Try the app
PL UA EN
PRIVACY POLICY

PRIVACY POLICY

Last updated: 2026-10-04

This Privacy Policy describes how APPOINTIR processes personal data in connection with the use of the Platform.

1. Personal Data Controller

The controller of personal data processed in connection with the use of the Platform is:

Andrii Harkusha
operating the website under the name “APPOINTIR”

Email: contact@appointir.com
Phone: +48 733 741 176

For matters concerning the processing of personal data, you can contact the Controller using the contact details above.

2. What is APPOINTIR

APPOINTIR is a platform that enables users to create booking pages, publish events and services, make available time slots and accept and manage bookings.

In particular, users can:

  create a user account;
  create a public booking page;
  publish events and services;
  set available time slots;
  accept bookings;
  collect data from people making bookings;
  manage calendars and bookings;
  send booking-related messages;
  use online payments, if this feature is available.

3. What Personal Data We Process

Depending on how the Platform is used, we may process the following data:

3.1. Data of Platform Users

In the case of users who have an account on the Platform, we may process, in particular:

  first and last name;
  email address;
  phone number;
  login and authentication data;
  account information;
  information about created events, services and booking pages;
  payment and billing information;
  technical data related to the use of the Platform;
  IP address;
  information about the device and web browser;
  information provided when contacting the Controller or technical support.

3.2. Data of People Making Bookings

People visiting public booking pages created by Platform users may be asked to provide data necessary to make a booking.

This may include, in particular:

  first and last name;
  email address;
  phone number;
  selected service, event or time slot;
  information entered in the booking form;
  payment information, if online payment is available;
  other data that the Platform user decides to collect in connection with their business.

The scope of data required when making a booking may vary depending on the settings of the relevant Platform user.

4. Data of Platform Users’ Clients

Platform users may use APPOINTIR to collect their clients’ data through their own booking pages.

With regard to their clients’ data, a Platform user generally acts as the personal data controller if they independently determine the purposes and means of processing.

In such cases, the Platform user is responsible for:

  determining the legal basis for processing the data;
  determining the purposes for which the data is collected;
  informing their clients about the processing of their data;
  ensuring that data processing complies with applicable laws;
  collecting only data necessary to achieve the specified purposes.

APPOINTIR may process a user's clients’ data on the user's behalf and on their instructions to the extent necessary to provide the Platform services.

In such cases, APPOINTIR may act as a personal data processor within the meaning of Article 28 of the GDPR.

Detailed rules for such processing may be set out in a separate Personal Data Processing Agreement.

5. Purposes of Data Processing by the Controller

Personal data may be processed, in particular, for the following purposes:

  creating and managing a user account;
  providing services available on the Platform;
  handling bookings and events, including providing the Platform user with data of people making bookings and sending booking notifications;
  ensuring the proper operation of the Platform;
  sending messages related to accounts, bookings and services;
  handling payments and settlements;
  ensuring the security of the Platform;
  detecting and preventing abuse;
  preventing unauthorized access to accounts and data;
  handling user enquiries and reports;
  pursuing or defending against claims;
  fulfilling the Controller’s legal obligations;
  maintaining, analyzing and improving the operation of the Platform;
  conducting marketing activities where there is an appropriate legal basis.

6. Legal Bases for Processing

Depending on the purpose, personal data may be processed on the following legal bases:

  Article 6(1)(a) GDPR — consent of the data subject;
  Article 6(1)(b) GDPR — where processing is necessary for the performance of a contract or to take steps prior to entering into a contract;
  Article 6(1)(c) GDPR — where processing is necessary to comply with a legal obligation;
  Article 6(1)(f) GDPR — where processing is necessary for the purposes of the Controller’s legitimate interests.

Where processing is based on consent, the data subject may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Provision of Personal Data

Providing personal data may be necessary to:

  create an account;
  use certain Platform features;
  make or manage a booking;
  make a payment;
  contact the user;
  fulfil obligations arising from applicable laws.

The scope of required data depends on the type of service or feature used by the relevant person.

If providing certain data is voluntary, the person will be informed accordingly at the relevant point.

8. Data Retention Period

Personal data is stored for the period necessary to fulfil the purpose for which it was collected.

Data related to a user account may be stored for as long as the Platform is being used.

After use of the Platform ends, data may be retained for the period necessary to:

  fulfil legal obligations;
  protect against potential claims;
  pursue or defend against claims;
  meet billing and record-keeping obligations.

Data processed on the basis of consent is stored until that consent is withdrawn, unless another legal basis justifies further processing.

9. Data Recipients

Personal data may be disclosed to entities providing services necessary for the proper operation of the Platform, in particular:

  hosting and server infrastructure providers;
  email service providers;
  payment service providers;
  database and data storage providers;
  security service providers;
  technical and IT service providers;
  analytics tool providers, if used;
  entities providing accounting, legal or administrative services.

These entities may access data only to the extent necessary to provide their services.

If an entity processes personal data on behalf of the Controller, the relevant data protection obligations are governed in accordance with GDPR requirements.

10. Transfers of Data Outside the European Economic Area

Where services are provided by suppliers established outside the European Economic Area, personal data may be transferred outside the EEA.

In such cases, the Controller takes the measures required by the GDPR to ensure an adequate level of data protection, in particular by applying an appropriate legal transfer mechanism where required.

11. Rights of Data Subjects

Data subjects have the rights set out in the GDPR, in particular:

  the right of access to their data;
  the right to rectification;
  the right to erasure;
  the right to restriction of processing;
  the right to data portability;
  the right to object to processing;
  the right to withdraw consent where processing is based on consent;
  the right to lodge a complaint with a supervisory authority.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).

To exercise your rights, you can contact the Controller:

Email: contact@appointir.com
Phone: +48 733 741 176

The Controller may request information necessary to verify the identity of the person submitting a request where this is necessary to protect personal data.

12. Public Pages, Events and Services

Platform users may create publicly accessible pages, events and offers.

Such pages may include, among other things:

  the user's or company's name;
  business description;
  service descriptions;
  events;
  available time slots;
  working hours;
  contact details;
  other information that the user chooses to make public.

The Platform user is responsible for the content and data they publish publicly.

Data of people making bookings is not published by default on public pages, events or calendars.

13. Payments

If online payments are available on the Platform, payments may be handled by external payment service providers.

The payment provider’s own data protection and privacy policies also apply to data processed directly by that provider.

APPOINTIR does not store payment card data where payments are handled through an external payment provider.

14. Integrations with External Services

The Platform may allow users to use additional external services and applications, in particular calendar, communication, conferencing and payment services. The availability of individual integrations depends on the Platform’s current functionality.

Once an integration is activated or configured, the Platform may transfer to the relevant provider the data necessary for that integration to work, in accordance with its configuration and the scope of permissions required.

Depending on the type of integration, this may include, in particular:

  event and booking details;
  the name of the person making the booking;
  the email address of the person making the booking;
  the phone number of the person making the booking, if used by the integration;
  information about the service or event;
  the date, time and duration of the booking;
  organizer information;
  links related to the booking, event or Platform;
  other information necessary for the proper operation of a specific integration.

In particular, the Platform may use the following integrations:

  Google Calendar — enables events and bookings to be synchronized with Google Calendar. As part of synchronization, booking information may be transferred to calendar events, including the booking person's details, event details, date and time, and links related to the booking;

  Apple Calendar — enables events to be synchronized with Apple Calendar. The information transferred may include event and booking details necessary to display and synchronize the event correctly;

  Notion Calendar — enables events to be synchronized with Notion Calendar. The integration may use data synchronized through a connected Google Calendar and data necessary to manage events in Notion Calendar;

  Google Meet — enables online meetings associated with events or bookings to be created and meeting links to be generated. To the extent required by this integration, event or participant data may be processed by Google in accordance with the terms of that service;

  ICS Feed — enables events to be imported into the Platform from an external ICS source. Data contained in imported events may be processed to the extent necessary to import and display them;

  Stripe — enables online payments for services or events. Data necessary to process a payment may be transferred to Stripe to the extent required to handle the payment;

  Telegram, WhatsApp and Signal — may be used as a location type or as a way to indicate a contact or meeting location. If a user adds a link to one of these services on the Platform, the Platform may store and display that link. Merely adding a link does not mean that APPOINTIR automatically transfers the booking person's data to these services;

  QR Code — enables a QR code containing a link to a page or event on the Platform to be generated. Generating a QR code does not require the booking person's data to be transferred to an external provider if the code contains only a link to the Platform.

The use of external services may also be subject to the terms of service and privacy policies of the relevant providers. These providers may process data in accordance with their own rules and to the extent arising from the relevant integration.

The scope of data transferred through a specific integration may depend on its configuration, the permissions granted and the way the user uses that feature.

15. Cookies

The Platform may use cookies and similar technologies.

Cookies may be used, among other things, to:

  ensure the proper operation of the Platform;
  maintain the user's session;
  remember settings;
  ensure security;
  analyze the use of the Platform;
  improve the operation and functionality of the Service.

Where technologies requiring user consent are used, the relevant consent is obtained in accordance with applicable laws.

Users may also manage cookie settings through their web browser settings or consent management mechanisms available on the Platform.

16. Data Security

The Controller applies appropriate technical and organizational measures designed to protect personal data against:

  accidental loss;
  destruction;
  unauthorized access;
  unauthorized disclosure;
  alteration;
  other forms of unlawful processing.

The security measures applied are appropriate to the nature, scope and risks associated with the processing of data.

17. Automated Decision-Making

As a rule, personal data is not used to make decisions about individuals based solely on automated processing that produce legal effects concerning them or similarly significantly affect them.

If such mechanisms are introduced, data subjects will be informed in accordance with GDPR requirements.

18. Data of Minors

The Platform is not intended for independent account creation by persons who, under applicable law, cannot use such services without the consent of a legal representative.

Platform users are responsible for ensuring that the processing of minors’ data complies with applicable laws if such data is collected through their booking pages.