Privacy Policy

1. Data controller

The controller of the personal data collected through the platform is Pavanello & Jacomel, Lda, with corporate tax identification number NIF/NIPC: 519391705 and registered office at Rua 25 de Abril, Lote 1, 1º esquerdo, 2955-123 Pinhal Novo, Palmela, Setúbal, Portugal (hereinafter «agenda.do», «we»).

For any question about privacy or to exercise your rights, you can contact us at pavanelloejacomel@gmail.com.

2. Who it applies to

This Policy applies to everyone whose data we process: site visitors, professionals who subscribe to agenda.do, their team members and customers who make bookings, including customers without an account, whose record is created from the booking form.

When a customer makes a booking with a professional, the professional becomes the independent controller of that customer's data, for the management of their own commercial relationship. This Policy describes the processing carried out by agenda.do.

3. What data we collect

• Account and identification data: name, email address, password (stored in encrypted form), and photo/avatar (optional).
• Professional profile data: trade name, telephone, address and locality, geographic coordinates, description, photos and gallery, logo, social media links and activity categories, displayed publicly on the booking page.
• Team data: name, biography and photo of the members added by the professional.
• Booking and customer data: name, telephone and email (when provided), appointment notes, appointment history, the professional's internal notes about the customer and no-show records.
• Reviews: rating (1 to 5) and comment submitted by the customer.
• Subscription and payment data: plan, subscription status and Stripe identifiers. Card data is processed directly by Stripe; agenda.do does not store it.
• Technical and session data: IP address, browser/device identification, access logs and session cookies.
• Google Calendar integration (optional): Google account address, access credentials (stored in encrypted form) and calendar identification.
• Communications: messages you send us through the contact form or by email.

4. Purposes, legal basis and retention

We process your data only for the purposes below and retain it only for as long as necessary for those purposes or to comply with legal obligations.

5. How we collect the data

We collect data directly from you, when you create an account, set up your profile, make a booking or contact us. In the case of customers without an account, data is collected through the booking form. When you enable the Google integration, we receive data from that account with your authorisation.

6. Who we share your data with

We do not sell your personal data. We share the necessary contact details with the professional with whom you make the booking, so that the service can be provided. We also use processors that process data on our behalf, subject to confidentiality and security obligations:

7. Disclosure to authorities

We may disclose personal data when required by law, by a court order or by a competent authority, or when necessary to protect rights, the security of the platform or of third parties. In the context of corporate operations (merger, acquisition), data may be transferred subject to confidentiality.

8. International transfers

Some of our processors are established outside the European Economic Area, in particular in the United States. In such cases, we ensure adequate safeguards under the GDPR, through adequacy decisions of the European Commission (including the EU-U.S. Data Privacy Framework, where applicable) or standard contractual clauses. You can obtain more information by contacting us.

9. Retention and deletion

We retain data while the account is active and for the periods indicated in the table above. You can delete your account at any time from the settings; deletion removes the associated data (profile, team, services, bookings and customers created in the account). Some data is retained for longer periods when the law requires it (for example, billing data, for 10 years).

To prevent abuse of the free trial period, we retain the email address of accounts that used it even after the account is deleted. Requests for portability and access are handled by us individually, upon contact.

10. Security

We adopt appropriate technical and organisational measures to protect your data: encrypted transmission (HTTPS), passwords stored with hashing functions, encryption of third-party credentials at rest, limitation of access attempts and access control. No system is completely secure, but we work continuously to reduce risks.

11. Your rights

Under the GDPR, you have the following rights over your personal data:

• Access: obtain confirmation that we process your data and a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the deletion of your data in the cases provided for by law.
• Restriction: temporarily restrict the processing.
• Objection: object to processing based on legitimate interest.
• Portability: receive your data in a structured, commonly used format.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.

12. How to exercise your rights

To exercise any of these rights, contact us at pavanelloejacomel@gmail.com. You may be asked to prove your identity. We will respond within one month, extendable under the law. If you are a customer who booked with a professional, you may exercise your rights with that professional or through us.

You also have the right to lodge a complaint with the supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt.

13. Minors

The platform is not directed at minors under 18 and we do not intentionally collect their data. Bookings on behalf of minors must be made by a responsible adult.

14. Automated decisions

We do not make decisions that produce legal effects or that significantly affect you based solely on the automated processing of your data.

15. Cookies

We use cookies and similar technologies to operate and improve the service. The details are set out in our Cookie Policy.

16. Changes to this policy

We may update this Policy to reflect changes in the service or in legislation. The update date is shown at the end of the document and material changes will be communicated.