Privacy & Cookie Policy

Lookster ("Lookster", "we", "us", "our") attaches great importance to the protection of your privacy. In this Privacy & Cookie Policy, we explain how we collect, use, share, secure and retain personal data when you use our platform, consisting of:

• the website www.lookster.nl (the "Website");
• the Lookster mobile application(s) (the "App");
• the online booking portal and other features we offer via Website and App,

collectively: the "Platform".

By using the Platform, you acknowledge that you have read and understood this policy.

The data controller within the meaning of the General Data Protection Regulation ("GDPR") is:

Lookster has not appointed a Data Protection Officer (DPO). For privacy questions or requests, you can reach us via the email address above.

We may (depending on your use of the Platform) process the following categories of personal data:

We process personal data exclusively for legitimate, specified purposes, such as:

1. Performance of the Platform and the agreement
   • creating and managing accounts;
   • technically enabling bookings/appointments and forwarding them to salons;
   • communication about bookings (confirmations, changes, notifications);
   • support and customer service;
   • sending push notifications in the App, for example for new or cancelled bookings (if enabled by you).
2. Security and reliability
   • securing accounts and systems;
   • preventing and detecting fraud, abuse and disruptions;
   • logging, troubleshooting and stability purposes.
3. Improvement and analysis
   • statistics and analysis of Website usage (e.g. via Microsoft Clarity and, where applicable, Google Analytics);
   • further development of features and user experience.
4. Marketing
   • sending marketing communications;
   • displaying/measuring advertisements or retargeting (e.g. via Meta Pixel), only after your consent where legally required (e.g. via cookie banner).
5. Legal obligations
   • complying with fiscal/administrative retention obligations (particularly for B2B invoices);
   • complying with requests from competent authorities where legally required.

We process personal data on the basis of one or more of the following legal bases (Article 6 GDPR):

• Performance of a contract (Art. 6(1)(b) GDPR) – e.g. account and booking functionality.
• Legal obligation (Art. 6(1)(c) GDPR) – e.g. fiscal retention obligation.
• Legitimate interest (Art. 6(1)(f) GDPR) – e.g. security, fraud prevention, basic statistics/improvement without tracking where permitted.
• Consent (Art. 6(1)(a) GDPR) – e.g. non-essential cookies (analytics/marketing), personalised advertisements, certain marketing.

You can withdraw consent at any time (see Article 10).

We do not sell your personal data. We only share data when necessary for the operation of the Platform, for our services, or when we are legally obliged to do so. This may include sharing with:

1. Salon partners: when you request/book an appointment, we share the necessary data (such as name/phone/email and appointment details) with the relevant salon so they can carry out the appointment.
2. Hosting/IT service providers: for hosting and infrastructure (e.g. Hetzner).
3. Email service providers: for sending emails (e.g. Postmark).
4. Push notification services: to deliver push notifications in the App we use Google Firebase Cloud Messaging; this involves processing a device token.
5. Analytics and marketing services (after consent where required): e.g. Microsoft Clarity and, where applicable, Google Analytics or Meta Pixel.
6. Government agencies/supervisory authorities: where legally required.
7. Business transfer: in case of merger/acquisition/restructuring, with appropriate safeguards.

We enter into data processing agreements in accordance with Article 28 GDPR with parties that process personal data on our behalf.

Some service providers (such as Microsoft, Google and Meta) may process or make personal data accessible outside the European Economic Area (EEA) (e.g. the US). When we use such services, we ensure – where required – appropriate safeguards, such as:

• EU Standard Contractual Clauses (SCCs), and/or
• other legally permitted safeguards.

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access or disclosure. This includes:

• TLS/SSL encryption during data transmission;
• access management and authentication;
• logging and monitoring;
• restricting access to personal data to authorised persons.

We do not retain personal data longer than necessary for the purpose for which it was collected, unless we are legally required to retain it longer.

Indicative:

• Account data (consumers): until you request deletion, and thereafter within a reasonable period, unless legal retention obligations or necessary security/fraud prevention interests require temporary longer retention.
• B2B invoice and administrative data: generally 7 years (fiscal retention obligation).
• Support/communication: as long as needed for resolution and limited thereafter, unless longer retention is needed for evidence, security or disputes.
• Cookies: see paragraph 13.

Under the GDPR, you have rights including:

• access;
• rectification;
• erasure;
• restriction;
• data portability;
• objection (including against processing based on legitimate interest);
• withdrawal of consent (where applicable).

You can submit your request via [email protected]. We will respond in principle within one month. As a Partner you can also delete your account directly in the Lookster Dashboard app.

The Platform is not specifically aimed at minors. Minors may only use the Platform if they have consent from a parent/guardian, insofar as this is required. We do not target marketing campaigns at minors and do not intentionally collect personal data from children. If we suspect that we are processing personal data of a child without valid consent, you can contact us via [email protected], so that we can investigate and delete where appropriate.

Lookster does not apply automated decision-making that has legal effects or otherwise significantly affects you. We may (after consent where required) use profiling for marketing/advertising measurement (e.g. via marketing cookies).

1. Cookie banner. We only place non-essential cookies (such as analytical and marketing cookies) after you have given consent via a cookie banner, insofar as legally required.

   Change preference: you can accept, reject or later change analytics cookies via the cookie settings in the footer.

2. Types of cookies (indicative). The list below is indicative and may change. Current cookie information can be consulted via the cookie banner and cookie settings.
   1. Functional cookies (necessary): required for the operation of the Website (e.g. session, security).
   2. Analytical cookies: measuring website usage and improving the user experience (e.g. Microsoft Clarity and, where applicable, Google Analytics) – only after consent where required.
   3. Marketing cookies: measuring/targeting advertisements (e.g. Meta Pixel) – consent required.

13.3 Examples (indicative)

1. Microsoft Clarity cookies may include _clck and _clsk (to recognize a user and connect page views within a session).
2. Google Analytics cookies may include _ga, _ga_* (retention periods depending on settings).
3. Meta cookies may include _fbp (retention periods depending on settings).

13.4 Cookie management

You can manage cookies via:

1. the cookie settings in the footer, and/or
2. your browser settings (delete/block cookies).

Please note: if you block cookies, certain parts of the Website may not function properly.

Our Platform may contain links to external websites. Lookster is not responsible for the privacy or cookie policies of third parties. We recommend that you carefully read the policies of those websites.