Privacy and your data

1. Who is responsible for your data

Phoebe's Place is a one-person business run by Gabriella Reels in Rijswijk, the Netherlands, registered with the Dutch chamber of commerce under KVK 92725422. Under the General Data Protection Regulation (the GDPR, called AVG in Dutch and DSGVO in German) I am the controller of the personal data described on this page.

Anything about this page or your data: info@phoebes-place.nl, or +31 6 11451719 by phone or WhatsApp. A business of this size does not need a data protection officer, so your question comes straight to me.

The GDPR is the same law in every EU country. Whether you live in the Netherlands, in Germany or anywhere else in the EU, this page and the rights on it apply to you in the same way.

I am one person with a laptop and a phone, not a company with a data department. This page is written so that you can see exactly what that means in practice.

2. What I collect

When you get in touch

• The contact form: your name, your e-mail address, your phone number if you give it, what your message is about, and the message.
• The meet & greet form: your name, e-mail address and phone number, your area, your pet’s name, species and breed, what you tell me about it, and the days and times that suit you.
• The chat on this website: your e-mail address, your phone number if you give it, and your message.
• E-mail, phone and WhatsApp: what you send me, and the address or number it comes from.

When you book, or have an account

• About you: your name, e-mail address, phone and WhatsApp number, home address, preferred language, how you would like me to contact you and, only if you want to say, how you found me. Your password and any sign-in code are stored scrambled (hashed), so nobody can read them back, me included.
• About your pet: name, species, date of birth, breed, sex, whether it is neutered, weight, chip number, health (conditions, allergies, medication and doses), vaccinations, insurer, food and routine, and how it behaves, including with other dogs, cats and children, and a photo, if you upload one.
• A photo you upload of your pet is stored privately: only you and I can open it, and the hidden location data a phone adds to a photo is removed when it is saved.
• For my private planning map, the server sends only the separate parts of your address to the Dutch PDOK location service and stores the returned coordinates with a scrambled address fingerprint. It never sends your name, contact details or pet details. The coordinates are removed when your customer record is erased.
• Each booking: the service, the dates and times, the address and phone number for that booking, your notes, the price, and whether the invoice has been paid.
• Where your key is or how to get in, if you tell me. It is kept in the notes of your booking and is removed with them.
• The messages we exchange in your account, and the reports I write for you during a stay.
• Which version of my terms you accepted and when, and when you accepted the veterinary release for a booking.
• If you switch on notifications on a phone or computer: a technical address for that device from its maker’s push service, the keys that encrypt your notifications, the kind of device (such as “iPhone”), the language of the notifications and when the last one arrived. Switching notifications off deletes this. After your account is deleted it is never used again and is removed automatically.
• When we met, and my own notes about looking after your pet and about your wishes, for example that you asked me to keep your pet off social media.

About other people

Your vet (the name of the practice and its phone number), your emergency contact if you give one (their name, phone number, how they are related to you and whether they may collect your pet), and anyone else who drops off or collects your pet are in my records because you gave me their details. I use them only to look after your pet. Please let those people know, and point them to this page.

When you pay

• The invoice, and what your bank transfer shows me: the amount, the date, and the name and account number it came from. There is no online payment on this website.

When you visit this website

• Your IP address, which your browser sends with every request so that the page can find its way back to you. The server needs it for that and for the protection described below. It keeps no record of ordinary visits.
• To protect the forms, the booking and the logins from abuse, the website itself counts requests per IP address, in its memory only and for no longer than a day. If it turns a request away for that reason, it records the refusal: your IP address with the last part removed, a scrambled (hashed) form of the full address, your browser type, the page and the time.
• In addition, security software on this website’s own server in Germany checks every request to this website automatically for known patterns of attack, such as an attempt to fetch configuration files or to exploit a known security hole. The software is the open-source program CrowdSec. It runs only on this server and passes no data to its maker or anyone else; all it fetches from its maker are the rules it checks against. The check happens in the server’s memory, and requests without a pattern of attack are not stored.
• Depending on the rule, a request with a pattern of attack is either turned away or only counted, and that count holds no IP address. For every request it turns away, the program stores an entry: the IP address the request came from, the time, the address requested, the browser identifier (user agent) and other technical features of the request, the rule that matched and the part of the request that set it off. If several requests with patterns of attack come from the same IP address within a short time, further requests from that address are turned away for one hour. This serves to fend off attacks on this website and on the data stored with it. The entries are deleted automatically after 7 days at the latest.
• If something goes wrong, the server writes a technical error message so that the fault can be fixed. Such a message can contain the e-mail address involved.
• A few small things in your browser: your answer to the cookie banner, a login cookie while you are signed in, what you have typed into the booking form so far, and whether you have already seen a hint. The table at the bottom of this page lists each one.
• Everything on these pages, the fonts and the pictures included, comes from this website’s own server, and your browser contacts no other company while you read, with one exception that you choose yourself: the service area map on the contact and service pages. There are no advertising or social media trackers, no videos and no visitor statistics. If I ever switch statistics on, this page and its table will say so.
• If I switch on the spam check for the forms, Cloudflare Turnstile checks that a person rather than a program is sending them. While it runs, Cloudflare receives your IP address and technical details of your browser. It only ever runs on the forms.
• The service area map on the contact and service pages is served by OpenFreeMap (Hyperknot Software Kft., Hungary) and uses OpenStreetMap data. It loads only after you agree, in the cookie banner or with the button on the map. Your browser then requests map data from OpenFreeMap, sending its IP address, the page address and technical browser details. OpenFreeMap says it does not store IP addresses in ordinary logs, but may temporarily log them for security incidents and may use Cloudflare as a CDN. Nothing is stored in your browser for the map. The list of places and zones remains visible without the map.

Photos

• Photos and short videos of your pet that I take during a stay, a walk or a visit, as described in my terms.

3. Why I have it, and what allows me to

The things in the table at the bottom of this page are stored in your browser without asking first, because each one only makes this website work the way you are using it, and none of them tracks you. The Dutch Telecommunications Act allows that (article 11.7a), and the same rule applies across the EU, in Germany for example under § 25 TDDDG.

Health information about an animal is not "special category" data under the GDPR, which is about people. I treat it carefully anyway, because it is the part of a booking that matters most.

4. Who else sees it

These businesses work for me. They handle your data only so that this website, its e-mail and its storage keep running:

• Peggert (Philipp Eggert, Worpswede, Germany) built this website and runs it and its server for me. He looks at stored data only when maintenance or a fault requires it.
• netcup GmbH (Karlsruhe, Germany) provides the server this website and its database run on, in its data centre in Nuremberg.
• Cloudflare, Inc. (San Francisco, USA) stores the pictures and files of this website and the nightly backup copies of its database, in data centres inside the EU. Cloudflare also answers for the web address phoebes-place.nl (DNS); your visits do not pass through Cloudflare.
• Hostinger International Ltd. (Larnaca, Cyprus) runs my e-mail inbox and sends the e-mails this website writes, such as booking confirmations and reminders.

Others see data only when there is a reason, and then only what they need:

• WhatsApp (WhatsApp Ireland Limited, Dublin), when we write to each other there. It handles your number and our messages under its own privacy policy. If you would rather not use WhatsApp, tell me and I will use e-mail or phone.
• Google, Apple or Mozilla, if you switch on notifications on a phone or computer: their push service delivers each notification to that device. It sees a technical address for the device, not what the notification says, which is encrypted.
• A veterinarian, if your pet needs treatment: your pet’s details, your name and your phone number.
• Your emergency contact, if your pet needs something and I cannot reach you.
• The Dutch tax authority (Belastingdienst) and anyone who helps me with my bookkeeping: invoices and what belongs to them.
• The company behind my calendar app, for example Apple or Google, if I show my bookings in the calendar on my phone: the dates, your name, your phone number and your pet’s name.
• Everyone who visits this website or my social media: photos of pets and reviews, never with your name or address.
• OpenFreeMap (Hyperknot Software Kft., Hungary), only if you agree to see the service area map on contact or service pages: map requests with your IP address and technical details of your browser, under its privacy policy. OpenFreeMap says it may use Cloudflare as a CDN.
• PDOK Locatieserver (Dutch government), when I use my private planning map: only the address components needed to find coordinates, never your name, contact details or pet details. This happens on the server; your browser does not contact PDOK.
• Authorities, only where the law obliges me to.

I never sell your details, never use them for advertising, and never pass them to another business so that it can contact you.

5. Data outside the EU

The website, its database, its files and its backups are all kept inside the EU. Some of the organisations above have links to countries outside the EU, and this is how your data is protected there:

• Cloudflare is an American company, so American law applies to it even though your data stays in its EU data centres. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as protecting personal data adequately. You can check this on the official list.
• Hostinger does not commit to keeping e-mail inside the EU. Where it handles data outside the EU, its data processing agreement protects it with the European Commission’s standard contractual clauses.
• Google, Apple and Mozilla are American companies. A notification passes through their push service encrypted, so they cannot read it, only the device address it goes to.
• WhatsApp passes data to WhatsApp LLC and Meta Platforms in the United States, under the same EU-U.S. Data Privacy Framework.
• OpenFreeMap is based in Hungary. Its privacy policy says it may use Cloudflare as a CDN for map requests; Cloudflare is an American company and is covered by the safeguards described above.

Ask me at info@phoebes-place.nl and I will send you a copy of these safeguards.

6. How long I keep it

Ask me to delete something sooner and I will, unless the law says it has to stay. Something deleted can still exist in a backup copy for up to 30 days, until that copy is replaced.

7. What you can ask me to do

• See a copy of what I hold about you.
• Have something corrected or completed.
• Have it deleted, where I am not required to keep it.
• Have me stop using it while a disagreement about it is being sorted out.
• Get the data you gave me in a common, machine-readable form, to take elsewhere.
• Object to my using it on the basis of a legitimate interest (see the box below).
• Withdraw a consent you gave, without that affecting anything done before you withdrew it.

Your right to object. Where I rely on my legitimate interest (the rows marked 6(1)(f) above), you can object at any time, for reasons to do with your own situation. I then stop, unless I have compelling reasons that outweigh yours, or I need the data to establish or defend a legal claim. For photos of your pet on social media you need no reason at all: tell me in writing and your pet stays off.

Some of this you can do yourself, under Settings in your account. You can download a copy of your account, your pets, your bookings, your reports and our messages, as a JSON file, a common format any computer can read. And once no booking is open any more, you can delete your account. That removes everything personal straight away: your details, your pets’ profiles and photos, your reports, our messages, and the address, phone number and notes of your bookings, including any key or door-code details. Only what an invoice needs stays: the booking number, the dates, the service and the price, without your name.

Two things to know: removing a pet in your account archives its profile rather than deleting it, and the download leaves out my own notes. Ask me and I delete the profile for good, or send you the notes as well.

For everything else, write to info@phoebes-place.nl. I answer within a month, free of charge. I may ask you to confirm that it is really you, so that nobody else gets your data.

If you are not happy with how I handled something, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live or work, in Germany for example the one for your federal state. The European Data Protection Board keeps a list of them all. I would rather you came to me first, but you do not have to.

8. What you have to give me

No law obliges you to give me your details. But I can only look after a pet when I can reach you, know where it lives or stays, and know what it needs, so without those details I cannot take a booking. Whatever a form does not mark as required is up to you.

9. Decisions made by a computer

None that affect you, and nobody builds a profile of you. The booking system works out prices and free dates the same way for everyone, and whether I take on a new pet is my own decision, made after we have met.

10. How it is kept

• This website only works over an encrypted connection, and its server, database and backups are all in the EU.
• Passwords and sign-in codes are stored scrambled (hashed), and logging in pauses after too many wrong attempts.
• Photos you upload of your pet can only be opened by you and me.
• The part where bookings are managed needs a login, and only I and the person who runs the website for me have one.
• My phone and my laptop are locked with a passcode.
• Keys are stored in a locked place without a name or an address on them.
• Paper notes about a pet are kept at home and are shredded when they are no longer needed.

If something ever goes wrong with your data in a way that is likely to put you at risk, I will tell you, and I will report it to the authority within the 72 hours the law allows.

11. Children

This service is for adults. I do not knowingly collect data about children, and if a child’s details reach me in a message I delete them.

12. Changes to this page

When what I do changes, this page changes with it, and the date and version at the top tell you when that last happened.

This page exists in English and in Dutch, with the same content. If the two ever say different things, the English text applies.

Cookies & storage in detail

This overview is generated automatically from the services actually in use on this site and is always up to date.