Privacy notice

Who processes your data

Controller: the institution named above. Write to it through its usual contact details to exercise your rights. Its contact details and those of its data protection officer are in its own privacy notice, usually on its website.

Processor: Appointsafe, operated by Shopkitware, sole proprietorship, owner Hakim DJABRI, Nordring 25, 64846 Groß-Zimmern, Germany, [email protected].

What is processed

The name of the person attending, your email address, your mobile phone if you give it, your answers to the service's questions, and the appointment itself: service, place, time and number of persons.

For security, the technical data of your requests, such as your IP address, is used to stop automated and abusive bookings.

Why

To book, confirm and remind you of your appointment, to let you change or cancel it, and to check you in at the counter. Where the institution uses them: to confirm your email with a code, to tell you what to bring, to book for you a time that frees up on a day whose waitlist you joined, and to ask you to rate your visit. The legal basis is the institution's public task or your request for a service (Art. 6(1)(e) or (b) GDPR), and the protection of the booking service against abuse (Art. 6(1)(e) or (f) GDPR).

At the office, you may be called by your visit number: the calling screen shows only that number and the counter, never your name.

Who receives it

The institution's staff, for your appointment only.

Our hosting in Germany; the email provider that delivers your messages, in the EU unless the institution agrees to another one, which then needs an adequacy decision or the EU standard contractual clauses; and, if you receive text messages, the SMS provider seven.io in Germany.

Cloudflare, Inc. (USA) protects this page and encrypts its connections. To do so it receives your requests in clear text, including the data you enter, in the data centre nearest you, possibly outside the EU: in the USA under the EU–US Data Privacy Framework, elsewhere under the EU standard contractual clauses.

Sentry (Functional Software, Inc., USA) receives technical error reports when this page or our servers fail, stored in its EU data region in Frankfurt. The reports are built to leave your data out: your IP address, cookies and what you enter are never sent, and email addresses, phone numbers, codes and links in an error message are masked. Your browser never contacts Sentry: reports go through our own server. Access from the USA relies on the EU–US Data Privacy Framework, otherwise on the EU standard contractual clauses.

These providers are all bound by data processing agreements. Your data is never sold or used for advertising, and this page uses no tracking.

How long it is kept

Your personal data is encrypted and kept for the period the institution sets, and at the latest deleted within 30 days after its contract with Appointsafe ends.

A booking that is not confirmed is erased as soon as its hold ends.

Security

Your personal details are stored encrypted in Germany, with the institution's own keys, and every connection is encrypted.

Cookies

Only strictly needed cookies: one keeps your booking session (on a booking page embedded in another website, a separate one does), and one keeps the session of your change or cancel link while you use it.

Cloudflare normally sets none. Only if it shows a security check during an attack does it set cf_clearance and short-lived challenge cookies (cf_chl_rc_*), to remember that you passed it. No analytics or advertising cookies.

Your rights

You can ask for access, correction or erasure of your data, restriction of its processing and data portability, and you can object to processing (Art. 15 to 21 GDPR). Send your request to the institution; if you cannot reach it, write to Appointsafe at [email protected] and we forward it to the institution. You can also complain to a data protection supervisory authority.