PlanSlot Privacy Policy & GDPR Data Protection Notice

1. Controller and contact details

For processing where PlanSlot determines the purposes and means, the controller is PLANSLOT TECH LTD, Patmou 15, 8021 Paphos, Cyprus, Company No. HE 498059. Privacy contact: info@planslot.com. Data protection contact (Compliance Officer, acting as PlanSlot's data protection point of contact): info@planslot.com. EU Digital Services Act (Regulation (EU) 2022/2065) point of contact for recipients of the service, designated under Article 12: info@planslot.com.

2. Scope

This Notice applies to visitors to the PlanSlot website, Customers/End Users, Supplier representatives and staff users, and individuals whose data is processed through the Platform. The Platform is intended for use by individuals aged 18 and over; see “Who can use the Platform / PlanSlot” in the Website Terms of Use and Customer Terms.

3. Categories of personal data

• Identity data: name and account identifiers.
• Contact data: email address, telephone/mobile number and communications details.
• Account and authentication data.
• Booking data: Supplier, service, date/time, booking status, cancellation and waiting-list information.
• Supplier data: business information, staff profiles, schedules and operational information.
• Technical data: IP address, device/browser information, logs, security events and application diagnostics.
• Usage data: interaction with the website/app, preferences and feature usage.
• Communications data: support requests and correspondence.
• Marketing preferences and consent records.
• Location information only where the feature is enabled and the applicable legal basis/permissions exist.

4. Special-category / health data

Appointments with healthcare providers may reveal or infer information concerning health. PlanSlot will not intentionally require detailed medical records for ordinary booking functionality. Where a Supplier instructs PlanSlot to process health or other special-category data, the Supplier remains responsible for identifying and documenting the applicable Article 9 condition and giving appropriate privacy information. PlanSlot will process such data only under documented instructions and appropriate safeguards. PlanSlot's Suppliers include clinics and other healthcare providers from initial launch. Before onboarding healthcare Suppliers, PlanSlot completes a Data Protection Impact Assessment (DPIA) covering this processing, in line with guidance from the Cyprus Commissioner for Personal Data Protection.

5. Purposes and legal bases

6. Data sharing

PlanSlot may share personal data with the relevant Supplier when necessary to fulfil a Customer booking or other requested service, and with processors/subprocessors such as hosting, communications, analytics, security, support and infrastructure providers. PlanSlot may also disclose information where required by law, to professional advisers, or in connection with a corporate transaction subject to appropriate safeguards.

7. International transfers

Where personal data is transferred outside the EEA, PlanSlot will use a lawful transfer mechanism under GDPR, such as an adequacy decision, Standard Contractual Clauses or another permitted safeguard, as applicable. A current subprocessor/transfer list is maintained and made available through the Subprocessor List.

8. Retention

Personal data will be retained only for as long as necessary for the relevant purpose, contractual relationship, security, accounting/legal requirements and the establishment, exercise or defence of legal claims. Supplier data processed under the DPA will be returned or deleted according to the Supplier's instructions after termination, subject to legal retention requirements. PlanSlot maintains a detailed internal retention schedule setting out specific periods for each data category, available on request from info@planslot.com.

9. Data subject rights

Subject to applicable law, individuals may have rights of access, rectification, erasure, restriction, objection, data portability and withdrawal of consent. Requests may be sent to info@planslot.com. Where PlanSlot acts only as a processor for a Supplier, PlanSlot may refer the request to the relevant Supplier/controller and assist as required by the DPA.

10. Security

PlanSlot will implement appropriate technical and organisational measures proportionate to risk, including access controls, authentication, encryption where appropriate, logging, backups, vulnerability management, secure development practices and incident response. No online system can guarantee absolute security.

11. Personal data breaches

Where PlanSlot acts as a processor and becomes aware of a personal data breach affecting Supplier data, it will notify the relevant Supplier/controller without undue delay and provide reasonable information and assistance. Where PlanSlot is controller, it will assess notification obligations under GDPR and applicable Cyprus law.

12. Automated decision-making

PlanSlot will not make decisions producing legal or similarly significant effects on individuals solely through automated processing unless expressly disclosed and implemented in accordance with applicable law.

13. Complaints

Individuals may contact PlanSlot first. They may also lodge a complaint with the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority where permitted by GDPR.

14. Changes

PlanSlot may update this Notice to reflect changes in the Platform, law or processing activities. Material changes will be communicated through appropriate channels.