Privacy policy

WHO PROCESSES YOUR DATA (THE CONTROLLER)

The budevolno.cz service is operated, and personal data is controlled, by budevolno.cz s.r.o., Company ID No. 29810701, VAT No. CZ29810701, data box ID 2c3biv4, registered in the Commercial Register under file No. C 104704 kept by the Regional Court in Ostrava. For matters of personal data protection, contact us at podpora@budevolno.cz.

The full identification of the Operator, including its registered address, is in the Terms of use at budevolno.cz/podminky.

budevolno.cz is a booking service: for businesses (hairdressers, massage studios, restaurants and others) it takes online bookings and manages the calendar; for customers it helps to find a free slot and book it. This policy describes what data we process about you, why, who we pass it to and what rights you have.

We are the CONTROLLER for data you give us directly — when you create an account with us or book through budevolno.cz. For data a BUSINESS puts into the app (for example when it brings its own customer file over from an earlier system, or writes you in at the counter), that business is the controller and we are its processor: we handle such data only on its instructions and only as far as running the bookings requires.

The same applies to the answer you write to a business's question in the booking form: the business asks the question and only the business uses the answer, so the business is its controller and we process it on its instructions.

The rules for this processing (the business's instructions, sub-processors, reporting of security breaches, erasure at the end and audit) are set by the data processing agreement that the business concludes by accepting the Terms of use; it is an annex to them.

WHAT DATA WE PROCESS

In connection with a booking and with the use of the service we process:

• •Identification and contact data: the name and phone number you give when booking; an email address if you create an account or if you optionally fill it in on the booking form. The email address on the booking form is voluntary: without it the booking works exactly the same, we just cannot write to you about it.
• •Data from your Google account: if you sign in or register with Google, Google gives us your name, email address, a link to your profile photo, the identifier of your Google account, whether Google has verified your address, and for company accounts (Google Workspace) the domain of your organisation. We do not show your Google profile photo in the app; only a photo you upload yourself is shown.
• •Booking data: the business, the service, the slot, and where relevant the number of people, a preferred table, the name of the guest if you are booking for somebody else, and your answer to a question the business asks in the booking form.
• •Payment and purchase details: if a business requires payment in advance for a booking, a class or a course, the amount, the variable symbol, whether and when the payment arrived, and whether and when the business refunded it to you; if you buy a gift voucher, your email, optionally a name (“From”) and a dedication, and the amount you chose; if you buy a pass online, your email, name and phone number. If you buy while signed in, we link the purchase to your account so that you can see it in the app. Payment card details never reach us: you enter them directly with the Stripe payment gateway.
• •Details of a sign-up for a class or course: your name, phone number, optionally your email, the class or course, your place on the waiting list, the language in which you signed up, and whether you attended the class; attendance is recorded by the business at the counter or in the attendance list.
• •Details from an enquiry: if you send a business an enquiry, your name, phone number, optionally your email, your preferred time and the text of your message.
• •Details of watching for free time: if you ask us on a business's page to let you know when a slot becomes free, your name and phone number, the service, possibly the staff member, the period you chose and the language in which you asked us to watch.
• •Data a business enters about you into the app: if a business transfers its customer file from its previous booking system or adds you by hand, your name, phone number, possibly your email, details of your bookings with it and a note the business keeps about you (free text that the business wrote into the app or transferred). The business is the controller of this data.
• •Details of loyalty schemes, passes and vouchers at a business: the code of your customer card (QR), the number of stamps or points and their history, the entries left on a pass and the history of their use (when, for which class, and whether at the counter, in the business administration or online), and the balance of a voucher.
• •Details from your communication with us: the content of the messages you send us through support in the app or by email, and the name and email address we should reply to; if you report a business profile, the reason for the report and an optional message and contact, if you give them yourself.
• •The address for delivering notifications to your device, if you switch them on: your browser issues it and we store it with your account.
• •Optional data you set yourself: favourite businesses, ratings of a visit, the interface language, and a profile photo if you upload one to your account. Only you see the photo, in your account; it is not shown to businesses. You can delete it at any time in your Account. We keep your chosen language with your account so that it applies on other devices too; if you make no choice, the one stored in your browser decides.
• •Location data: if you permit it in your browser, we determine the location of your device so that we can order businesses by distance and offer you the ones near you. The coordinates obtained stay on your device: they are not transferred to our servers and we do not store them. You can withdraw the permission at any time in your browser settings, which stops the location being determined immediately. Without the permission you choose your default area by hand, by tapping on the map. Your browser also uses the distance from the detected or hand-picked location for the default order of businesses (see the terms, article Ranking of businesses); the location is not transferred to our servers for that either. If a map centred on your location is shown to you, the provider of the base maps can tell from the map section roughly the area where you are (see the section on who we pass data to).
• •Technical data: IP address, browser type and data from the cookies necessary to run the service (see Cookies and storage). We also write your IP address, and for some forms your email address or phone number, into request counters that protect the service from misuse (how long we keep them is described in the section on retention).
• •Data about a business's staff: if a business introduces its people on its profile, we process the name (and possibly the surname or a nickname), the job role, a short introduction and a photograph. The business enters and publishes this data itself, as the controller; we only store and display it. Publication is voluntary and the business can switch it off at any time, at which point the photograph is deleted from our storage too. A staff member's name is also shown when a particular person is chosen on the booking form, if the business turns that option on for a service. We do not publish staff contact details. The manager of a business may store an internal email address for a staff member, to which we send that person their own work schedule; otherwise we use it only to assign an email in our inbox to the right business. The address is entered by the business as the controller, is not displayed anywhere on the profile, and is not passed to anyone other than the provider that sends emails on our behalf. The business can delete it at any time.
• •Details of a business's team: if the owner of a business invites a receptionist into the administration, the invited person's email, their role and when they accepted the invitation.
• •Data about a business and its founder: if a business creates a profile with us with a company registration number or changes that number, we check it in the public ARES register and store from there the business name or the name of the trader, the registered office (for a self-employed person this is often their home address) and the date the business started; with the request to publish the business we also store the name the founder gave. Of this, we show publicly on the business's profile only the year since which the business has been operating.

WHY WE PROCESS THE DATA AND ON WHAT BASIS

Every processing operation has its purpose and its legal basis under the GDPR:

• •Mediating and confirming a booking with the business you choose: performance of a contract, or steps taken prior to entering into a contract (Article 6(1)(b) GDPR).
• •Text messages to the number you give (confirmation of a booking or of a sign-up for a class or course, a reminder the day before, a reminder of an unpaid deposit before the deadline, a message when the business cancels a slot or when a slot is cancelled because of an unpaid deposit, a message that the business removed you from a class, a message when the business does not confirm a table booking, a message when a slot is moved, an offer of a slot that has become free, a tip about an earlier free slot if you are watching for one, and a message to someone on a waiting list that a place in a class has become free for them, possibly with a request to pay): performance of a contract and our legitimate interest in a reliable service (Article 6(1)(f)). The business cannot switch off the booking confirmation and the message about a cancelled slot, nor the message about an unconfirmed table, because without them you could arrive at a closed door; the business can switch the other messages off in its settings. Text messages are paid from the business's text-message credit: when it runs out, they do not arrive, except for a message that your booking has been cancelled (by the business, because the deposit did not arrive in time, or because the business did not confirm a table booking) and the confirmation of a table booking to a guest who has neither an email nor an account. For a business without a paid plan we pay for those ourselves, at most 5 cancellation messages and 5 table confirmations per business in a calendar month. Text messages also do not arrive when you switch them off in your account or when you tell the business not to text you.
• •Verifying the phone number before a booking: before we create a booking, a sign-up for a class or course, or a watch for free time without you being signed in, we send a text message with a one-time code to the number given, and you copy it into the form. Without this it would be possible to book on somebody else's or a non-existent number: the confirmation would then reach a different person and the business would wait for a guest who knows nothing about the booking. We also send you a one-time code when you verify your phone number in your account: once it is verified, we record in the account that the number is yours and, if your account has no other number linked to it and no other account uses this number, we link it to your account; your account then also shows the bookings that businesses keep under this number (for example those you made without signing in or by phone). Legal basis: steps taken prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in protecting the service from misuse (point (f)).
• •Verifying a number a business wants to add to a customer's record: if a business adds a new phone number to its customer file, we send a text message with a one-time code to that number at its request. The number is added to the record only if its holder passes the code on — this is how we verify that the number belongs to the person who agrees to it being added, and the business cannot link the record to someone else's number. The customer file is kept by the business, so the business is the controller of this data and we process it on its instructions; we pay for the text message, not the business.
• •Verifying a business's phone number: if a business enters a phone number in its profile, we send a text message with a one-time code to that number at its request, with which the business confirms that the number is its own. Legal basis: performance of the contract with the business (Article 6(1)(b) GDPR).
• •Emails to the address you give (confirmation of a booking or of a sign-up for a class, for a table booking also a message that we have received it and it is awaiting the business's confirmation, and a message that the business did not confirm it, a message when a slot is cancelled or moved, a reminder the day before, a reminder of an unpaid deposit, and a message that a booking was cancelled because the deposit was not paid): performance of a contract and our legitimate interest in a reliable service (Article 6(1)(f)). We always send the confirmation and messages about changes to your booking for as long as we hold your address, because without them you would not know about your slot. You can unsubscribe from the reminder the day before at any time, using the link in the message itself. If you have an account and are watching for an earlier slot or for free time, we also email you offers of a slot that has become free and tips about an earlier free slot; you switch these emails off in your Account under notification settings (Just freed up nearby).
• •Notifications on your device (push): if you switch them on in your Account (in the business administration, in the account settings), we send to your device the same notices you see in the app, for example a reminder of your appointment the day before and about two hours before it, a message about a cancelled or moved slot, an offer of a slot that has become free, a message that a favourite business has announced free time or published news, a message that your enquiry has been dealt with, that you have earned a reward in a loyalty scheme or that a voucher or pass is about to expire, and a reply from support; to a business, a message about a new, moved or cancelled booking and about customers' payments, which does not contain the customer's name. The message is delivered by the push service of your browser's maker; its content is encrypted, so that service cannot read it. You can switch notifications off at any time in the same place, and we then delete the delivery address; if you withdraw the permission in your device settings, we delete it as soon as the service tells us it is no longer valid. Legal basis: your consent given by switching the notifications on (Article 6(1)(a)).
• •Payment in advance for a booking, class or course: if a business requires a deposit or payment in advance, we show you the details for a transfer to its account (the account number, the amount and the variable symbol) and may offer payment by card. The money goes directly to the business; we do not hold it. If the business has linked its bank account, we go through the incoming payments on its behalf and mark the booking as paid according to the variable symbol; from the bank statement we keep only the identifier of the matched payment. Card payments are processed by Stripe on the business's account: you enter your card details and any other details it asks for when paying (for example your email) directly with Stripe, and we do not see them. If the business has linked its bank account with us and the payment does not arrive, then, where the deadline is at least three quarters of an hour long, we remind you of it once before the deadline ends, and after the deadline the booking or sign-up is cancelled automatically; we tell you why. At other businesses, the business may cancel an unpaid booking or sign-up after the deadline. We let the business know that a deposit has arrived, has lapsed or should be refunded, including your name. If the business refunds your money, we record when: either the business marks it itself, or we learn it from Stripe. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• •Buying a gift voucher: if a business sells gift vouchers online and you buy one, we use your email to send you the voucher to print. The name (“From”) and the dedication appear on the voucher. The voucher is sold by the business, so we pass your email and name to it, so that it knows whom it sold the voucher to and can handle a possible refund. The card payment goes through Stripe directly to the business's account, and Stripe also receives your email from us; neither we nor the business see your card details. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• •Buying a pass online: if a business sells passes online and you buy one, we send a confirmation to your email. The pass is sold by the business, so we pass it your name and phone number, by which it keeps the pass on your customer record, and let it know that it has sold it. Card payment goes through Stripe directly on the business's account, and Stripe also receives your email from us; neither we nor the business see your card details. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• •Signing up for a class or course: when you sign up, we pass the business your name and phone number, which it sees in the attendance list, and send you a confirmation and a reminder. If a class is full, we put you on the waiting list; if a place becomes free, we move you into it and tell you by text message, possibly with a request to pay. The business itself can also sign you up for a class, and we then send you the confirmation all the same. If the business removes you from a class, we let you know by text. The business records your attendance at a class, at the counter or in the attendance list. You see the sign-up in your account if you signed up with your account. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• •A link to your booking without an account: if you do not have an account, the confirmation includes a link to your booking or sign-up. Through it you can view and manage it: cancel or move the slot, cancel your place in a class, confirm that you are coming, pay a deposit, accept an offer of an earlier slot or rate the visit. The link works like a key, so do not forward it to anyone. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• •An enquiry to a business: if you send a business an enquiry, we pass it your name, phone number, preferred time and message. We do not pass the email from the enquiry to the business: we use it (or the address of your account) to send you a copy of the enquiry, at most three copies to one address in 24 hours, and a message once the business has dealt with it. The business learns it when you reply to one of these messages. If you are signed in, you also see the enquiry and its status in your account, and we let you know that it has been dealt with through a notice in the app. Legal basis: taking steps prior to entering into a contract (Article 6(1)(b) GDPR).
• •Watching for free time without a booking: if you find no free slot at a business and ask us to let you know when one becomes free in the period you choose, we pass your name and phone number to the business (if you do not yet have a customer record there, one is created for you). We offer a slot that becomes free first to customers who already have a booking with the business and are watching for an earlier slot, and then to those watching for free time in the order in which they asked. As soon as it is your turn, we let you know by text message, paid from the business's text-message credit unless the business has switched it off, and, if you have an account, also through a notice in the app, by email and possibly by a notification on your device. We do not hold the slot for you: whoever books it first gets it. Watching ends as soon as you book a slot within the period being watched, when you switch it off using the link in the message or in My bookings, or when the period ends. Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• •Rating a visit or a class: after a visit has taken place, we may ask you to rate it, through a notice in the app or, if you do not have an account and gave an email, once by email with a link to unsubscribe from the business's emails. You can also rate a class you attended and, with your account, a visit without an online booking at which the business scanned the card from the app at the till and added a loyalty stamp. For such a stamp we record whose card the counter scanned, and only you can rate it, at most 14 days after the stamp and at most once in 30 days for any one business; we send you an invitation to rate after a stamp at most once in 30 days per business. The stars count towards the business's average rating, which everyone can see. If you also write a text with your rating, we publish it on the business's profile together with the stars, the date and a label saying whether the rating follows a booking or a class (“verified customer”) or a visit with a loyalty stamp (“verified visit”), but without your name, and the business may reply to it publicly. We do not show the business your name with the rating; a business with few visits may, however, work out from the date and the label who wrote it. Legal basis: our legitimate interest in trustworthy ratings of businesses (Article 6(1)(f)).
• •Loyalty schemes, passes and vouchers at the counter: if you show the QR code of your card at a business, the business uses it to find your customer record and adds a stamp, deducts an entry from a pass or an amount from a voucher. If you do not yet have a customer record there, we create one for the business with the first stamp, using the phone number from your account, but we do not give the business the name on your account. You and the business can both see the history of stamps and of a pass's use in the app, and if you earn a reward, we let you know through a notice in the app. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• •Notice that something is about to expire: about 14 days before a voucher or pass that still has something left on it expires, we let you know, through a notice in the app and by email or, if you do not have an account, to the email the business holds for you or that you gave when buying the voucher online. Legal basis: our legitimate interest in you not losing value you have paid for (Article 6(1)(f)).
• •Notifying a business that a table booking is awaiting confirmation: if you are a business that takes table bookings with us, we let you know about every new table booking by email and by a notification in the administration; if it stays unconfirmed for half an hour, we also send a text message to your business's verified phone number. That text message is paid from your credit and you can switch it off in the table settings. Legal basis: performance of the contract with the business (Article 6(1)(b) GDPR).
• •A reminder that it is time to book again: for businesses you add to your favourites, we watch the rhythm of your own visits and at the estimated time let you know through a notice in the app and, if you have them switched on, through a notification on your device. If you have an active Plus or Platinum plan (a trial period does not count), we also send you an email and a text message to your account's phone number; we look for a free slot at the business further ahead for you, and with the Platinum plan we suggest up to three specific slots in the email. The business pays for the text message from its text-message credit and can switch it off, as well as the reminders altogether. We decide from your bookings with that business, from its free slots and from your account's plan. Before we send you a reminder, we compare your account's phone number and the numbers of your bookings, sign-ups and enquiries with that business with the numbers under which you have refused offers from it; if you have refused them, we send you nothing. So that you are not written to twice about the same estimated time, we record when we wrote to you about which business; we delete this record after 400 days. We pass this data to nobody. Legal basis: our legitimate interest in a useful service (Article 6(1)(f)). You can switch it off at any time in your Account under notification settings (Time to book again), or by removing the business from your favourites.
• •Notices about free time and news at your favourite businesses: if a business you have among your favourites announces free time for today, or publishes news on its profile, we let you know through a notice in the app and, if you have switched them on, also through a notification on your device. We send both kinds of notice together at most once a day per business and at most three times a day in total; we do not write to members of a business's team about its own free time or news. For this we use only the list of your favourite businesses, the language of your account and a record of whom we wrote to on which day about which business; that record serves only to keep to these limits, and we delete it the following day. Before we send you news, we also compare the phone number of your account and the numbers of your bookings, sign-ups and enquiries at that business with the numbers under which you have declined its offers; if you have declined them, you will not get its news. We do not pass this data to the business or to anyone else. Legal basis: our legitimate interest in a useful service (Article 6(1)(f)). You can switch it off at any time in your Account under notification settings, each separately (Free time at your favourite businesses, News from your favourite businesses), or by removing the business from your favourites.
• •Card in your phone's wallet: if you save the card to Google Wallet, we send Google your card code, your name and the language — the card needs the code and the language to exist in the wallet at all, and your name stands on it as the heading by which you recognise it. So that we can remind you of the card when you are at a business, we also attach the coordinates of at most ten businesses where you have a booking or which you keep among your favourites and whose location we know precisely; once an hour we reconcile them with your bookings, your favourites and the name on your account, so a change of name reaches the card by itself. For this card we do not send your phone number or stamp counts, and we do not track your own location — your phone works out on its own that you are at a business. Until you tap the Add to Google Wallet button, nothing is sent to Google and the card in the app works exactly the same. Legal basis: your consent given by saving the card (Art. 6(1)(a)).
• •A business's loyalty card in your phone's wallet: if, at a business with a loyalty programme, you also save its card to Google Wallet, we send Google your card code, your name and the language, the business's name, logo and location, the rules of its loyalty programme and the number of your stamps there. We reconcile the stamp count on the card after every stamp and once an hour, so the card shows the real state. We do not send your phone number. Until you tap the button at that business, nothing is sent to Google. Legal basis: your consent given by saving the card (Art. 6(1)(a)).
• •Service messages about your account and subscription: by email we welcome you after you create an account, send you a link to confirm your address, reset your password or change your email, warn you about changes to your account's security (a new password, a changed email address, a sign-in method linked or removed, two-step verification switched on or off, and a changed authenticator app), confirm a subscription you have ordered and a withdrawal from the contract we have received, and let you know that a trial period is ending or that a subscription payment could not be taken. Legal basis: performance of a contract (Article 6(1)(b) GDPR) and, for warnings about security changes, our legitimate interest in protecting your account (point (f)).
• •Messages to a business and its team: by email and possibly by a notification on their device, we let all members of the business's team, owners and receptionists alike, know about new, moved and cancelled bookings, sign-ups and enquiries. We also let business owners know about their customers' payments (a deposit paid, lapsed or waiting to be refunded, a voucher or pass sold), about how their requests have been dealt with (to publish the business, to change its details or its field, or to refund text-message credit), about actions taken by our dispatch team (for example pausing or blocking the business), about the state of their text-message credit, about a custom domain being disconnected and about the business returning to Discover. To the billing email address a business enters, we send a link to verify it. Legal basis: performance of the contract with the business (Article 6(1)(b) GDPR). We send the monthly summary of what the service has brought the business, partner programme codes and discount codes on the basis of our legitimate interest (point (f)), and the business can refuse them at any time.
• •Support and reporting a profile: if you write to us through support in the app or by email, we keep your message, name and email so that we can reply; we send the reply by email and, to a customer with an account, also as a notice in the app. If you report a business profile, we store the reason, your message and your contact if you give it, so that we can look into the report and get back to you if needed. Legal basis: our legitimate interest in dealing with your question and in protecting the service from fake profiles (Article 6(1)(f)).
• •Emails you exchange with us: we compare the addresses of the sender and the recipients of a message with the customer files and teams of the businesses that use the service, so that we can assign the message to the right business and deal with it; about you we see only the name recorded with your address and the name of the business, and the look is written to an audit log. If you reply to an email that a business sent you through us, we pass the text of your reply and your address on to that business, even though we do not otherwise pass your address on to it, provided we recognise you by your address as its customer; otherwise we deal with it ourselves. Legal basis: our legitimate interest in dealing with the message and in getting a reply meant for a business to that business (Article 6(1)(f)).
• •An invitation to a business's team: if the owner of a business invites a receptionist into the administration, we send an invitation valid for seven days to the email given; only an account with the same verified address can accept it. Legal basis: performance of the contract with the business (Article 6(1)(b) GDPR).
• •Verifying a business: we use the data from the ARES register and the name the founder of the business gave to verify that the business exists and that it is being set up by an authorised person, and to approve its profile; we also put the business name or the trader's name from ARES on the tax documents for the business's subscription. Our dispatch team sees them. Legal basis: performance of the contract with the business (Article 6(1)(b) GDPR) and our legitimate interest in protecting the service from fake profiles (point (f)).
• •A suggested text for a business's profile: if a member of a business asks in the administration for a suggested text for the business's profile, we pass to the language model provider the details the business has entered about itself in its profile (name, field, focus, town, description, amenities, and the names and descriptions of its services), even if the profile has not been published yet. We do not pass on the business's phone number or e-mail; whatever the business itself wrote in its description is passed on as written. We do not use details of customers or bookings for this. We do not store the suggestion; the business saves it itself after checking it. Legal basis: performance of the contract with the business (Article 6(1)(b)).
• •News and tips: we send the newsletter (to customers with an account and to businesses) and a short series of “Tips on features” emails to business owners only to those who have switched them on in their settings themselves. You can unsubscribe at any time using the link in the email or in the settings. Legal basis: your consent (Article 6(1)(a)).
• •Support and protection of the service by our dispatch team: to handle support and to protect against misuse, our dispatch team can see, for a customer account, the name, email, phone number, subscription, bookings at individual businesses and support questions, and can block a phone number from which the service is being misused. Every such look and action is written to an audit record. Legal basis: our legitimate interest (Article 6(1)(f)).
• •The quality and security of the service (protection against misuse and spam): legitimate interest (Article 6(1)(f)).
• •Optional features you activate (an account, favourites, watching for an earlier slot, subscribing to your bookings in your phone's calendar): performance of a contract, or your consent.
• •Sign-in and registration with Google: steps before entering into a contract and its performance (Art. 6(1)(b)); keeping an unfinished registration for 7 days after you last signed in so that you can finish it: legitimate interest (Art. 6(1)(f)).
• •Compliance with legal obligations, for example accounting and tax ones: Article 6(1)(c).

WHERE WE GET THE DATA FROM

Most of the data comes straight from you — you fill it in when booking or when creating an account.

If you sign in with Google, the data listed in the section on what data we process is given to us by Google, and only the data you approve with Google.

If a business creates a profile with us with a company registration number, we take the details of the business (the business name or the trader's name, the registered office and the date the business started) from the public ARES register kept by the Czech Ministry of Finance.

Some data may reach us from the business whose customer you are: when it moves over from an earlier booking system and brings its customer file with it, or when it writes you in by hand. In that case the business is the controller of that data — ask it about the processing and exercise your rights with it. We handle the data only on its instructions.

Bringing a customer file over does not send you any message from us. You get booking messages (confirmation, reminder) only for slots you actually have with the business.

WHO WE PASS THE DATA TO

We pass your booking data to the business you are booking with, as otherwise it could not confirm the booking. The business receives your name and phone number from us and keeps them in its customer records. In its administration it also sees the history of your visits there, their price and whether you are among its new, regular or top-spending customers or among those who have not been there for a long time, and it can copy phone numbers to contact you itself. If it contacts you outside a booking, it acts as an independent controller and is responsible for doing so: it may send you commercial messages only as the law allows. You can refuse them directly with the business and with us: by ticking the box when you book, sign up, send an enquiry or ask us to watch for free time, or at any time later in My bookings or via the link in the confirmation text. We remember the refusal against your phone number, the business then does not get it among copied contacts, and we do not delete it even when you delete your account, so that it keeps applying.

We do NOT pass on the email address you fill in on the booking form to the business: we use it to write to you about your booking and to assign an email you exchange with us. The business learns it when you reply to an email it sent you through us. We also use vetted providers (processors) that run the service for us technically:

• •Supabase: database, sign-in and storage (storing bookings and accounts).
• •Google: sign-in and registration with Google, if you use them. Google verifies your identity and gives us the data listed above. Here Google is not our processor but an independent controller of your Google account.
• •Vercel: running and hosting the web application.
• •Google: the card in Google Wallet, if you save it there (the card code, your name, the language and the coordinates of at most ten businesses where you have a booking or which you keep among your favourites; for a business's loyalty card also the business's name, logo and location, the rules of its loyalty programme and the number of your stamps there). Here Google is not our processor acting on our instructions, but the operator of the wallet you chose.
• •GoSMS: sending text messages to customers (the verification code before a booking, a verification code that, at a business's request, we send to a number the business wants to put on a customer's record, the confirmation of a booking or of a sign-up for a class, the reminder, a reminder of an unpaid deposit, a message when the business cancels or moves a slot, a message about a cancellation because of an unpaid deposit, a message that the business removed you from a class, a message about an unconfirmed table, an offer of a slot that has become free, also when you are watching for free time, a tip about an earlier free slot, a message to someone on a waiting list about a place that has become free in a class, the notice that it is time to book again, and the same verification code before a sign-up for a class or a watch for free time and for verifying the number in your account) and to businesses (a verification code for the business's phone number and a notice that a table booking is awaiting confirmation).
• •Stripe: processing card payments. For the budevolno.cz subscription it is our processor. At businesses that offer it, it also processes payment in advance for a booking, class or course and the purchase of a gift voucher or pass; these payments go directly to the business's own Stripe account under its contract with Stripe, and here Stripe is not our processor but the business's payment gateway. For a gift voucher and a pass we also pass your email to Stripe. From Stripe we learn that a payment has gone through or that the business has refunded it. You enter your payment card details directly with Stripe; we neither see nor store them.
• •Fakturoid: issuing and keeping records of tax documents for payments received.
• •Resend: sending email notifications (messages to the business about a booking, a sign-up and an enquiry; the confirmation of a booking or sign-up, messages about a table booking, a message about a cancellation or a move, the reminder and the reminder of an unpaid deposit to the customer; an offer of a slot that has become free, also when watching for free time, and a tip about an earlier free slot; the gift voucher and the confirmation of a pass to their buyer; a copy of an enquiry and the message that it has been dealt with; a request for a rating; notice that a voucher or pass is about to expire; the notice that it is time to book again; a reply from support; an invitation to a business's team; the welcome email, address confirmation, password reset, email change and warnings about changes to account security including two-step verification (some of these are sent through Resend by our sign-in service Supabase); the confirmation of a subscription and of a withdrawal we have received; messages to business owners about how their requests have been dealt with, about actions by our dispatch team, about text-message credit and about their custom domain, the link to verify a billing address, the monthly summary, partner programme codes and discount codes; service messages about the subscription and messages about payments to business owners; the confirmation that an account has been deleted, to its verified address; tax documents to the business's verified billing address or, if the business has none, to its owners; a staff member's schedule to their internal address; the newsletter and tips on features).
• •Google (Google Workspace): our mailbox: the emails you write to us and the replies to emails you receive from us.
• •The notification delivery service of your browser's maker (for example Apple, Google, Microsoft or Mozilla), only if you switch on notifications on your device. It passes the message to your device; its content is encrypted and that service cannot read it.
• •Stadia Maps: base maps (with data from OpenMapTiles and OpenStreetMap). We load map tiles from the European endpoint of Stadia Maps, so your device connects only to its servers in the European Union. When a map loads, Stadia Maps receives your IP address and the map section you are looking at, so for a map centred on your location also the rough area where you are.
• •Google (YouTube): playing a video on a business's profile, if you start it yourself. The video is loaded from YouTube (Google Ireland Limited) only after you click the play button; until then your device sends nothing to YouTube or Google, and we send you the video preview from our own server. Once you start it, Google receives your IP address and details about your browser and device and, under its own policy, may store cookies and similar data on your device. We embed the player in privacy-enhanced mode (youtube-nocookie.com). Google is not our processor here but a separate controller, and it processes the data under its own privacy policy.
• •Anthropic: a language model that, at a business's request, suggests a text for its profile. For the suggested text we pass it only the details the business has entered about itself in its profile (name, field, focus, town, description, amenities, and the names and descriptions of its services); details of customers or bookings and the business's phone number and e-mail are not passed to it. The same provider helps us prepare a profile proposal from the public website of a business we contact; what we pass to it in that case is described in the information at budevolno.cz/odhlasit/osloveni. The contracting party is Anthropic Ireland, Limited; the data may also be processed in the USA on the basis of standard contractual clauses, and under its terms Anthropic generally deletes it within 30 days.
• •Cloudflare: protecting forms against automated misuse (where active) and a security backup copy of the database kept outside the main storage (R2 storage in the European Union); for businesses on a paid Premium plan, also a copy of the photos and logo from their profile, in the same place.

TRANSFERS OUTSIDE THE EU

Some providers may process data on servers outside the European Union, for example in the USA. In that case the transfer is covered by appropriate safeguards under the GDPR, in particular the European Commission's standard contractual clauses. We pass data to nobody with whom we do not have a corresponding contract in place.

HOW LONG WE KEEP THE DATA

We keep booking and account data for as long as you use the service, and afterwards for as long as is necessary to protect our rights and to meet legal obligations (accounting documents, for example, for the period laid down by law).

If you delete your account, we remove or anonymise the associated personal data, except for what we are required by law to keep.

If you delete your account, we also end your running subscription so that nothing more is charged: a paid period will not renew and an unpaid one is cancelled straight away. We keep tax documents for payments made for as long as the law requires.

If you start registering with Google and do not finish (you do not accept the terms), we delete that account together with the data from Google 7 days after you last signed in, provided nothing has been linked to it in the meantime.

An order for a gift voucher or a pass that is not paid is deleted together with the email, name and phone number after seven days, during the regular daily clean-up. A paid order is kept as a record of the sale; when you delete your account, or at your request, we remove the email, name, phone number and dedication from it and keep only the amount and the voucher or pass.

If you delete your account, we cancel your future bookings and your places in future classes and courses, so that nobody waits for you in vain. The business still receives a message about a cancelled booking with your name and the time, and we offer the freed slot to others who are interested. Past visits stay with the business with no link to you.

We keep enquiries, watches for free time, sign-ups for classes, ratings, loyalty stamps and pass movements for as long as the service is used, as part of the records at the business. When you delete your account, we delete the ratings you gave from your account and the watches for free time at businesses where we can reliably link your customer record to your account (through bookings and sign-ups made from the account or through the phone number verified in your account), anonymise your details in enquiries, and stamps, passes and past sign-ups stay with the business only on an anonymised customer record.

We delete notices in the app after 30 days. We keep audit records of our dispatch team's looks and actions for 24 months. We delete a support question one year after the last message in a resolved thread, or earlier together with your account; we do not delete an open thread. We delete a report of a profile that has been dealt with one year after it was submitted; we do not delete one that has not been dealt with. We delete an invitation to a business's team one year after it was accepted, cancelled or expired, or earlier together with an account that has the same address. We also delete a report or an invitation at your request.

We hold a verification code, and the number we sent it to, only for as long as it is valid: ten minutes. We delete the record as soon as you enter the code, ask for a new one or request a code from elsewhere; anything left over is cleared up in the nightly run at the latest. Separately we keep a count of the codes sent to a single number, so that we can watch for misuse and for the cost of text messages; we delete those records within 45 days at the latest, and immediately when your data is erased.

We hold just as briefly the verification code that, at a business's request, we send to a number the business wants to put on a customer's record; we pay for this text message, not the business. The code is valid for ten minutes. We delete its record as soon as the code is entered or the business asks for a new one; a code that is never entered is cleared up after it expires in the nightly clean-up at the latest, that is by the following day. To protect against misuse we keep counts of such codes sent for a single business and to a single number for no longer than 45 days.

We delete the counters with which we protect forms, signing in and the sending of messages from misuse, and which carry your IP address, email address or phone number, within 45 days at the latest. If you delete your account, we immediately delete those that carry your account's confirmed email address or its verified phone number; counters with your IP address, with an unverified phone number or with a different email address (for example one you changed earlier, or the address from an unfinished email change) remain until those 45 days have passed.

If an email we sent you comes back permanently as undeliverable, or if you mark it as spam, we put your address on a list of undeliverable addresses. On it we store only a fingerprint of the address (a code we compute from it with a secret key, from which the address cannot be read back), the type of event and its time. We then send no emails from the app to an address on this list, not even booking confirmations or other messages about your bookings, account or subscription. This does not apply to emails for verifying an address or resetting a password, or to messages from our mailbox (our replies and customers' replies we forward). We delete the record a year after the last such event, when you delete your account, and earlier at your request.

To protect against data loss we make regular backup copies of the database. Data is not deleted from a backup immediately: it disappears from the live database at once, and drops out of the backups within 90 days at the latest, when the oldest backup is automatically removed. Backups serve solely to restore the service; they are not worked with in any other way.

For businesses on a paid Premium plan we also back up, outside the main storage, the photos and logo from their profile, that is, files that are publicly visible on the business's profile anyway. We do not back up photos of a business's staff. When a business deletes a photo or stops paying for Premium, its photos and logo drop out of the backups within 90 days at the latest.

YOUR RIGHTS

In relation to your personal data you have the right:

• •to access your data and to obtain a copy of it,
• •to have inaccurate data corrected,
• •to erasure (the right to be forgotten), unless we are obliged to keep the data,
• •to restriction of processing and to data portability,
• •to object to processing based on legitimate interest,
• •to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

HOW TO EXERCISE YOUR RIGHTS AND WHERE TO COMPLAIN

Send your request to podpora@budevolno.cz, or directly to the business you booked with. We will deal with it without undue delay, within one month at the latest.

If you believe we are processing your data unlawfully, you can lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

COOKIES AND SECURITY

Which cookies and browser storage we use, and how to manage your consent, is described on the Cookies and storage page. We use no marketing cookies.

We measure traffic with our own means, and only where you give us consent in the banner. The legal basis is your consent, which you can withdraw at any time. The only thing that comes out of it is aggregate daily and monthly counts of visits, registrations and bookings, together with where a visit came from and which of our pages it landed on. We do not store the exact time, your IP address or anything that could be used to trace an individual person, and we pass these numbers to nobody. Without consent nothing is sent: such a visit is simply not counted in these numbers.

Independently of consent, on each business's profile we count only the aggregate daily number of times it was viewed, and we show that number to the business in its administration. For this we store nothing on your device and read nothing from it, and we do not store your IP address, browser details, the exact time or where you came from.

A video on a business's profile is loaded from YouTube only at the moment you click the play button. Until then nothing goes from your device to YouTube or Google; once the video starts, Google may store cookies and similar data on your device under its own policy, independently of the choices in our banner.

We protect data by technical and organisational measures (encrypted transmission, controlled access for authorised people only). Access to a business's data is held only by its members and, to the extent necessary, by our support desk.

CHANGES TO THIS POLICY

We may update this policy to a reasonable extent, for example when we add a new feature or provider. The current wording is always on this page; we will tell you about substantial changes.