Privacy policy

1. Who we are and in what capacity we process data

For business owners’ data (the account and business details) we are the data controller.

For the data of clients who book on a business’s public page, the controller is that business; we process the data on its behalf, as a processor, only to record the booking and send its notifications.

2. What data we collect

Depending on how you use the service:

• Business account: name, email, password (stored hashed) or Google identifier, business details (name, address, phone, services, prices, hours, images, logo).
• Booking (client): first name, last name, phone, email (optional), notes, answers to the business’s form fields (for example the reason for the visit) and, where applicable, the voucher code.
• Client account (optional): the data above, the booking history at that business and preferences.
• Technical data: IP address, browser type, pages visited and time, error logs — used for security and to keep the service running.

3. Why we process data (legal bases)

• Performance of a contract: creating the account, recording the booking, sending the confirmation, reminders and cancellation or reschedule notifications.
• Legitimate interest: platform security, abuse prevention, aggregate usage statistics.
• Consent: marketing communications (only if you subscribed) and non-essential cookies, if they are ever introduced.

4. Emails and notifications

On behalf of the business we send clients transactional emails: booking confirmation, reminders before the appointment, cancellation, reschedule, review request. The business can turn some of them off from its dashboard. We do not use a business’s client data for our own marketing.

5. Who we share data with

Data is hosted on servers in the European Union. We use providers that process data on our behalf, under contract, strictly for their service:

• hosting and database (EU infrastructure);
• sending transactional emails;
• Google sign-in, if you choose that option;
• storage of uploaded files (logo, gallery, booking attachments).

6. How long we keep data

• Account and business data: for as long as the account exists. When a business or account is deleted, the data is permanently erased.
• A business’s bookings and client data: for as long as the business keeps them in its account; the business can delete them at any time, and deleting the business deletes everything.
• Technical logs: at most 12 months.

7. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP) or your local authority.

Business owners can export and delete their data directly from Settings. Clients can contact the business they booked with (it is the controller) or us at contact@programarirapide.ro; we reply within 30 days.

8. Security

Connections are encrypted (HTTPS), passwords are stored only as hashes, each business’s data is isolated from the others, and internal access to systems is restricted and logged.

9. Cookies

We only use strictly necessary cookies: the session cookies (to keep you signed in) and the one that remembers your language. We do not use tracking or advertising cookies. If we ever add analytics tools that require consent, we will ask for it first.

10. Changes and contact

We may update this policy; the current version and the date of the last update are shown at the top of the page. For any question about your data write to contact@programarirapide.ro.