CBBDigitalPrivacy Policy & Data Protection Notice
Processing and retention of personal data and data subject rights.
Roles and contact
CBBDigital LLC, 30 N Gould St, Sheridan, WY 82801, USA; info@cbbdigital.us. The salon business is controller for its appointment customers, staff and service delivery; CBBDigital is processor on documented instructions. CBBDigital is a separate controller for its merchant contacts/accounts, authentication, billing, support and platform security. Roles depend on the actual activity, not only the contract label.
Data and purposes
Data can include merchant and staff contact details, roles and credential hashes; service names/prices, schedules and leave; appointment customer name, phone and optional email, service/staff selection, appointment time/status, operational notes, payment-method/amount records and reports; preferences, authentication/delivery/suppression records; device/browser/session/IP security metadata; order, billing and contract acceptance evidence. Integrations can involve Meta/WABA/phone identifiers, protected access tokens and Calendar event/account links. The service is not limited to OTP processing. Full card details are entered with Stripe, not into our appointment forms.
Lawful grounds and minimisation
Contract necessity, legal obligations and balanced legitimate interests support relevant own-controller processing under GDPR/UK GDPR Articles 6(1)(b), (c) and (f), where applicable; consent is used for optional channels where required. Reading a privacy notice is not blanket consent. The salon determines the lawful grounds for its own customer/staff processing. Do not submit medical or other special-category data, identity-document copies or PAN/CVV. Unwanted sensitive content is restricted and removed or anonymised when identified; no perfect filtering guarantee is made.
Infrastructure and agreements
Hosting is through Hetzner Online GmbH on the selected Helsinki, Finland server; Cloudflare, Inc. provides CDN/network security; Google LLC Workspace provides business email. Applicable provider data-processing terms have been accepted through the relevant account processes and retained in a restricted archive. Public provider/DPA links, purposes and roles appear in the provider directory. Stripe has processor and independent-controller roles depending on payment, fraud prevention and statutory functions. Meta/WhatsApp and optional Calendar connections follow their own applicable terms.
International access and transfer safeguards
The provider is a US LLC; hosting in Finland does not prevent international provider processing or authorised cross-border technical/support access. EU GDPR Chapter V, UK GDPR, the UK Data Protection Act 2018 and the UK International Data Transfer Addendum (UK Addendum) are addressed where applicable; Swiss FADP safeguards are assessed for Swiss data. Where required, transfer instruments must identify the proper parties and modules, contain completed annexes and binding acceptance, and be supported by the necessary transfer assessments and supplementary measures before the restricted transfer begins. We do not claim Data Privacy Framework certification. A provider DPA is not a blanket transfer authorisation for every relationship.
Representatives and authorities
The need for an EU/UK representative is assessed under Article 27 based on territorial scope and actual processing. B2B status or a processor role alone is not an exemption, and regular processing is not automatically occasional processing. Swiss representation is assessed under FADP Article 14 where relevant. No representative is described as appointed without an actual mandate. Individuals can contact info@cbbdigital.us and complain to the competent authority, including Germany’s competent supervisory authority, Austria’s Datenschutzbehörde, the UK Information Commissioner’s Office (ICO), or Switzerland’s FDPIC.
WhatsApp and choices
WhatsApp integration is included in salon subscriptions; messaging itself requires an operational sender, appropriate approved Meta templates and a separate valid recipient opt-in. OTP verifies current access to the channel, not legal identity or general consent. Notification preferences can be withdrawn without cancelling an appointment. No SMS is offered. Incoming text is processed transiently in memory to recognise the documented stop commands and is not retained in the webhook log; event identifiers, sender, type and time can be retained. Outgoing template parameters and delivery states can be recorded. We do not promise absolute end-to-end encryption of all Cloud API processing. STOP, İPTAL, IPTAL, DURDUR, RET, UNSUBSCRIBE, ABMELDEN, STOPZETTEN, AFMELDEN, ARRET, ARRÊT, DESABONNER, DÉSABONNER. wa_id identifies the channel sender, not legal identity or general consent.
Retention and security
Access controls, protected secrets, TLS and audit trails support proportionate security. Contract IP/User-Agent metadata has a separate 90-day expiry/cleanup process. Completed operational message, webhook, provider-call and Calendar logs follow the configured operational retention policy (default 90 days); this does not automatically delete appointment, staff, consent, billing or contract evidence. Records are retained for their actual purposes and applicable statutory periods, then reviewed for deletion or return. New managed daily backups follow a 30-day rotation policy, retaining the latest two valid recovery copies and any documented legal holds. Earlier named archives are excluded from this automatic rotation and are subject to a separate necessity and deletion review. Backup archives are protected by strict server-side access controls and SHA-256 integrity manifests. We do not promise immediate record-level erasure within an archive. Before restoration, current deletion and notification opt-out records must be reapplied and verified before processing resumes; raw SQL/ZIP restoration does not automatically perform that replay. Operational log retention is configurable within 7–3650 days; the default is 90 days.
Rights and requests
Depending on applicable law, individuals may request access, correction, erasure, restriction, portability and objection, or withdraw consent. Contact the salon for salon-controlled records; CBBDigital assists it and handles its own-controller requests at info@cbbdigital.us or the deletion page. GDPR/UK GDPR requests are normally answered without undue delay and within one calendar month; lawful extensions are explained within that month. Verification is proportionate; an identity-document copy is not a default requirement. Requests and any public-authority disclosure are legally reviewed, minimised and documented; unlawful requests are challenged where appropriate.
Cookies and scope
Essential authentication/security storage supports the service. Optional analytics or marketing storage requires the applicable separate choice and is not authorised by the service contract. New business sales are limited to US, GB, DE, AT and CH. Language availability is separate from country eligibility; mandatory laws can still apply based on actual processing and individual rights.
Electronic acceptance evidence
Contract records include the accepted canonical text and SHA-256 hash, time and an HMAC session pseudonym (not a persistent device fingerprint); raw IP/User-Agent metadata expires after 90 days. The 6-year contractual claim evidence review policy is an initial review milestone, not automatic deletion or a universal maximum. Active contracts, specific legal holds and applicable claim periods are reviewed individually. Agreements and receipts are available at https://cbbdigital.us/account/contracts.php. Checkout uses an immutable checkout order snapshot.
Managed backups and restoration
New managed daily backups follow a 30-day rotation policy, retaining the latest two valid recovery copies and any documented legal holds. Earlier named archives are excluded from this automatic rotation and are subject to a separate necessity and deletion review. Backup archives are protected by strict server-side access controls and SHA-256 integrity manifests. We do not promise immediate record-level erasure within an archive. Before restoration, current deletion and notification opt-out records must be reapplied and verified before processing resumes; raw SQL/ZIP restoration does not automatically perform that replay.
13 stop commands
The complete exact command list, matching the webhook: STOP, İPTAL, IPTAL, DURDUR, RET, UNSUBSCRIBE, ABMELDEN, STOPZETTEN, AFMELDEN, ARRET, ARRÊT, DESABONNER, DÉSABONNER. Case and surrounding whitespace are normalised. Only a complete command matches; incoming text is inspected transiently and is not retained in webhook logs.
Business, tax and transfer verification
For jurisdictions outside the United States, online order approval additionally requires verification of official business/tax registration, the business identity and reverse-charge applicability for the relevant service. EU customers require VIES VAT validation; Swiss customers require UID and active MWST status; UK customers require UK VAT or verified business/HMRC evidence. A UID or CRN alone does not prove VAT status or reverse-charge eligibility. An API error or missing evidence never enables payment and enters review. We do not sell to applications that cannot satisfy verification. Preparation markets require separate activation and are not exempt from these conditions. Country and VAT number are sent to the official EU VIES service; returned business identity/address are matched with contract records. Evidence references, check time, result and approved service scope are retained for audit and reviewed with applicable billing/contract retention duties. Do not enter a raw UTR in this form.