Privacy Policy

1. Who we are

MultiBooking is a booking and business-management platform operated by:

This Privacy Policy explains how personal data is processed when you use MultiBooking websites, applications, booking interfaces and related services.

2. Scope

This Policy applies to:

• Business owners and administrators;
• Business employees and managers;
• registered Customers;
• Customers using booking interfaces without a permanent account;
• persons whose Bookings are created by a Business;
• visitors to MultiBooking websites and applications.

A Business may also maintain its own privacy policy governing its direct relationship with its Customers.

3. Our role under data protection law

Depending on the processing activity, MultiBooking may act as either a data controller or a data processor.

3.1 When MultiBooking acts as controller

MultiBooking generally acts as controller when determining the purposes and means of processing related to:

• MultiBooking user accounts;
• authentication and account security;
• operation and improvement of the Platform;
• Customer discovery and Platform-level functionality;
• Platform notifications;
• fraud and misuse prevention;
• security logging;
• communications with users;
• compliance with legal obligations.

3.2 When MultiBooking acts as processor

Where a Business uses MultiBooking to manage its own Customers, employees, schedules and Bookings, the Business generally determines why those personal data are processed.

For such processing, the Business acts as Controller and MultiBooking acts as Processor.

This includes, depending on how the Business uses the Platform, Customer records, Bookings, Business employee information and related operational data.

The applicable processing relationship is described further in our Data Processing Agreement.

4. Personal data we collect

Depending on how you use MultiBooking, we may process the following information.

Account information

• first and last name;
• email address;
• telephone number;
• authentication information;
• account role;
• account preferences;
• profile image.

Business information

• Business name;
• Business contact information;
• address;
• website;
• descriptions;
• Business category;
• logo and images;
• services and pricing;
• opening hours and schedules.

Some Business information may not constitute personal data where it relates solely to a legal entity.

Business employee information

Businesses may provide:

• employee name;
• email;
• telephone number;
• profile information;
• photograph;
• role;
• services;
• work schedules;
• time-off and availability information.

Customer and Booking information

Depending on the booking workflow, this may include:

• Customer name;
• email address;
• telephone number;
• selected Business;
• selected service;
• selected employee;
• appointment date and time;
• Booking status;
• Booking history;
• information entered by Business personnel in connection with the Booking.

Please avoid entering sensitive or special-category personal data into free-text fields unless it is necessary for the relevant service and there is a lawful basis for doing so.

Device and technical information

We may collect:

• IP address;
• browser and device information;
• operating-system information;
• application version;
• device or notification identifiers;
• timestamps;
• security and diagnostic logs;
• information about interactions with the Platform.

Communications

When you contact us, we may process your:

• email address;
• name;
• message content;
• related support information.

5. How we obtain personal data

We may obtain information:

• directly from you;
• from a Business that creates or manages a Booking;
• from an authorised Business User;
• automatically from your browser, device or application;
• from authentication or infrastructure providers where necessary to provide the Platform.

6. Purposes and legal bases

Where MultiBooking acts as controller, personal data may be processed for the following purposes.

Where processing is based on legitimate interests, we consider whether those interests are overridden by the rights and freedoms of affected individuals.

7. Data processed on behalf of Businesses

Businesses may add personal data to MultiBooking or instruct MultiBooking to process it.

Where MultiBooking acts as processor, we process those data according to the Business's documented instructions and our Data Processing Agreement.

Questions relating primarily to a Business's use of your information may need to be addressed directly to that Business.

8. Sharing information with Businesses

When you create a Booking, relevant information is provided to the Business with which the Booking is made.

This may include your name, contact details and Booking information.

The Business may use that information to:

• provide the booked service;
• communicate regarding the Booking;
• manage its schedule;
• maintain appropriate Business records;
• comply with its legal obligations.

The Business's own privacy practices also apply to its independent processing activities.

9. Service providers

We use specialised service providers to operate MultiBooking. Current providers include:

• Railway — application and infrastructure hosting;
• Cloudflare — DNS, network, security and content-delivery services;
• Cloudinary — image and media storage, processing and delivery;
• Resend — transactional email delivery;
• Google / Firebase — mobile, push-notification, tag-management and other Platform services as configured.

These providers may process limited personal data as necessary to perform their services.

Where a provider processes data on our behalf, we require appropriate contractual and data-protection safeguards.

10. International transfers

Some service providers may process personal data outside Slovakia or outside the European Economic Area.

Where GDPR rules governing international transfers apply, we use an applicable lawful transfer mechanism, such as:

• an adequacy decision;
• Standard Contractual Clauses approved by the European Commission; or
• another mechanism permitted under applicable data-protection law.

11. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected.

Retention depends on factors including:

• whether an account remains active;
• whether information is required to provide the Platform;
• instructions received from a Business where MultiBooking acts as processor;
• security and fraud-prevention requirements;
• dispute-resolution needs;
• applicable legal obligations.

When data are no longer required, they are deleted, anonymised or otherwise placed beyond ordinary use, subject to technical backup cycles and legal retention obligations.

12. Security

We use technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure or destruction.

Measures may include:

• authentication controls;
• access restrictions;
• encrypted communications;
• infrastructure security controls;
• logging and monitoring;
• software updates;
• controlled access to production systems;
• backups and recovery mechanisms.

No online system can guarantee absolute security.

13. Your data-protection rights

Subject to applicable law and the circumstances of the processing, you may have the right to:

• access your personal data;
• correct inaccurate data;
• request deletion;
• restrict processing;
• object to certain processing;
• receive certain data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

You may contact us at support@multibooking.net to exercise rights relating to processing for which MultiBooking is the controller.

Where MultiBooking acts solely on behalf of a Business, we may refer your request to that Business or assist the Business in responding.

14. Account deletion

Registered users may request deletion of their account.

Deleting an account does not necessarily require immediate deletion of all related information where retention remains necessary for:

• another party's legitimate records;
• legal obligations;
• dispute resolution;
• fraud prevention;
• security;
• processing performed on behalf of a Business.

Where possible, information no longer requiring identification may be anonymised.

15. Cookies and similar technologies

Our website and web applications may use cookies, browser storage and similar technologies.

We use Google Tag Manager to manage website tags. Any non-essential analytics or similar technologies deployed through tag management will be used in accordance with applicable consent requirements.

Strictly necessary technologies may be used without optional tracking consent where permitted by law.

See our Cookie Policy for more information.

16. Children

Business accounts are not available to persons under 18.

Customer accounts are intended for users aged 16 or older.

If a person under 16 needs to make a Booking, a parent or legal guardian should participate in or make the Booking where required by applicable law.

If we learn that personal data have been collected from a child in circumstances where legally required parental authorisation was absent, we will take appropriate steps to address the situation.

17. Automated decision-making

MultiBooking does not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects for individuals.

Features that automatically calculate availability or suggest booking times are operational scheduling functions rather than decisions about an individual's legal rights.

18. Changes to this Policy

We may update this Privacy Policy as MultiBooking develops.

The latest version will be published with an updated effective date.

Where a change materially affects registered users, we may provide additional notice.

19. Complaints

You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic or, where applicable, another competent data-protection authority in the EU/EEA.

We encourage you to contact us first if you believe we can resolve your concern.

20. Contact