Privacy Policy

This Privacy Policy explains what personal data Chekiraj collects, why, how long we keep it, who we share it with and what rights you have. It applies to the website and service at chekiraj.net (the "Platform").

Who is responsible

The controller of your personal data is [θα συμπληρωθεί], [θα συμπληρωθεί], registration number [θα συμπληρωθεί] ("Chekiraj", "we"). For anything about privacy, write to support@chekiraj.net.

When a business uses Chekiraj to manage its own clients and staff (for example bookings it enters manually, or its client list), the business is the controller of that data and Chekiraj processes it on the business's behalf. Questions about that data are best sent to the business directly. We will help the business respond.

Data we collect

Account data. First and last name, email address, password (stored only as a secure hash), language, time zone, the date you accepted the Terms and, if you agreed, the date of your consent to news and offers. For business accounts also a contact phone number, which is not public. If you sign in with Google, we receive your name, email address and Google account identifier.

Client profile. Phone number (optional) and your reminder settings.

Bookings. The business, service, staff member or resource, date and time, number of participants, your note to the business, the booking status and its history (who changed what and when), attendance and no-show records.

Reviews, reports and disputes. Your ratings, comments, replies, reports of content or of a booking problem, no-show disputes, appeals and the decisions made on them.

Business data. Business name, category, description, address and map location, service area, photos, services and prices, working hours, staff names and schedules, resources, subscription and payment status, sponsorships and their statistics (number of times shown and clicked). Business profiles are public by design, except the owner's contact data and internal data.

Payments. Subscriptions and sponsorships are paid through PayPal. We receive the payment confirmation, amount, status and PayPal's transaction reference. We never receive or store card or bank details.

Emails we send. The address, type and status of every email we send you (such as confirmations, reminders and notices about decisions). We keep the content of sent emails for 30 days and the sending records for 90 days, so that we can resend failed emails and answer questions about them.

Searches. When someone searches, we record the search text, category, place, radius, whether a date was chosen, the number of results and the language, without any information about who searched. We use this to improve search and to see which services are in demand.

Technical data. Your IP address is processed when you use the Platform, to keep it secure (for example to limit repeated sign-in attempts) and, on the search page, to suggest the city you are probably in, using a database stored on our own server. We do not store the IP address for the city suggestion and do not send it to anyone for this purpose. Error records are stripped of email addresses and phone numbers and kept for 30 days.

Location in the browser. If you press "My location" in search, your browser asks your permission and shares your current position with the page so that it can show nearby businesses. We use it only for that search and do not store it.

Records of administrative actions. Important actions, such as cancellations, changes made by our team and measures against accounts, are recorded with the time and the person who did them, to resolve disputes and keep the Platform secure.

Why we use your data and on what legal basis

• To provide the Platform under our contract with you (GDPR Article 6(1)(b)): your account, bookings, confirmations and reminders, reviews, disputes, the business profile, subscriptions and support.
• For our legitimate interests (Article 6(1)(f)): security and abuse prevention, moderation, resolving disputes, enforcing our Terms, improving the Platform and anonymous statistics. We weigh these interests against your rights, and you can object (see "Your rights").
• With your consent (Article 6(1)(a)): news and offers by email, and your browser location. You can withdraw consent at any time.
• To meet legal obligations (Article 6(1)(c)): for example keeping accounting records of payments, and responding to lawful requests from authorities.

We do not sell personal data, we do not show third-party advertising, and we do not use your data for targeted advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. How search results are ordered is explained in the Terms of Use.

Who can see your data

• Businesses you book with see your name, contact details, your bookings with them, your note, your attendance and reviews of their business. Your phone number is shown only if you entered it.
• The public sees business profiles and published reviews. Your review shows your first name and the initial of your last name. No-shows are never public.
• Our team sees personal data only as far as needed for support, moderation, dispute resolution and security. Access to a user's personal data in the administration requires a stated reason, lasts at most 60 minutes and is logged.
• Service providers (processors) that work for us under contract:
  • [θα συμπληρωθεί]: hosting of the Platform and its database ([θα συμπληρωθεί]);
  • Resend: sending emails;
  • PayPal: processing payments for subscriptions and sponsorships (PayPal also acts as an independent controller under its own privacy policy);
  • Google: sign-in with Google, only if you choose it.
• OpenStreetMap. Maps on the Platform are loaded from OpenStreetMap servers, and when a business enters its address, the address is looked up through OpenStreetMap's search service. Your browser connects to these servers directly, so they receive your IP address and the requested map area or address, under the OpenStreetMap Foundation's privacy policy.
• Authorities, when the law requires it.
• A buyer or successor, if Chekiraj is reorganised or sold, under the same protection.

Transfers outside your country

Some of our service providers process data outside the European Economic Area and Bosnia and Herzegovina, for example in the United States. In those cases we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, where the provider is certified) or on Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at support@chekiraj.net.

How long we keep data

• Client account: while the account is open. If you close it, you can restore it within 30 days. After that we permanently delete your name, email address, phone, sign-ins, favourites and settings. Your past bookings, reviews and disputes stay with the businesses in anonymised form ("Former client"), because they are part of the businesses' records and ratings.
• Business account: while the account is open. After it is closed, the business's data are deleted, except data we must keep by law (such as payment records).
• Payment and invoicing records: for the period required by accounting and tax law.
• Emails: content 30 days, sending records 90 days.
• Error records: 30 days.
• Anonymous search records: 12 months.
• Records of administrative actions and measures: as long as needed to resolve disputes and keep the Platform secure.
• Permanently deleted accounts: if an account is permanently deleted as a measure for breaking the rules, its data are deleted, but its email address and phone numbers are kept on a block list to prevent registering again.
• Backups: deleted data may remain in backups for a limited time until the backups are overwritten.

Your rights

Depending on where you live, you have the right to:

• access your data and get a copy. As a client you can download all your data yourself in the account settings;
• correct inaccurate data, mostly yourself in your account;
• delete your data. As a client you can close your account yourself in the account settings;
• restrict processing, or object to processing based on legitimate interests;
• data portability, to receive your data in a machine-readable format;
• withdraw consent at any time, without affecting earlier processing. You can withdraw consent to news and offers by writing to us or through the unsubscribe link in every such email;
• complain to a data protection authority: in the EU/EEA to the authority in your country, in the UK to the Information Commissioner's Office, in Bosnia and Herzegovina to the Personal Data Protection Agency, in Serbia to the Commissioner for Information of Public Importance and Personal Data Protection.

To use any of these rights, write to support@chekiraj.net from your account's email address. We reply within one month. If needed, we may ask you to confirm your identity.

Additional information for residents of the United States

This section applies to residents of California and of other U.S. states with consumer privacy laws.

• Categories of personal information we collect are listed in "Data we collect": identifiers (name, email, phone, IP address), commercial information (bookings, subscriptions and payments), internet activity on the Platform (searches, technical data), approximate geolocation (city from IP address, browser location with permission) and content you publish (reviews, profile content). We collect it from you, from your use of the Platform, from businesses that enter bookings for you, and from Google if you sign in with Google. We use it for the purposes listed above.
• No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share personal information of consumers under 16.
• Sensitive personal information. We use account sign-in data only to provide the service, and we do not use or disclose sensitive personal information for purposes that would give you the right to limit it.
• Your rights. You can request to know, access, correct and delete your personal information, and to receive it in a portable format. We will not discriminate against you for using these rights. An authorised agent may submit a request for you, with your written permission, and we may verify your identity. Send requests to support@chekiraj.net. If we deny your request, you can appeal by replying to our answer, and, if you are not satisfied, contact your state's Attorney General.
• Retention is described in "How long we keep data".

Children

The Platform is not intended for children. You must be at least 16 years old to create an account. If we learn that we hold data of a child under 16 without a valid basis, we will delete it. Parents or guardians can contact us at support@chekiraj.net.

Security

We protect data with encrypted connections (HTTPS), hashed passwords, access control based on roles, logging of access to personal data, rate limiting against misuse, and by re-encoding uploaded photos to remove hidden location data. No system is completely secure, so please use a strong, unique password.

Cookies

We use only cookies that are needed for the Platform to work. The Cookie Policy lists them.

Changes to this policy

We may update this policy. We publish the new version on this page with its date, and we notify you by email or in your account before important changes apply.

Languages

This policy is available in several languages. If the versions differ, the English version prevails.