Privacy notice for online bookings

This notice explains which personal data is used, for what purposes, and what rights you have when you book an appointment online with Klingo Qa (the "Business") or visit its website. It is provided under the EU General Data Protection Regulation 2016/679 ("GDPR") and Greek Law 4624/2019.

1. Who is responsible for your data

The controller is the Business:

• Klingo Qa [legal name] ("Klingo Qa")
• VAT number [VAT number of the business]
• registered address: [registered address of the business]
• contact: [contact details of the business]

Klingo ([legal name of the Klingo operator], [registered address of the Klingo operator], VAT [VAT number of the Klingo operator], [privacy contact email of the Klingo operator]) supplies the booking software to the Business. Klingo processes your data on the Business's behalf and on its instructions, as a processor (Art. 28 GDPR). Klingo does not use your data for its own purposes.

2. What data is collected

• Details you enter: your name, email and phone number (required), and optional notes. Please do not include health information or other sensitive data in the notes. If the Business needs such information, it will ask you separately.
• Appointment details: branch, services, date and time, professional, price, page language, status (booked, cancelled, completed, no-show) and change history.
• Payment data: amount, payment and refund status, and the Stripe transaction reference. You enter your card details directly into Stripe's form. Neither the Business nor Klingo receives them.
• Acceptance record: the version of the terms and of this notice in force, and the time of booking.
• Technical data: IP address and browser details, used to secure the page and limit abuse. Your IP address and browser are also stored as proof if you consent to marketing emails (section 8).
• If you are already a customer of the Business (same email or phone), the booking is added to your existing record with the Business.

Your name, email and phone number are required to book online, because they are needed to confirm and serve your appointment.

3. Why the data is used and on what legal basis

• Booking and serving your appointment. The Business uses the data to create and manage the booking, to handle payment and refunds, and to email you confirmations and notices of changes or cancellations. If the Business has enabled them, it also sends you appointment reminders by email or SMS. Legal basis: performance of the contract and steps taken before entering into it (Art. 6(1)(b) GDPR).
• Accounting and tax obligations. These include issuing receipts or invoices and transmitting them to the Greek tax authority (AADE, myDATA) where required, as well as consumer-law obligations such as handling withdrawals. Legal basis: legal obligation (Art. 6(1)(c)).
• Security and prevention of abuse or fraud. This includes rate-limiting automated requests and keeping proof of transactions. Legal basis: the Business's legitimate interest in protecting its page and revenue (Art. 6(1)(f)).
• Customer history. The Business keeps a history of your visits to serve you better at your next appointment (for example, which service you had and with whom). Legal basis: the Business's legitimate interest (Art. 6(1)(f)). You can object (section 7).
• Marketing messages. These are sent only with your separate consent (section 8). Booking does not add you to any list.
• Reviews. If you leave a review of your visit, the Business keeps your rating and comment with the appointment, to improve its services. If you allow it in the review form, it may publish the rating, the comment and your first name with the initial of your surname (e.g. "Maria K.") on its website. Your full name and contact details are never published. You can withdraw your consent at any time; the review is then removed from the website. Legal basis: consent (Article 6(1)(a) GDPR).

No decisions based solely on automated processing are made about you within the meaning of Art. 22 GDPR. Stripe may apply its own automated fraud checks to the payment (see section 4). The booking process does not use artificial-intelligence tools.

4. Who receives your data

• The Business and its authorised staff.
• Klingo, as processor, and its sub-processors, which work under data processing agreements:
  • Hostinger: hosting and database, in an EU data centre;
  • Amazon Web Services (Amazon SES, Ireland) and Google (Google Workspace): email delivery;
  • Twilio: SMS delivery, only when the Business has enabled SMS.
• Stripe (Stripe Payments Europe Ltd, Ireland, and its affiliates): processes the online payment on the Business's behalf. For fraud prevention and its own regulatory obligations, Stripe acts as an independent controller, under its own privacy policy (stripe.com/privacy).
• Public authorities, where the law requires, e.g. AADE via myDATA when the Business issues tax documents.
• The Business's accountants or legal advisers, where necessary.

Your data is not sold and is not shared with third parties for their own advertising.

5. Transfers outside the EEA

Your data is stored in the EU. Some providers (Stripe, Twilio, Google, Amazon Web Services) belong to US-based groups and may access data from outside the EEA. Any such transfer relies on:

• the EU–US Data Privacy Framework adequacy decision, for certified companies; or
• the European Commission's Standard Contractual Clauses (Arts. 45–46 GDPR), together with supplementary measures.

You can ask the Business for a copy of the relevant safeguards.

6. How long the data is kept

• Customer record and appointment history: while you are a customer of the Business and for up to 3 years after your last appointment. After that it is deleted or anonymised, unless it is needed to establish, exercise or defend a legal claim.
• Accounting and tax records (receipts, payments, refunds): for the period required by law, normally 5 years from the end of the financial year concerned (Greek Law 4308/2014). The period may be longer if the limitation period is extended.
• Proof of consent to marketing emails: while the consent is valid and for up to 5 years after you withdraw it. If you unsubscribe, your address is kept on a suppression list so that offers are not sent to you again.
• Booking management link: valid until 14 days after the appointment.
• Technical logs: up to 14 days.
• Backups: overwritten on a rolling basis within 6 months at most.

7. Your rights

You have the right (Arts. 15–22 GDPR):

• of access to your data;
• to rectification;
• to erasure;
• to restriction of processing;
• to data portability;
• to object to processing based on legitimate interest;
• to withdraw any consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, contact the Business ([contact details of the business]). If you contact Klingo ([privacy contact email of the Klingo operator]), it will forward your request to the Business without delay. You will receive a reply within one month, which may be extended by two further months for complex requests. You may be asked to confirm your identity.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Ave., 115 23 Athens, tel. +30 210 6475600, www.dpa.gr).

8. Offers and news by email (optional)

1. What you receive. If you tick "I want to receive emails with offers and news from Klingo Qa" when booking and then confirm it, Klingo Qa will email you:
   • offers and news;
   • birthday wishes, if you have given us your date of birth;
   • a reminder to book again, if some time has passed since your last visit;
   • a request to review your visit.
   
   The box is never pre-ticked and your booking does not depend on it.
2. Confirmation. After your booking we send you one confirmation email. Your consent takes effect only once you press "Yes, I want to receive emails" within 7 days. If you don't, the request is deleted automatically and you receive no promotional email. If it wasn't you, simply ignore the email.
3. Legal basis and roles. The legal basis is your consent (Art. 6(1)(a) GDPR and Art. 11(1) Greek Law 3471/2006). The controller is Klingo Qa. Klingo ([legal name of the Klingo operator]) sends the emails on its behalf as processor, using Amazon Simple Email Service by Amazon Web Services EMEA SARL, in data centres in Ireland (EU). Emails carry the business's name and are sent from a Klingo address (news@m.klingo.gr) or from the business's own verified domain.
4. What we record. As proof of your consent we record:
   • the date and time you gave and confirmed it;
   • the page you gave it on;
   • the version of this notice;
   • your IP address and browser type.
   
   For each email we also record whether it was delivered or bounced, whether you opened it and whether you clicked a link. This comes from a small image and from measured links inside the email. We use it so the business can see how useful its messages are, and to protect sending reputation. Measurement stops when your consent ends.
5. Withdrawal. You can withdraw your consent at any time, free of charge, in either of two ways:
   • via the "Unsubscribe" link at the bottom of every email, or your email app's unsubscribe option;
   • by contacting the business ([contact details of the business]).
   
   Withdrawal applies immediately to every new message. It does not affect the lawfulness of earlier emails. It does not affect your booking or service emails (confirmations, reminders, cancellations).
6. Retention.
   • Your address is used for promotional emails only while your consent is valid.
   • Proof of consent and withdrawal for emails is kept for 5 years after withdrawal, to defend possible legal claims. Proof of consent to marketing SMS is kept for up to 6 months after withdrawal or after sending stops.
   • Per-email delivery data (delivery, opens, clicks) is deleted or anonymised 12 months after sending.
   • After you unsubscribe we keep only a note that you don't want messages, so that we never email you again. If you ask for your data to be erased, that note is kept only in a one-way coded form that does not reveal your address.
7. Rights. See section 7 for your rights and your right to complain to the Hellenic Data Protection Authority.

9. Cookies and storage on your device

• The booking page (/book) sets no analytics, advertising or tracking cookies.
• Local storage after you book: your browser keeps a random booking key in its local storage, so that you can view or cancel the booking from the same device. The key does not contain your name, email or phone number. You can delete it in your browser settings.
• At the online payment step, Stripe's payment form is loaded and sets the cookies __stripe_mid (lasts 1 year) and __stripe_sid (lasts 30 minutes). They are strictly necessary to complete the payment securely and to prevent fraud.
• On the other pages of the Business's website, your cookie choice is stored in the cookie klingo_consent. No non-essential cookie is activated without your consent, and you can change your choice at any time.

10. Changes to this notice

The Business may update this notice. The version in force and its date are shown at the top of the page.

How long we keep your data

We keep your data only for as long as we need it:

• Your customer details and appointment history: for as long as you are our customer. We review the records of customers who have not visited for 3 years. If you ask us to delete your data, we do so, unless the law requires us to keep it.
• Receipts, invoices and payments: 5 years from the end of the tax year, as Greek tax law requires. We keep them longer when the law requires it, for example during a tax audit.
• Technical copy of your booking confirmation: we keep it encrypted for 30 days, so that a dropped connection cannot create a duplicate booking. After that we delete it automatically.
• SMS and emails we sent you: the text of an SMS for 30 days; the delivery details (to whom, when, whether it was delivered) for 12 months.
• Your consent to marketing messages, and its withdrawal: for as long as we send you such messages and afterwards: up to 5 years after withdrawal for emails and up to 6 months after withdrawal or after sending stops for SMS, so that we can show that we respected your choice. If you opt out, we keep only your number or email on a do-not-contact list, so that we never message you again.
• Backups: deleted data may remain in backups for up to 6 months until they are erased automatically. We do not use it.