Draft for review. Last updated 13 October 2026.
I am Agata Malczewska and I run Agata Wholistic Touch from Amsterdam. This page explains what I do with your personal data when you visit this site, book a treatment or an event, buy something in the shop, write to me or subscribe to my newsletter. I keep it short and I keep it honest. If anything is unclear, write to me at hello@agata-wholistic-touch.com.
Who is responsible
Agata Wholistic Touch, Van Spilbergenstraat 46-1, 1057 RJ Amsterdam, the Netherlands. Chamber of Commerce (KvK) 80985149, VAT NL003513288B56. I am the controller for everything described here.
What I collect, why, and on what basis
| When | What | Why | Legal basis | Kept for |
|---|---|---|---|---|
| You book a treatment | Name, email, phone, the appointment, and the answers to my intake questions (health conditions, medication, pregnancy, injuries) | To give you a safe treatment and to reach you about the appointment | Contract; for the health questions your explicit consent, which I ask for in the intake | Intake notes: 2 years after your last visit. Booking details: as long as the booking tool keeps them, at most 3 years |
| You book an event, a ceremony or a training | Name, email, phone, what you booked, payment reference, and for ceremonies the preparation call and intake | To run the event and to prepare you properly | Contract; explicit consent for health information | Order records 7 years (tax law); intake notes 2 years after the event |
| You buy in the shop | Name, address, email, phone, order and payment status. I never see your card or bank details; the payment provider does | To deliver the order and to keep my books | Contract and legal obligation (tax) | 7 years; the shop anonymises completed orders after 2 years and deletes inactive accounts after 3 years |
| You write to me through the contact form or by email | Name, email, your message | To answer you | Consent (the box under the form) and my legitimate interest in replying | Until the conversation is finished, then at most 1 year |
| You subscribe to the newsletter | Email, optionally your name | To send you news about sessions, events and trainings | Consent, confirmed by the email you receive after signing up | Until you unsubscribe (every newsletter has a link) |
| You visit the site | Anonymous statistics: pages viewed, country, device type, how you found the site | To see which pages are useful | Consent, through the cookie banner | 14 months in Google Analytics |
| You leave a testimonial | Your words, and your first name only if you agree | To show what sessions are like | Consent | Until you ask me to remove it |
Health information and intakes
Before a treatment or a ceremony I ask about your health: conditions, medication, pregnancy, injuries, and for ceremonies your mental health history. I need this to keep you safe and to adjust what I do. This is sensitive data and I handle it with care: I only ask what I need, I store it in my booking tool or in my own notes and nowhere else, I do not share it with anyone, and I delete it two years after your last visit. You can refuse to answer, but then I may not be able to treat you. You can ask me at any time to see or delete these notes.
Who helps me and sees some of your data
- Acuity Scheduling (Squarespace, USA) for treatment bookings and intake forms. Transfers to the USA are covered by the EU-US Data Privacy Framework.
- Pay.nl (Netherlands) processes payments in the shop, including iDEAL and cards. They are an independent controller for the payment itself.
- WooCommerce runs the shop on my own website; order data stays on my hosting.
- TransIP (Netherlands) hosts the website and its database.
- MailerLite (Lithuania, EU) sends the newsletter and stores subscribers.
- Google Analytics 4 (Google Ireland, data also processed in the USA under the EU-US Data Privacy Framework) for anonymous statistics, only after you accept cookies. IP addresses are not stored.
- My email provider delivers order confirmations, booking emails and replies to your messages.
- My accountant sees invoices, as the law requires.
I do not sell your data, I do not run advertising, and I do not profile you. I share data with the authorities only when the law obliges me to.
Cookies
Necessary cookies keep your basket and your cookie choice; they need no consent. Google Analytics cookies (_ga, _ga_*, 14 months) are only set after you click Accept in the banner. If you refuse, or do not answer, nothing is set for statistics. You can change your choice at any time with the “Change cookie choice” button at the bottom of every page, or by deleting cookies in your browser.
Your rights
You can ask me to show you the data I hold about you, correct it, delete it, limit what I do with it, or hand it over in a usable format. Where I rely on consent, you can withdraw it at any time; where I rely on legitimate interest, you can object. Write to hello@agata-wholistic-touch.com and I answer within a month. I may ask you to confirm who you are. If you think I handle your data wrongly, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). I would prefer you tell me first so I can put it right.
Children
Treatments, ceremonies and trainings are for adults. Sessions for kids are booked by a parent, who gives me the child’s first name and age and nothing more.
Security
The site runs over HTTPS, the shop and my accounts use two-factor login where the provider offers it, and intake notes are not kept on paper lying around the practice. No system is perfect; if something goes wrong with your data I will tell you and the authority within 72 hours, as the law requires.
Changes
When I change something here I update the date at the top. For changes that matter, such as a new tool that sees your data, I also mention it in the newsletter.