Privacy Policy (GDPR)

CutOnTime acts as controller for personal data collected and processed through the platform.

For privacy questions or data-right requests, contact us through the email listed on this page.

We only process data needed to operate the service, including:

• Barbershop and staff account data (name, email, login credentials).
• Customer booking data (name, email, phone, appointment details).
• Technical security data (sessions, IP address, user agent, abuse-prevention logs).
• Notification and communication records for confirmations, reminders, and service updates.

We process personal data only under valid GDPR legal bases:

• Performance of a contract (bookings, account access, service communication).
• Legal obligations (administration, anti-fraud duties where required).
• Legitimate interests (security, reliability, and quality assurance).
• Consent (optional analytics and similar technologies).

Data is retained no longer than necessary for the purpose it was collected for.

Where possible, data is deleted or anonymized after retention periods expire.

We share data only with processors necessary to provide the platform, such as hosting, email, and payment providers.

Processor agreements and appropriate safeguards are in place with relevant vendors.

If personal data is processed outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

Under GDPR, data subjects have rights including:

• Right of access, rectification, and erasure.
• Right to restrict processing and to object.
• Right to data portability for data provided by you.
• Right to withdraw consent at any time where processing relies on consent.

CutOnTime applies technical and organizational measures to protect data against loss, misuse, and unauthorized access.

In case of a data breach, we act under applicable incident response and legal notification obligations.

If you believe we handle personal data incorrectly, please contact us first so we can address it promptly.

You also have the right to lodge a complaint with the Dutch Data Protection Authority.