Privacy Policy

This notice explains how [Company name] ("Operator" or "Data Controller") processes personal data collected while you use the Calendio booking and business-management service ("Service"), in line with Regulation (EU) 2016/679 (GDPR) and applicable Hungarian data protection law.

Name: [Company name]
Registered office: [Registered office address]
Company registration number: [Company registration number]
Tax number: [Tax number]
Legal representative: [Legal representative name]
Email: [Contact email address]
Phone: [Phone number]

Data protection contact: [Data protection contact name and email address].

Personal data means any information relating to an identified or identifiable natural person. Controller is the entity that determines the purposes and means of processing. Processor processes personal data on the controller's behalf. Data subject is the natural person the data relates to.

The Operator processes personal data for the following purposes:

• Account registration and login — data: name, email address, password (hashed), company name and billing details if provided. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Appointment booking (as a registered or guest user) — data: name, email address, phone number, the booked service and time, an optional note. Legal basis: performance of a contract.
• Payment and invoicing — data: billing name and address, transaction identifiers needed for payment. The Operator does not store card details; these are processed solely by the payment provider. Legal basis: legal obligation (accounting, tax law) and performance of a contract.
• Newsletter and marketing communication — data: name, email address, subscribe/unsubscribe timestamp. Legal basis: your freely given consent, withdrawable at any time without justification.
• Cookies and similar technologies — see the cookie notice, available via the "Cookie settings" button.
• Support requests — data: the name, email address and message content you provide. Legal basis: your consent, or legitimate interest in responding to your request.
• Security logging — data: the time and result (success/failure) of each sign-in attempt, the device's browser identifier (user agent) and IP address. Purpose: detecting and preventing unauthorized access attempts, account takeover and abuse. Legal basis: the Operator's legitimate interest (GDPR Art. 6(1)(f)). The IP address and user agent are kept for 90 days from the attempt, after which they are automatically anonymized.

The Operator uses the following processors / recipients to run the Service:

• Hosting: [Hosting provider name, address and contact]
• Email delivery: [Outbound email (SMTP) provider name and address]
• SMS notifications: SeeMe (seeme.hu) — delivers transactional SMS messages when a business enables SMS notifications.
• Card payments and deposits: Barion Payment Zrt. [verify registered address/company number] — Barion's own privacy notice governs the payment data it processes.
• Invoicing: Billingo Technologies Zrt. and/or Számlázz.hu (KBOSS.hu Kft.) [verify registered address/company number] — depending on which invoicing integration the business selects.
• Calendar sync: Google Ireland Limited (Google Calendar), only when a business or its staff member chooses to enable the Google Calendar integration.

The Operator only discloses personal data to third parties to comply with a legal obligation, or under the processor agreements listed above, to the extent strictly necessary.

• Account and booking data: for as long as the account exists, then for the statutory (accounting/tax) retention period after deletion.
• Accounting records: 8 years under Hungarian Act C of 2000 on Accounting.
• Newsletter subscription: until you unsubscribe.
• Cookie-based data: as set out in the cookie notice.
• Login security log (IP address, user agent): 90 days, then automatic anonymization, and the record is permanently deleted after 1 year.

Under the GDPR you have the right to access, rectify, erase, restrict processing of, and port your data, and to object to processing. You can exercise these rights through the data export/erasure tool in your account, or via the contact details above. The Operator responds without undue delay and within one month at the latest.

The Operator applies appropriate technical and organizational measures — encrypted storage and transmission, access controls, and logging — to keep personal data secure.

You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) — 1055 Budapest, Falk Miksa utca 9-11., Hungary, phone: +36 (1) 391-1400, email: ugyfelszolgalat@naih.hu, website: www.naih.hu — or seek judicial remedy if your rights are infringed.

The Operator may update this notice and will announce changes within the Service. This notice takes effect as of [effective date].