because you or Anna use that service yourselves.

4. Your rights

You have the right to:

  • access your data;
  • have incorrect data corrected;
  • have your data deleted, except what we are legally required to keep;
  • have the processing restricted or object to it;
  • receive your data in a commonly used format (portability);
  • withdraw consent you have given at any time. What we did before you withdrew it remains lawful.

If you have received a certificate for the online course, you can also ask us to withdraw it and to erase your exam work (photos, videos and your submission).

To do so, email [email protected]. We will respond within one month. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (autoriteitpersoonsgegevens.nl).

We don’t make decisions about you that are made solely by a computer, and we don’t create profiles.

5. Security

Data always travels encrypted (HTTPS) between your browser and the site. The database and the storage of model photos are not publicly accessible; only Anna and the site administrator can access them. Location and other embedded data are removed from photos before they are stored.

6. Changes

If we change this policy, we will put the new version on this page, with the date at the top.

7. Contact

Questions about your data: [email protected].

The Dutch version is legally binding.