Privacy Policy

Agéndalo ToDo ("we", "us", "our", or "the Platform") informs users that the personal data they provide will be processed by GPS LOBBO TEAM, S.L., with Tax ID B-19401306 and address at Avenida del Paral·lel 144, 2-1, 08015 Barcelona, España. For any questions related to this policy, you can contact us at info@agendalotodo.com.

We collect information to provide and improve our services. This information is divided into two categories:

a) Data from our Clients (Businesses):

• Account Information: Business name, Tax ID, address, contact email, phone number.
• Payment Information: We collect the necessary data to process subscription payments through our payment provider (Stripe), but we do not store full credit card details.
• Configuration Data: Customization of the booking portal, services offered, schedules, employee profiles, etc.

b) Data from our Clients' Customers (End Users):

As a SaaS platform, our Clients (the businesses) use our tools to manage their own customers. Agéndalo ToDo acts as a Data Processor for this data, while the Business is the Data Controller. The information we process on their behalf includes:

• Contact Details: Name, email, phone number.
• Appointment History: Services booked, dates, assigned professional.
• Notes and Consents: Technical information or informed consents that the Business records on the platform.
• Clinical history (health data): In healthcare and aesthetics practices, the Business may record clinical notes, progress images, attached documents and pain-area maps. These are special category data (art. 9 GDPR) and we process them solely on behalf of the Business, which is the party obtaining the patient's explicit consent. When the right to erasure is exercised, the associated files are deleted too.

c) Client Portal account data:

An End User may, if they wish, create a free account to view their own appointments, vouchers, subscriptions and documents at the businesses where they are a client. For this account, Agéndalo ToDo acts as Data Controller, not as Processor, because the relationship is directly with us:

• Sign-in data: their email and authentication credentials, or their Google account identifier if they sign in with it. Passwords are never stored in plain text.
• Contact details they keep from their account: name, phone number, language and notification preferences (whether they want reminders and promotions, and through which channel).
• The link: which records at which businesses belong to that account, and since when.

The information the person SEES inside their account (their appointment history, their vouchers, their signed documents) remains the responsibility of the relevant business: the account is a window onto data that already existed, not a new copy.

The link between an account and a record is only created with proof of channel ownership: an invitation link sent by the business itself, or an email verified by the identity provider. Never merely because an email address matches.

We use the information we collect for the following purposes:

• For Businesses: To manage their account, process payments, provide the contracted service, offer technical support, and communicate updates about the platform.
• For End Users (on behalf of the Business): To manage the appointment system, send automatic reminders via WhatsApp or email, and allow the Business to provide its service efficiently.
• For the Client Portal account: allow the person to view their information at the businesses where they are a client, keep their contact details up to date and decide which notifications they want to receive and through which channel.
• To measure our advertising: Knowing which of our Facebook and Instagram ads bring businesses that sign up, only with your consent (see section 7).

The legal basis for processing the data of our Clients (Businesses) is the performance of a contract (the terms and conditions of the service).

The legal basis for processing the data of End Users is the consent they give to the Business when booking an appointment, or the contractual relationship they establish with said Business. Agéndalo ToDo operates under the instructions of the Business, formalized in the data processing agreement.

The legal basis for Google Calendar synchronization (section 6) is the consent of the user who connects their account, revocable at any time.

Where the Business records health data (clinical history, progress images or pain-area maps), the legal basis is the patient's explicit consent or the provision of health care (art. 9.2.a and 9.2.h GDPR), which the Business itself must obtain and evidence as Data Controller.

The legal basis for processing the Client Portal account is the performance of the contract the person accepts when creating it (Art. 6.1.b GDPR), together with their consent, given by an affirmative action at sign-up and withdrawable at any time by deleting the account from the portal itself.

The legal basis for measuring our advertising (section 7) is your consent (Art. 6(1)(a) GDPR), which you give by accepting marketing cookies in the cookie notice and can withdraw at any time from that same notice or by writing to info@agendalotodo.com. If you do not accept, we report nothing to Meta.

We do not sell or rent your personal data. We only share information with service providers who help us operate, always under strict confidentiality agreements:

• Payment Gateways (Stripe): To process subscription payments and advance payments for appointments.
• Infrastructure and hosting (Google Cloud / Firebase): Our servers, with data hosted in a European Union region.
• Email delivery (Resend): For the Platform's transactional emails and notices.
• WhatsApp reminders (Meta Platforms, WhatsApp Business Cloud API): For sending appointment reminders.
• Advertising measurement (Meta Platforms Ireland Ltd.): Only if you reach our sign-up from one of our ads on Facebook or Instagram and accept marketing cookies (see section 7).
• Google Calendar (Google): Only if a professional or manager voluntarily connects their calendar (see section 6).

When any of these providers involves an international data transfer (for example, US-based parent companies), it is carried out with the safeguards provided by the GDPR: standard contractual clauses or participation in the EU-US Data Privacy Framework.

If a professional or manager of a Business decides to connect their Google account, Agéndalo ToDo syncs the appointments of their agenda with their personal Google Calendar. This feature is optional and only activates if the user expressly authorizes it through Google's secure access system (OAuth).

• Data we send to Google: for each appointment, an event is created or updated in the user's calendar with the service, the date and time, and the client's name for that appointment. Private appointment notes never leave the Platform.
• Data we receive from Google: only the email address of the connected account and the technical access credentials (tokens). We do not read, store or analyze any other events in the user's calendar.
• How we protect credentials: tokens are stored encrypted (AES-256-GCM) and are only used to keep the calendar in sync.
• Revocation: the user can disconnect their calendar at any time from the Platform (future events created by Agéndalo ToDo are removed and their credentials are destroyed) or revoke access from their Google account at myaccount.google.com/permissions.

Agéndalo ToDo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: this data is not used for advertising, is not sold or transferred to third parties except to provide the synchronization feature itself, and no human reads it except with the user's consent, for security purposes, or to comply with the law.

If you reach our sign-up form from an Agéndalo ToDo ad on Facebook or Instagram (or with the parameters of one of our campaigns on those networks) and accept marketing cookies, we tell Meta Platforms Ireland Ltd. which sign-up steps you complete, so we know which ads work and can show them to businesses that may be interested. We do this with the Meta pixel in your browser and, so the data is not lost, also from our servers through Meta’s Conversions API.

• What we report: that you completed your business details (with the business type you picked from a list) and, where applicable, that you created your account.
• Which data: the ad-click identifier that Meta adds to the link, your IP address, technical details of your browser, a random visit identifier and, only when you create your account, your email and country. The visit identifier, email and country are sent through a hash function (pseudonymisation). Meta matches them against its own users to know whether they belong to someone with a Facebook or Instagram account, so they are still personal data. We never send your clients’ data or the content of your account.
• Only with your consent and from our ads: if you do not accept marketing cookies, or you arrive any other way (a search engine, a direct link, a recommendation), we report nothing to Meta.
• How to withdraw it: from the cookie notice or by writing to info@agendalotodo.com. Withdrawing does not affect what has already been reported.
• Retention: we do not keep a copy of what we report to Meta. Meta keeps it under its own policy.

For the collection and transmission of this data to Meta we are joint controllers with Meta Platforms Ireland Ltd., under the joint controller addendum Meta publishes (facebook.com/legal/controller_addendum), which allocates the information and data-subject-rights obligations. We handle any rights you exercise over this reporting at info@agendalotodo.com. Once received, Meta processes the data as an independent controller for its own purposes, under its privacy policy (facebook.com/privacy/policy). Any transfer to the USA this may involve is made with the safeguards described in section 5.

The account data of Businesses will be kept as long as they maintain an active subscription and, subsequently, for the legally required periods.

The data of End Users will be retained according to the policies defined by the Business (Data Controller). If a Business cancels its account, its data will be deleted from our production systems within 90 days, unless the law requires its retention.

Client Portal account data is kept for as long as the account exists. When the person deletes it from their portal, their sign-in account is erased and the link to their records is undone immediately. The records themselves (their history and their vouchers) belong to the business and are kept according to its policies and legal obligations: deleting the sign-in account is not the same as exercising the right to erasure with the business.

Both Businesses and End Users can exercise their rights of access, rectification, erasure, opposition, limitation of processing, and portability.

• If you are a Business (our Client): You can exercise your rights by contacting us directly at info@agendalotodo.com.
• If you are an End User (a client of a Business): You must direct your request to the Business with which you booked the appointment, as it is the Data Controller of your data. We will cooperate with the Business to address your request.
• If you also have a Client Portal account: for that account's data (your sign-in email, your language and your notification preferences) we are the Controller. You can view, rectify and delete the account yourself, at any time and from the portal itself, or write to us at info@agendalotodo.com. For the rest of your information (history, vouchers, documents) the Business remains the Controller.

You also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing of your data does not comply with the regulations.

You can withdraw your consent to the measurement of our advertising (section 7) at any time from the cookie notice or by writing to info@agendalotodo.com.

We implement technical and organizational security measures to protect personal data against accidental or unlawful destruction, loss, or alteration, and against unauthorized disclosure or access. This includes encryption of data in transit and at rest, and access controls.

If a public authority (law enforcement, a court or an official body) requests personal data from us, we follow a written procedure before disclosing anything.

• We verify the request is legitimate: who signs it, under which legal provision, and whether it requires judicial authorisation. A request with no identifiable legal basis is not fulfilled: we ask for it to be corrected.
• We disclose the strict minimum: only the fields and the time period requested. We never hand over database copies, credentials or account access.
• We keep a record of every request, including the ones we refuse.
• If the data requested belongs to an End User (a customer or patient of a Business), the Data Controller is that Business, not us: we refer the request to the Business and inform them without delay, unless the order itself expressly forbids it.

We reserve the right to modify this policy to adapt it to new legislative or jurisprudential developments. Any changes will be notified to our Clients via email or through a notice on the platform.

If you have any questions or concerns about how we process your personal data, do not hesitate to contact us at info@agendalotodo.com.