Datenschutzerklärung

1. Identity of the controller

This privacy policy is issued by:

• Name: VesyGo — operated by A. DEMS LTD
• Registered office: Stadiou 11, 2113 Aglantzia, Nicosia, Cyprus
• VAT number: CY60137615U
• Email: info@vesygo.com
• Telephone: +357 99 976 265
• Website: https://www.vesygo.com

A. DEMS LTD, trading as VesyGo, acts under a dual GDPR role set out in section 1bis below.

1bis. Our GDPR role: controller and processor

Depending on the nature of the data processed, VesyGo takes one or other of the roles defined by the GDPR:

In practice: if you are an end client who booked through a salon, your GDPR requests (access, rectification, erasure, portability) should be addressed first to the salon concerned, which acts as controller. VesyGo can technically facilitate those requests when the salon asks us to, in accordance with the DPA.

2. Personal data collected

We collect the following categories of data:

2.1. Salon owners (professional users)

• First and last name
• Email address
• Mobile telephone number
• Salon address (street, city, postal code, country)
• Intra-community VAT number
• Salon logo and cover photo
• Google Place identifier (if voluntarily provided)

2.2. Clients (people making a booking)

• Full name
• Email address
• Mobile telephone number
• Any comments related to the booking

2.3. Technical and browsing data

• IP address (anonymised)
• Browser type and operating system
• Pages visited and time spent
• Cookie data (see section 8)

3. Purposes and legal bases of processing

In accordance with article 6 GDPR, we process your data on the following legal bases:

4. Recipients of the data

Your personal data is never sold or rented to third parties. It is shared only with our technical processors, strictly within the scope of their services.

The complete, current and binding list of our sub-processors is published on the Sub-processors page. That page is the single source of truth: we undertake to inform our customers by email at least 30 days before any addition or replacement.

For information, the main sub-processors are:

• Hetzner Online GmbH (Germany, EU) — server hosting + database
• Cloudflare (United States*, EU POPs) — CDN, DNS, DDoS protection
• Resend (United States*) — transactional email delivery
• Stripe Payments Europe (Ireland, EU) — subscriptions and deposits
• Google & Microsoft (United States*) — calendar synchronisation (with OAuth consent)

* For sub-processors located outside the EU, VesyGo relies on the Standard Contractual Clauses (SCCs) — implementing decision (EU) 2021/914 — and on the EU-US Data Privacy Framework where the sub-processor is certified under it. A transfer impact assessment is available on request.

5. Data retention periods

This schedule is strictly aligned with the Terms of Service and the DPA. Any apparent inconsistency must be interpreted in favour of the table below, which prevails.

• Active salon account: for the whole duration of the contract
• Operational client data (clients, current appointments): duration of the contract + 30 days' grace after termination to allow restoration
• Past bookings: 3 years from the date of the appointment (legitimate interest — dispute handling and history for the salon)
• Invoices and accounting data: 10 years from 1 January of the year following their issue (Belgian tax obligation — article 60 § 1 of the VAT Code, version applicable since 1 January 2024)
• Security and audit logs: 12 months
• OTP codes: 5 minutes (automatic expiry)
• Preview requests submitted on the website (name, email, telephone): 12 months from the request; 7 days for failed or archived requests
• Professional prospecting contact details from public listings (Google Maps): 24 months without contact. An objection is kept beyond that, in minimal form, so that you are not contacted again
• Analytics cookies (Google Analytics): 14 months maximum

6. Your rights (articles 15 to 22 GDPR)

In accordance with the GDPR, you have the following rights:

• Right of access (art. 15): obtain a copy of your personal data
• Right to rectification (art. 16): correct inaccurate or incomplete data
• Right to erasure (art. 17): request deletion of your data, subject to statutory retention obligations
• Right to restriction (art. 18): restrict processing in certain cases
• Right to portability (art. 20): receive your data in a structured, machine-readable format
• Right to object (art. 21): object to processing based on legitimate interest
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing

To exercise your rights, contact us at: info@vesygo.com

We will respond within 30 days in accordance with article 12 GDPR.

7. Complaint to a supervisory authority

If you consider that the processing of your data infringes the GDPR, you have the right to lodge a complaint with:

You may also contact the data protection authority of your country of residence.

8. Cookies

8.1. Essential cookies (no consent required)

These cookies are strictly necessary for the site to work:

• Authentication session (authjs.session-token) — duration: session
• Language preference (loc for VesyGo, salon-loc on booking pages) — duration: 1 year
• Cookie consent (cookie-consent) — duration: 1 year

8.2. Analytics cookies (with consent)

These cookies are only set if you explicitly consent:

• Google Analytics (_ga, _ga_*) — duration: 14 months — purpose: anonymised audience measurement (anonymised IP)

You can change your preferences at any time through the cookie banner or by deleting cookies in your browser.

8.3. Advertising cookies

VesyGo uses no advertising or marketing tracking cookies.

8bis. Calendar data (Google / Microsoft)

A salon's team members can connect their personal calendar (Google Calendar, Microsoft Outlook / Office 365) to VesyGo to synchronise their appointments. This integration uses each provider's official APIs through the OAuth 2.0 protocol.

Data we access

• Reading events from the selected calendar: only start and end times, title and "busy" status. We never access attachments, detailed descriptions, locations or guest lists.
• Creating / modifying / deleting events only for appointments generated by VesyGo, so that they appear automatically in the member's calendar. We never touch events created by the user or by third parties.
• The email address of the connected account, purely for display purposes ("Connected as ali@gmail.com").

How we protect this data

• OAuth access tokens are encrypted at rest with AES-256-GCM before being stored in the database. The encryption key is never accessible from ordinary application code.
• No calendar data is shared with third parties, sold, or used for targeted advertising.
• Event data is cached server-side solely to block the corresponding slots on the availability grid. The cache is refreshed in real time through the provider's push notifications (webhooks).
• In accordance with the Google API Services User Data Policy, VesyGo does not use data obtained through Google Workspace APIs to train artificial intelligence models.

Revocation and deletion

Users can revoke the connection at any time from the "Calendar" tab of their profile in VesyGo, or directly from the security settings of their Google / Microsoft account. On revocation, all encrypted tokens and associated cached data are deleted immediately and permanently.

9. Data security

We implement the following technical and organisational measures:

• Encryption of data in transit (HTTPS/TLS 1.3)
• Hashed passwords (bcrypt)
• CSRF protection and security headers (CSP, HSTS, X-Frame-Options)
• Rate limiting on sensitive endpoints
• OTP verification by SMS for bookings
• Hosting in the European Union (Hetzner, Germany)
• Administrator access protected by strong authentication
• Logging of sensitive actions (audit log)

10. International transfers

Some sub-processors are established in the United States (see section 4). These transfers are governed by:

• The EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023)
• Standard contractual clauses (SCCs) adopted by the European Commission

11. Minors

VesyGo is not intended for people under 16. We do not knowingly collect personal data from minors. If you are a parent and find that your child has provided us with data, contact us at info@vesygo.com.

12. Changes to this policy

We reserve the right to amend this policy. Any substantial change will be notified by email to registered users and signalled by updating the date at the top of this page.

13. Contact

For any question relating to the protection of your personal data:

• Email: info@vesygo.com
• Form: vesygo.com/contact