Privacy statement

Zoek Sabai handles your personal data with care and complies with the General Data Protection Regulation (GDPR). Here you can read which data we process, why and for how long. Last updated on 4 October 2026.

• Zoek Sabai, Westwagenstraat 76, 4201 HJ Gorinchem, the Netherlands
• Email: info@thaimassagegorinchem.nl
• Chamber of Commerce (KvK) number: 42134725
• Controller and privacy contact: Nang Kung Sheng (Kate)
• Full name and legal form: Nang Kung Sheng, sole proprietorship

• Contact details: name, email address and phone number.
• Appointment details: treatment, date and time, therapist, your notes and the status of your appointment.
• Payment details: what you paid and how, and your multi-visit cards, gift cards and credit.
• Intake and health data: your answers to the health questions (see section 4).
• Account details if you create an account, and your message preferences (email, WhatsApp, news).
• Technical data needed to run and secure the website.

• Making and confirming your appointment, reminding you and passing on changes (performance of the contract).
• Treating you safely and responsibly (intake, with your explicit consent).
• Keeping track of payments, multi-visit cards and gift cards, and our accounting (legal obligation).
• Occasionally sending you news or a review request, only with your consent. You can unsubscribe at any time.
• Securing the website and our systems (legitimate interest).

Data about your health are special category data. We only ask for them so we can massage you safely, and only with your explicit consent, which you give when you fill in the intake.

Only the therapists and the owner of Zoek Sabai can see your intake. An intake is valid for 24 months, after which we ask you again. We delete old answers no later than 24 months after your last visit or after you filled them in, whichever is later; a booked appointment that is still to come also counts as a visit. You can withdraw your consent at any time; we will then delete your answers.

We send messages about your appointment by email. Via WhatsApp only if you want: you turn it on yourself by sending us the message with your code from your own number. We record when and from which number you gave consent.

Via WhatsApp we only send messages about your appointments, no advertising. Send STOP and you will no longer receive WhatsApp messages.

When an appointment is made, moved or cancelled, our own staff receive a notification by email, WhatsApp or in the app, with your name, the treatment, the time and the therapist. This is needed to carry out your appointment (performance of the contract) and to run the salon properly (legitimate interest). Your note and contact details are not included in that notification.

We work with a few service providers (processors). We have agreements with them so they also handle your data with care:

• Hosting and software of the website and booking system: Indanta (Rex Media); the servers are hosted by DigitalOcean (data centre in the EU, Amsterdam).
• Twilio and WhatsApp (Meta): for WhatsApp messages to you, only if you turned WhatsApp on, and for appointment notifications to our own staff.
• E-mail: Google Workspace, for confirmations and reminders.
• Apple and Google: for push notifications in the staff app, with the guest's name, the treatment and the time.
• MultiSafepay: for online payments, once these are available.
• Our accountant, for the statutory accounts.

Twilio, Meta, Google (Workspace and push notifications), Apple and DigitalOcean are US companies; they may process data in the United States. They do so on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Our servers at DigitalOcean are in the EU (Amsterdam). A notification to a staff member with a foreign number, such as the owner, is also delivered outside the EU. We never sell your data to anyone.

• Receipts and invoices (accounting): 7 years, the statutory tax retention period.
• Contact and appointment details: as long as you have an account with us.
• No account: 2 years after your last visit, except what we must keep for 7 years for the accounts.
• Intake and health data: 24 months after your last visit or after you filled in the intake or gave consent, whichever is later; a booked appointment that is still to come also counts as a visit (see section 4).
• Multi-visit cards and gift cards: until they are used up or expired, then as part of the accounts.
• Consents (WhatsApp, news): as long as they apply, and afterwards as long as needed to show that you gave them.

You may access, correct or delete your data. You can object to its use or have it restricted, request your data in a common file format (data portability) and withdraw any consent at any time.

Send your request to info@thaimassagegorinchem.nl. We will reply within one month and may ask you to identify yourself, so we know the request comes from you.

If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

We protect your data with appropriate measures, such as an encrypted connection, personal accounts for staff and restricted access to the intake.

Our website uses cookies that are needed for the site and booking to work, such as remembering your language and login. For any other cookies we ask your consent first.

We may update this privacy statement. The latest version is always on this page.