This Privacy Policy describes how Tidy-Book processes personal data in the context of operating tidy-book.com, its relationship with business Customers and the provision of support.
1. Data controller and contact details
Tidy-Book (hereinafter "Tidy-Book" or "we") is the Controller for the personal data we collect and process in the context of operating tidy-book.com, the commercial relationship with business Customers and the provision of support.
Contact email: [email protected] (privacy matters) and [email protected] (technical support).
2. Who this policy applies to
- Business Customers and their administrators/staff users who create an account.
- Visitors to the tidy-book.com website who contact us or use anti-abuse protection mechanisms.
- Important: End Users are entered into the platform by each Customer. For this data the Customer is generally the Controller and Tidy-Book the Processor.
This notice also covers members and instructors for the limited processing we undertake as a separate Controller for billing counts, security and abuse prevention (sections 4 and 6).
3. GDPR roles: When we are Controller and when Processor
3.1 Processor. For end-user, staff and instructor data entered to organise the Customer's services, the Customer is Controller and Tidy-Book is Processor under the DPA. Where receipt/myDATA features are enabled, processing on the Customer's instructions may include transaction details and issued-receipt information such as purchaser name, address and tax information where required. The Customer determines the lawful basis and retention requirements for its own processing.
3.2 Controller. Tidy-Book acts as a separate Controller for processing for its own purposes of managing its contractual relationship, billing its own service, support, security and abuse prevention. A person's status as an administrator or staff member does not make all processing of that person's data Controller processing; the role depends on the particular purpose.
4. What data we process as Controller
- Customer/administrator account details: full name, email, phone, role.
- Contact/support details: request content, attachments, history.
- Subscription/billing details: plan, dates, amounts, invoices.
- Security/technical data: logs, IP, device/browser identifiers.
For Active Member/Instructor counts and billing evidence we process necessary account identifiers, business/role and booking events, subscription status or instructor assignments with dates. For security and abuse prevention we process identifiers, IP addresses, technical events and relevant activity history. These come from the business using TidyBook and service use, rather than public sources. Health information or fiscal-document contents are not needed for billing counts. This limited processing also concerns end users and instructors; it does not make their entire profile our own-purpose data and is not used for advertising.
Optional AI assistance: authorised staffâs questions and submitted history to generate an answer through Google Gemini. The question is also recorded in the activity log with user/business information for support, security and investigating errors, with restricted access and retention only as necessary. Content involving the businessâs data is processed under the Customerâs instructions and DPA. Health data, passwords, card details and unnecessary membersâ data are not requested.
5. End User data we process as Processor
End User data is entered and managed by each Customer. Indicatively it includes: email, full name, username, phone, emergency contact details, bookings, sessions, memberships and history.
If you are an End User and wish to exercise rights (e.g. access/correction/deletion), contact the Customer (gym/venue) that uses Tidy-Book.
6. Purposes and legal bases of processing (as Controller)
- Providing the Service to Customers and managing accounts (performance of a contract).
- Invoicing/accounting and tax obligations (legal obligation).
- Support and communication (performance of a contract or legitimate interest).
- Security, fraud/abuse prevention and reliability improvement (legitimate interest or, where required, compliance with a legal obligation).
- Advertising measurement, conversion attribution, audience creation and advertising personalisation through Google Ads or Meta Pixel (consent, which can be withdrawn at any time).
Limited billing counts and security/abuse prevention rely on our legitimate interests in accurate service billing, resolving measurement disputes and protecting accounts and infrastructure (GDPR article 6(1)(f)), with minimisation, restricted access and balancing against your rights. The business informs people through its channels; for our own-purpose processing we ensure articles 13â14 information is provided, at the latest within a month, at first communication or before first disclosure as applicable, unless a documented lawful exception applies.
Right to object: You may object at any time, on grounds relating to your particular situation, to legitimate-interest processing by contacting [email protected]. We stop unless we demonstrate overriding compelling legitimate grounds or a need for legal claims. Objections to direct marketing are always honoured without that balancing.
7. Sub-processors and recipients
Customer Service providers: Hetzner for hosting in Germany/Finland and backups, Brevo for service email, Google Firebase/FCM and Apple APNs for notifications, and Google Gemini API for optional AI assistance where enabled. Authorised staffâs submitted AI questions and history are sent to Google. TidyBook runs the additional backup process internally, with rolling 30-day retention. Subprocessor additions/replacements follow the DPAâs notice-and-objection procedure.
Payments and public authorities: Stripe receives data when online payments are enabled. Its DPA describes separate Controller processing for its own regulatory, identity, fraud-prevention and payment purposes and Processor activities performed on instructions for particular services. The account contract and configuration determine applicable roles; Stripe is not classified wholly as TidyBookâs subprocessor. AADE receives fiscal/transaction details only when the Customer enables myDATA; it is a public authority, not a subprocessor. Other authorities receive data only on a lawful basis.
Public website: Google Ads/Google Tag and Meta Pixel receive advertising events only with consent. Metaâs Controller Addendum covers joint responsibility for Pixel collection/transmission to the relevant extent; Metaâs subsequent processing is its own. Cloudflare Turnstile protects the demo form. These roles are separate from the Customer-data DPA. Details appear in the Cookie Policy.
8. Transfers outside the EEA
Current main Hetzner hosting locations are Germany and Finland. Where a provider can access personal data from outside the EEA, an applicable adequacy decision or lawful contractual safeguards, such as EU Standard Contractual Clauses, and any necessary additional measures are required. These address lawful transfer/access; SSL/TLS protects communications.
Provider/location information and copies of applicable safeguards are available from [email protected]. The terms and actual configuration of the services used determine the applicable mechanism; not every service is treated as EU-only.
9. Retention period
Business-relationship and support records are kept as needed for the relationship, and afterwards only for documented lawful needs or pending claims. Security/technical logs are kept only as long as needed for their purpose, with restricted access. A daily backup process uses Hetzner and an additional internal TidyBook process. They are kept on a rolling thirty (30) day cycle: each new daily backup replaces the copy from 30 days earlier. Backups are not used for routine operational processing of deleted profiles; recorded deletions are reapplied after a restore.
Deleting a profile does not delete necessary payment and fiscal records. These are retained with restricted access for seven (7) years after completion of the transaction or the last related fiscal action, whichever is later, and longer only where required by law or for specific pending legal proceedings. Only information necessary for the lawful purpose is retained; identifying information remains personal data. On contract termination, the DPAâs return-or-deletion choice applies. Continued archiving on the Customerâs behalf requires a separate instruction, unless the Provider has a specific legal retention obligation of its own.
10. Account deletion and "GDPR Deletion" of End Users
Account deletion removes or de-identifies active profile information. Necessary payment/fiscal records are retained for the limited purpose and seven-year policy in section 9. Backup deletion and data return follow the DPA.
Where optional account closure offers a thirty (30) day withdrawal period, this relates to the closure feature and is not a mandatory waiting period for a GDPR erasure request. Rights requests are handled without undue delay, with information within one month and a lawful extension where the conditions apply. Return, erasure, backup access and lawful retention are governed by the DPA and law.
For rights requests concerning data controlled by a venue, contact that venue; Tidy-Book assists under the DPA. For processing for which Tidy-Book is Controller, contact [email protected]. Any refusal or lawful retention exception must be assessed for the particular request and communicated as required by law.
11. Data subject rights
Depending on our role (Controller or Processor), you may have rights of access, correction, deletion, restriction, portability and objection. For End User data, contact the relevant Customer.
For data where Tidy-Book is the Controller (e.g. administrator account), contact [email protected]. You have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
12. Cookies and similar technologies
We use technically necessary storage to remember cookie choices and security mechanisms, such as Cloudflare Turnstile, to protect the demo form from abuse.
Google Ads/Google Tag and Meta Pixel are optional and remain disabled until you give separate consent through the choice mechanism. If you consent, they are used on the public tidy-book.com marketing site to measure visits and actions such as demo-form submissions, contact clicks or visits to our Instagram profile, and to support conversion attribution, audience creation and advertising personalisation. Google and Meta may process information such as cookie identifiers, IP address, device/browser details, page URL, referrer and interaction events.
The use of Google Ads/Google Tag and Meta Pixel concerns the public marketing site tidy-book.com. The Tidy-Book platform and tenant-specific Customer environments, such as the demo/customer app, do not use these technologies for advertising measurement, unless separate prior consent is requested and obtained.
You can accept, reject or change each choice at any time through âCookie settingsâ in the footer. Details about purposes, providers, cookies and duration are available in the Cookie Policy.
13. Security
We apply technical and organizational security measures, such as access control, event logging, secure password hashing and per-Customer isolation measures where applicable. No method of transmission or storage is 100% secure.
14. Changes to this policy
We publish dated updates to this Privacy Policy on tidy-book.com. We directly notify business Customers of material changes affecting them and provide appropriate information to other affected people, before changed processing where required. A policy update explains processing; it does not itself amend the DPA or supply a new lawful basis.
Continued use does not constitute consent to new processing or optional cookies requiring consent. Where consent is required, it is requested separately and can be withdrawn. Data-subject rights and mandatory protections remain applicable regardless of the version of the Customer's service agreement.
For Customers with an earlier agreement, this update does not change their processing instructions or DPA.