Privacy policy
I only collect what is useful, and I explain why.
1. Who is responsible for your data
Data controller: Charlotte Giesen, sole trader, trading as EpilYou, Chaussée de Malines 3, 1933 Sterrebeek, Belgium. Company number (BCE/KBO) 0671.888.910. Contact for any question about your data: info@epilyou.com, +32 492 62 72 76.
2. The data I process, and why
| Situation | Data | Why | Legal basis | Retention period |
|---|---|---|---|---|
| Booking appointments (via Salonkee) | Surname, first name, phone, email, appointments | Organising your appointments and sending you reminders | Performance of the contract | During your treatment, then 3 years after your last appointment |
| Information session and treatment follow-up | Skin phototype, hair type, relevant medical history and contraindications, session settings, any photos taken with your consent | Treating you safely and monitoring progress | Your explicit consent (health data) and performance of the contract | During your treatment, then 5 years after your last session |
| Ordering a gift voucher | Your first name, surname, email, phone (optional); first name of the person receiving the voucher, “from”, short message; amount, number, payment status | Processing the order, checking the transfer, sending the voucher | Performance of the contract | Unpaid order: 90 days. Paid order: voucher validity + 3 months. Accounting records: 7 years (legal obligation) |
| Questions by phone, WhatsApp or email | Contact details, content of the message | Replying to you | Legitimate interest (answering your request) | 2 years after the last exchange |
| Accounting | Invoices, payments | Accounting and tax obligations | Legal obligation | 7 years |
| Audience measurement (Google Analytics) | Pages viewed, device, approximate city, source of the visit (shortened IP address) | Understanding how the website is used and improving it | Your consent | 14 months (Google Analytics data) |
| Advertising (Google Ads) | Click on an ad, click on “Book”, confirmed booking | Measuring how well my ads work | Your consent | According to Google’s settings, up to 90 days for cookies |
| Anti-bot protection (Cloudflare Turnstile) | Technical browser signals | Preventing fake orders | Legitimate interest (security) | Not stored by me |
I do not use your data for any other purpose and I do not make any automated decisions about you.
3. Who receives your data (my processors)
I use service providers who process certain data on my behalf, only on my instructions:
- Salonkee (Luxembourg): appointment booking, reminders, client record. Salonkee has its own privacy policy for its app and website.
- Cloudflare (website hosting, storage of gift voucher orders, anti-bot protection, forwarding of emails sent to info@epilyou.com).
- Brevo (France, servers in the European Union): sending gift voucher emails.
- Google (Google Analytics and Google Ads), only if you accept.
- Meta (WhatsApp), only if you choose to message me on WhatsApp.
- My accountant, for accounting records.
I never sell, rent out or hand over your data.
4. Transfers outside the European Union
Some providers (Google, Cloudflare, Meta) are US companies. Any transfers of data to the United States are covered by the EU–US Data Privacy Framework and by the European Commission’s standard contractual clauses.
5. Your rights
At any time, you can:
- access your data and obtain a copy;
- have it corrected;
- have it erased, unless the law requires me to keep it (accounting);
- object to processing or ask for it to be restricted;
- receive your data in a common format (portability);
- withdraw your consent (cookies, health data), without affecting what was done before.
Write to me at info@epilyou.com. I reply within one month. I may ask you to confirm your identity.
If you feel your rights are not being respected, you can lodge a complaint with the Belgian Data Protection Authority: Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
6. Security
Treatment records are paper records, kept at the centre in a locked cabinet, accessible only to me. The website is served over a secure connection (HTTPS). No bank card data passes through the website: gift vouchers are paid by bank transfer from your bank.
7. Cookies and browser storage
A cookie is a small file saved by your browser. The website does not set any measurement or advertising cookie before you consent. You choose in the banner (“Accept all”, “Reject all” or “Choose”), and you can change your mind at any time via “Manage cookies” at the bottom of every page.
| Name | Provider | What it is for | Duration | Category |
|---|---|---|---|---|
| epilyou_cookies | EpilYou | Remembering your cookie choices | 182 days (6 months) | Necessary (always on) |
| epilyou-bandeau-langue (browser storage, not a cookie) | EpilYou | Remembering that you closed the language banner (NL and EN pages) | 30 days | Necessary |
| _ga | Google Analytics | Distinguishing visitors anonymously | 2 years | Audience measurement (with consent) |
| _ga_… | Google Analytics | Keeping the state of the visit | 2 years | Audience measurement (with consent) |
| _gcl_au | Google Ads | Linking a booking to a Google ad | 90 days | Advertising (with consent) |
| _gcl_aw | Google Ads | Remembering a click on a Google ad, only if you arrive on the website from an ad | 90 days | Advertising (with consent) |
The gift voucher form is protected by Cloudflare Turnstile, which only loads when you start filling it in; it is used for security only and sets no measurement or advertising cookie.
The following services may set their own cookies when you open them, on their own website and under their own policy: Salonkee (booking, new tab), WhatsApp, Google Maps (“Directions” link), Instagram, Facebook. The map of the centre shown on the website is a static image and sets no cookie. Fonts are hosted on the website itself (no call to Google Fonts).
The website’s administration area (text editing tool) uses its own technical cookies; it is reserved for Charlotte and is not used by visitors.
8. Client reviews
The reviews shown were published by my clients on Google and Salonkee. I personally check that each review shown comes from a client who visited the centre. They are reproduced without changes; in the Dutch and English versions of the website, they are translated from French, which is stated next to each review.
9. Updates
This policy may change. The date of the last update is shown at the bottom of the page. The Dutch and English versions are translations; in the event of any difference, the French version prevails.
Last updated: 4 November 2026