Privacy notice

The Apointo platform is provided by [NAZIV PRAVNOG LICA], [ULICA I BROJ, POŠTANSKI BROJ, MESTO], registration number [MATIČNI BROJ], tax ID [PIB] (“Apointo”, “we”).

For any question about personal data and to exercise your rights, write to [privatnost@<domain>].

Our role depends on whose data it is:

• Owners and staff of businesses that use Apointo (users): we are the controller of their account data.
• Customers who book through a business's website: the business you book with is the controller, and Apointo is a processor that handles the data only on the business's behalf, under a data processing agreement (Article 45 of the Law). To exercise your rights, contact the business; if you contact us, we will forward your request to the business without delay.
• Visitors of our websites: we only process technical data needed to run and secure the site.

When you send us an enquiry through the form on our home page, we process the business name, full name, e-mail address and, if you enter them, the phone number, city, chosen plan and message.

The purpose is to answer the enquiry and prepare an offer; the legal basis is taking steps at your request before entering into a contract (Article 12(1)(2) of the Law). The enquiry is also sent to our e-mail inbox. We keep enquiries for at most 12 months, after which they are deleted automatically.

• Account data: name, e-mail address, password (stored only as a cryptographic hash), role in the business, chosen language, and for platform administrators the data for two-factor sign-in.
• Booking data (for the business): full name, phone number, e-mail address (if you enter it), note with the request, chosen service, staff member and time, status and history of appointments, and internal notes entered by the business.
• Technical data: IP address, browser type and time of access in server logs and abuse protection, and the cookies needed for signing in.
• Activity log: which user made which change in the business's account and when (for example, confirmed an appointment), without the content of customer data.
• Error reports: a technical description of an error, from which e-mail addresses, phone numbers and access links are automatically removed before sending.

We do not process special categories of personal data (Article 17 of the Law), such as health data. We ask businesses and customers not to enter them in notes.

• Providing the service to users (account, calendar, website, notifications): performance of a contract (Article 12(1)(2) of the Law).
• Processing customers' data (booking, confirmations and reminders by e-mail): on behalf of the business as controller, under the data processing agreement.
• Security, abuse prevention and fixing errors (logs, rate limiting, bot protection, error reports): our legitimate interest in a secure and working service (Article 12(1)(6) of the Law).
• Invoicing and accounting: compliance with legal obligations (Article 12(1)(3) of the Law).

We do not use the data for marketing, do not sell it, and do not carry out profiling or automated decision-making (Article 38 of the Law).

Providing account and booking data is a condition for using the service: without a name and phone number the business cannot confirm an appointment.

We only use cookies that are necessary for the service: session cookies for signing in to the application and a cookie that remembers the chosen language. We do not use analytics or advertising cookies, so your consent is not required.

Bot protection for forms (Cloudflare Turnstile) checks the browser without tracking cookies.

The data is processed by trusted service providers (processors), only as far as needed for the purpose we engage them for, under contracts that bind them to protect the data:

We disclose data to public authorities only when required by law.

The database is located in the EU (Frankfurt, Nemačka) region. Some processors are based in the USA or also process data outside the European Union. We make such transfers only with appropriate safeguards under Article 65 of the Law, primarily standard contractual clauses, together with additional technical measures (encryption, removal of personal data from error reports).

• Account data: while the account exists; deleted at the latest 30 days after the account is closed.
• Data of a business and its customers: while the business uses the service or until it deletes the data. A business can erase a customer's personal data (name, phone, e-mail and notes) at any time, including at the customer's request; the record of past appointments then stays without that data. When the contract ends, the business has 30 days to export the data, after which we delete it.
• Backups: encrypted and kept for at most 30 days, so deleted data disappears from them within that period at the latest.
• Server logs and error reports: at most 30 days.
• Activity log: at most 24 months.
• Accounting records: for the periods required by accounting law.

Under the Law you have the right:

• of access to your data and to a copy of it (Article 26);
• to rectification and completion of inaccurate or incomplete data (Article 29);
• to erasure (Article 30);
• to restriction of processing (Article 31);
• to data portability (Article 36);
• to object to processing based on legitimate interest (Article 37);
• to withdraw consent, where processing is based on consent, without affecting the lawfulness of earlier processing (Article 15).

Send your request to [privatnost@<domain>]. We will reply without delay and within 30 days at the latest; in exceptional cases this period may be extended by a further 60 days, and we will tell you if so (Article 21). Exercising your rights is free of charge.

If you believe your data is processed unlawfully, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs), and the right to judicial protection (Articles 82 and 84 of the Law).

Data is transmitted encrypted (HTTPS). Each business's data is separated from other businesses' data at the database level, only authorised users have access according to their roles, platform administrators use two-factor sign-in, and backups are encrypted and stored separately. In the event of a data breach we act in accordance with Articles 52 and 53 of the Law.

The service is not intended for persons under 15. Their appointments should be booked by a parent or guardian.

We announce changes to this notice by publishing a new version on this page, and inform users of significant changes by e-mail as well. The date of the last change is shown at the top of the page.