Privacy
TEST TEMPLATE — Operator details and legal arrangements are incomplete. This page is not a statement of GDPR compliance. Complete and review these documents before accepting real customer data.
Who is responsible?
Calendar operator: [LEGAL NAME, ADDRESS, COUNTRY]. Privacy contact: [EMAIL]. Each booking business must identify itself as responsible for its customer appointments. Calendar’s role and the business’s role must be recorded in their agreement.
Data and purposes
Calendar stores business account details, password hashes, employee names, working hours, time zones, services, optional prices, and customer names, emails and appointment details. It uses these for login, scheduling, confirmation messages, reminders and security. Booking totals are calculated from appointment records. No advertising or analytics trackers are installed.
Lawful basis and recipients
Template to complete: identify the lawful basis for each purpose, the responsible business, authorised recipients, and any international transfers. Booking administration may rely on contractual steps or performance where applicable; do not treat a privacy notice as blanket consent. Marketing requires a separate assessment and is not part of this test.
Storage and retention
Appointment data is stored on an OVHcloud VPS in Frankfurt, Germany (region os-de2), verified in the hosting account. Calendar keeps 14 daily database backups on that VPS. OVHcloud snapshots and automated VPS backups are also enabled; their location and retention still need review. Email is sent through OVHcloud; mailbox storage locations remain to be verified.
Retention period: [TO BE DECIDED]. Appointment records are not automatically deleted yet. Delivered email queue bodies are cleared, and expired queue entries are removed. The final policy must cover the database, backups, sender mailbox and recipient email copies.
If you enable a private calendar subscription, your selected calendar provider receives customer names, email addresses and appointment details, without prices. Google and Outlook connections store encrypted access credentials and busy start/end times only. Disconnecting removes the local connection and busy-time cache; external calendar copies may remain with their provider.
Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction or portability, object to processing, and complain to a supervisory authority. Send requests to [PRIVACY EMAIL]. Identity checks, exceptions and request handling must be defined before launch.