Privacy policy

1. What we collect

Depending on how you use Rebooth, we may process:

• Identity and contact details: name, email address, phone number, date of birth where needed for age checks.
• Waitlist and marketing details: language, what you told us you are interested in, your place on the list, which emails you open.
• Account, booking and membership details: sessions booked, attendance, membership type, passes, pauses and cancellations.
• Payment details: processed by our booking and payment providers. We never store full card numbers ourselves.
• Health information you choose to share with us at intake, for example conditions that matter for sauna or ice bath use. This is special category data and we only process it with your explicit consent, to keep you safe.
• Technical and usage data: IP address, device and browser, pages visited, through cookieless analytics on our website.
• Messages you send us, by email, social media or in person.

2. Why we use it and on what legal basis

Under the GDPR we need a legal basis for each use. Ours are:

• To run your waitlist spot, account, bookings and membership: performance of a contract, or steps you asked for before one.
• To send you emails about Rebooth, opening dates, sessions and offers: your consent, given when you signed up. You can withdraw it at any time with the unsubscribe link in every email.
• To keep you safe during sessions and to meet house rules: your explicit consent for health information, and our legitimate interest in running a safe facility.
• To improve our website and services, and to prevent abuse and fraud: our legitimate interest.
• To meet legal obligations, such as tax and accounting rules: legal obligation.

3. Who we share it with

We share personal data only with providers that help us run Rebooth, under data processing agreements, and with authorities when the law requires it. Our main providers are:

• Vercel (website hosting and cookieless analytics), Neon (database), Loops (email): European Union or EU adequacy and standard contractual clauses.
• Momence and its payment providers (bookings, memberships, payments) from the moment bookings open.
• The sports club that hosts a Rebooth location, only where needed for access and safety at that location.
• Accountants, legal advisers and insurers where necessary.

4. Where your data goes

We store data in the European Union where we can. Where a provider processes data outside the EU, we rely on an adequacy decision or the European Commission's standard contractual clauses.

5. How long we keep it

• Waitlist and marketing data: until you unsubscribe or ask us to delete it, and at most two years after our last contact.
• Account, booking and membership data: for the duration of your membership and up to seven years after, as Dutch tax law requires for financial records.
• Health information: for as long as you are a member, then deleted, unless you ask us to delete it sooner.
• Technical data: aggregated and anonymous.

6. Your rights

You can ask us at any time to:

• See the personal data we hold about you.
• Correct it, delete it, or restrict how we use it.
• Receive it in a portable format.
• Object to our use of it, including for marketing.
• Withdraw consent you gave earlier, without affecting what happened before.

6a. How to ask

Email hello@rebooth.com. To make sure a request really comes from you, we may ask you to confirm it from the email address we have on file, or ask for a copy of your ID with the photo, document number and citizen service number (BSN) blacked out. We answer within one month.

7. Cookies and analytics

Our website uses cookieless analytics that count visits without identifying you. We do not use tracking cookies and therefore show no cookie banner. If that changes, we will ask for your consent first.

8. Security

We protect your data with access controls, encryption in transit and at rest with our providers, and by collecting only what we need. No system is perfect. If a breach affects you, we will tell you and the Dutch Data Protection Authority as the law requires.

9. Children

Rebooth is for adults. Minors may only use our facilities under the conditions in our terms, with a parent or guardian. We do not knowingly collect data from children under 16 without parental consent.

10. Changes

We may update this policy. The date at the top tells you when. For meaningful changes we will let you know by email or on the website.

11. Contact and complaints

Questions or requests: hello@rebooth.com. We answer within one month. If you are unhappy with how we handle your data, you can complain to the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority, at autoriteitpersoonsgegevens.nl.