Privacy policy

1. Who we are

Sitebook is a service of [ΕΠΩΝΥΜΙΑ ΕΤΑΙΡΕΙΑΣ / COMPANY NAME] ([ΝΟΜΙΚΗ ΜΟΡΦΗ / LEGAL FORM]), based at [ΔΙΕΥΘΥΝΣΗ ΕΔΡΑΣ / REGISTERED ADDRESS]. VAT number: [ΑΦΜ / VAT NUMBER], tax office: [ΔΟΥ / TAX OFFICE], registration number: [ΑΡ. ΓΕΜΗ / REGISTRATION NUMBER]. Contact: [EMAIL ΕΠΙΚΟΙΝΩΝΙΑΣ / CONTACT EMAIL], [ΤΗΛΕΦΩΝΟ / PHONE]. ⚖ Lawyer check

For anything about personal data, write to [EMAIL ΓΙΑ ΘΕΜΑΤΑ ΑΠΟΡΡΗΤΟΥ / PRIVACY EMAIL]. Data protection officer, if one is appointed: [ΥΠΕΥΘΥΝΟΣ ΠΡΟΣΤΑΣΙΑΣ ΔΕΔΟΜΕΝΩΝ, ΑΝ ΟΡΙΣΤΕΙ / DPO, IF APPOINTED]. ⚖ Lawyer check

2. What this policy covers

It explains how we handle the details of the professionals who create a Sitebook account ("you") and the details of their customers, which we store on their behalf.

For the details of your own customers, you are the controller and we are the processor. The terms of that relationship are in the Data Processing Agreement. Your customers see your own privacy notice, not this text. ⚖ Lawyer check

3. What details we use

• Account details: name, email and password. The password is kept by the sign in service only in scrambled form and we never see it. ⚖ Lawyer check
• Details of your business: name, address, phone, email, opening hours, services, team, photos and texts. When you publish your page, most of this becomes public.
• Details of your customers, which you add or which they type when they book: name, phone, optionally an email and a message, your own private notes, bookings and packages.
• Billing details: your Stripe customer number, the plan you chose, the status of your subscription, the dates of your payments and links to your invoices. Your card details are typed on Stripe's own page and are never sent to us. ⚖ Lawyer check
• Technical details: when you visit Sitebook, the hosting provider records details of the visit, such as the IP address, the type of browser and the time. The IP address is also held for a few minutes in the server's memory, to limit repeated sign in attempts. ⚖ Lawyer check
• Messages to us: if you write to us, we keep your message and our reply.
• Cookies: we use only the ones needed to make the service work. See the Cookie Policy.

We do not ask for special categories of data, such as health details. The optional message on a booking is free text, though. We ask customers not to put sensitive details in it, but we cannot stop them. ⚖ Lawyer check

4. Why we use it and on what legal basis

• To give you the service (account, page, bookings, free trial, plan): performing our contract with you.
• To keep the service secure and prevent abuse: our legitimate interest.
• To meet accounting and tax duties: a legal obligation.
• To answer your messages: performing our contract or our legitimate interest.
• For cookies that are not essential and for analytics tools, if they are ever used: only with your consent, which you can withdraw at any time.

These legal bases come from Article 6 of the General Data Protection Regulation (EU) 2016/679. ⚖ Lawyer check

5. How long we keep it

• Account and business details: as long as you have an account. When you delete it in Settings, your business, bookings, customers and photos are deleted. Backups are deleted within [BACKUP PERIOD]. ⚖ Lawyer check
• An account that is not used: [PERIOD BEFORE AN INACTIVE ACCOUNT IS DELETED]. ⚖ Lawyer check
• Your customers' details: you choose in Settings how long they are kept. The default is 24 months after the customer's last booking. ⚖ Lawyer check
• Activity log (who viewed or changed customer details): 12 months. Text of booking emails: 90 days. ⚖ Lawyer check
• Billing details and accounting records: as long as the law requires. ⚖ Lawyer check

6. Who we share it with

We do not sell personal data. We use the providers below, which process details on our behalf:

• Supabase: database, user sign in and file storage. Region: [ΠΕΡΙΟΧΗ ΒΑΣΗΣ ΔΕΔΟΜΕΝΩΝ / DATABASE REGION].
• Vercel: hosting of the website and the application. Region: [ΠΕΡΙΟΧΗ ΦΙΛΟΞΕΝΙΑΣ / HOSTING REGION].
• [ΠΑΡΟΧΟΣ EMAIL / EMAIL PROVIDER]: sending booking emails. It is not connected yet, so no emails are sent for now.
• Analytics tool: we do not use any at the moment.
• Stripe: payment provider for your subscription. It receives your name, email and card details to take the payment. We never see or store the card number. ⚖ Lawyer check

If you add the calendar link to Google, Apple or Outlook, the calendar provider will receive the details of your bookings, that is, the customer's name, phone and message. Keep the link private.

We may give details to an authority if the law requires it. ⚖ Lawyer check

7. Transfers outside the European Economic Area

Some providers may also process details outside the EEA, for example in the United States. In that case we rely on safeguards the law provides, such as the European Commission's standard contractual clauses or an adequacy decision. Which ones apply to each provider: [TRANSFER SAFEGUARDS PER PROVIDER]. ⚖ Lawyer check

8. Your rights

You have the right to ask for access to your details, correction, deletion, restriction of their use and portability, that is, to receive them as a file. You also have the right to object to processing based on our legitimate interest and to withdraw your consent at any time. Withdrawing does not affect what happened before.

How to use them:

• Write to [EMAIL ΓΙΑ ΘΕΜΑΤΑ ΑΠΟΡΡΗΤΟΥ / PRIVACY EMAIL]. We will reply within one month at most. ⚖ Lawyer check
• In the dashboard, under Settings, you can download all your data yourself (JSON and CSV) and delete your account and all its data.
• To delete one of your customers, use the Customers page.

If you are a customer of a business that uses Sitebook, contact that business first: it decides how your details are used. If you write to us, we will pass the request to the business we can identify and help it reply. ⚖ Lawyer check

9. Security

We take measures to protect the details, such as an encrypted connection, access rules in the database so each business sees only its own details, an activity log and keeping secret keys away from the browser. No system is completely secure, and we cannot promise that an incident will never happen. If an incident affects your details, we will tell the people responsible, as the law requires. ⚖ Lawyer check

10. Children

The service is for professionals and is not meant for anyone under 18. ⚖ Lawyer check

11. Complaints

If you think we handle your details the wrong way, you can complain to the Hellenic Data Protection Authority (www.dpa.gr). We would prefer that you write to us first, so we can try to fix it. ⚖ Lawyer check

12. Changes

If we change this policy in a significant way, we will tell you in the dashboard or by email before the change applies. The date at the top of the page shows when it last changed.

13. Declaration, licence and licence documents

What we keep: the declaration of lawful operation that you accept before your page goes live (the business name or full name you gave, the type of business, the wording you accepted and the date). For regulated types of business we also keep the tax number (ΑΦΜ), the licence or registry number, the issuing authority, the status of the verification, our note, and the licence document you upload. ⚖ Lawyer check

Why: to keep proof of what you declared, to check that a regulated business holds the licence it declared, and to decide whether a page may stay online. Legal basis: our contract with you and our legitimate interest in keeping the platform lawful. ⚖ Lawyer check

Where, and who can see it: the document is stored in private storage (region: [ΠΕΡΙΟΧΗ ΒΑΣΗΣ ΔΕΔΟΜΕΝΩΝ / DATABASE REGION]). You and the members of the Sitebook team we authorise can read it. It is never public and never appears on your page. Our database and storage provider processes the details on our behalf. ⚖ Lawyer check

How long: [LICENCE DOCUMENT RETENTION PERIOD] after verification, or until you delete your account, whichever comes first. ⚖ Lawyer check

14. Reports about pages

Anyone who reports a page with the "Report this page" link sends us an email at [EMAIL ΕΠΙΚΟΙΝΩΝΙΑΣ / CONTACT EMAIL]. We use the details in the report to look into it and to reply. We keep reports for [REPORT RETENTION PERIOD]. ⚖ Lawyer check