Privacy policy
Last updated: 28.10.2026
1. Who we are
Appointix (https://appointix.net) is an online appointment booking platform operated by ДЖИ СЪЛЮШЪНС ЕООД, company ID 207003022, address: гр. Варна 9000, р-н Одесос, ул. „Ана Феликсова“ 14, бл. А, ет. 4, ап. 20.
For any question about personal data, write to [email protected].
2. Two roles: the platform and the businesses
- ДЖИ СЪЛЮШЪНС ЕООД is the controller of account data, platform security data and business subscription data.
- The business you book with is the controller of the data you give it when booking: your name, email, phone, notes and your booking history with it, as well as the records it keeps of your visits (notes, photos and documents). ДЖИ СЪЛЮШЪНС ЕООД processes that data on the business's behalf as a processor under Article 28 of the General Data Protection Regulation (GDPR). You can also contact the business directly about it.
3. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: name, email, phone, password (stored only as a hash), language | Signing in, booking, "My bookings" | Performance of a contract — Art. 6(1)(b) |
| Booking: business, service, staff member, date and time, notes; when booking without an account — name, email and phone | Making, confirming, reminding about and cancelling the booking | Performance of the contract between you and the business — Art. 6(1)(b) |
| Booking emails (confirmation, reminder the day before, cancellation) | Keeping you informed about the booking | Performance of a contract — Art. 6(1)(b) |
| Reviews: rating and comment | Publishing reviews of the business | Legitimate interest of users and businesses in genuine reviews — Art. 6(1)(f) |
| Business data: profile, services, locations, working hours, staff names and emails | Providing the service to the business | Performance of a contract — Art. 6(1)(b) |
| Business subscriptions: plan, status, invoices | Subscription payments, accounting | Performance of a contract and legal obligation — Art. 6(1)(b) and (c) |
| Technical data: IP address, browser, technical logs | Security, abuse prevention (rate limiting), fixing errors | Legitimate interest — Art. 6(1)(f) |
| Bot check (Cloudflare Turnstile) in the booking widget, when enabled | Preventing automated fake bookings | Legitimate interest — Art. 6(1)(f) |
We do not sell personal data, use it for advertising or profiling, or make automated decisions that significantly affect you. We do not send marketing messages.
Your name and email are needed to book: without them we cannot create the booking. Your phone number is optional.
4. Who receives the data
- The business you book with. It sees your name, email, phone, notes and your booking history with it, as well as the records of your visits. In "My bookings" you see only the notes and files the business has marked for you.
- Sub-processors that help us provide the service:
- Hetzner Online GmbH, Germany — hosting and database;
- Cloudflare, Inc. — network, attack protection and bot checks;
- Scaleway SAS, France — sending emails;
- Stripe Payments Europe, Ltd. — subscription payments (businesses only).
- Public authorities, where the law requires it.
5. Transfers outside the European Economic Area
Our servers and database are in the European Union (Germany). Cloudflare and Stripe belong to groups headquartered in the USA. Transfers to them rely on the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.
6. How long we keep data
- Account — until you delete it (Settings → Profile → Delete account). Your customer records at businesses are then anonymized.
- Customer record at a business — 3 years after your last booking with that business. Your name, email, phone and notes are then anonymized automatically; the bookings remain without personal data for the business's statistics.
- Subscription invoices — 10 years, as required by accounting law.
- Technical logs — up to 14 days.
- Visit records — until the business deletes them or the customer record is anonymized (they are then deleted with their files). The files of a business without an active subscription are deleted 3 months after its trial or subscription ended.
- Reviews — until they are deleted or the business is closed.
7. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest. You can change most of your data yourself in your profile settings, where you can also delete your account.
To exercise your rights, write to [email protected]. We reply within one month. For data we process on behalf of a business, we will forward your request to the business or help it respond.
If you believe your rights have been infringed, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, [email protected], www.cpdp.bg, or with the supervisory authority where you live.
8. Cookies
We only use strictly necessary cookies, without which the site cannot work:
appointix-session— keeps your session (sign-in);XSRF-TOKEN— protects forms against forged requests;appearanceandsidebar_state— remember the interface look you chose.
We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent. The booking widget embedded on businesses' websites sets no cookies.
9. Security
The connection to the site is encrypted (HTTPS), passwords are stored only as hashes, and access to data is limited to what each role needs.
10. Changes
When this policy changes, we publish the new text here with its date. We will notify account holders of significant changes.