Bienarothe system for salons and wellness

Data Processing Agreement

Agreement on the processing of personal data under Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR). Your business is the controller of its clients’ data, and Bienaro is its processor. This page sets out exactly what we may do with the data, what we may not do and what we will do for you when a client gets in touch.

Version 1.0, effective from 5 October 2026. We will notify any changes in accordance with Article 14.

1. Contracting parties and conclusion of the agreement

The processor is Toucan Labs s.r.o., company ID (IČO) 29931631, with its registered office at Husova tř. 1822/6, 370 01 České Budějovice, Czech Republic, the operator of the Bienaro platform (hereinafter “Bienaro” or the “processor”). The controller is the business that has set up an account on the platform (hereinafter the “business” or the “controller”).

The agreement is concluded at the moment when the business, during registration, accepts the terms and conditions and this agreement; we record the moment of acceptance in the business’s account. The agreement forms an integral part of the terms and conditions. In matters of processing the personal data of the business’s clients, this agreement takes precedence over the terms and conditions; the privacy policy describes the processing for which Bienaro is the controller and does not amend this agreement.

2. Subject matter, nature and purpose of the processing

The subject matter is the processing of personal data of the business’s clients that Bienaro carries out when providing the platform: operation of the booking calendar and the booking form, the business’s website and the business’s public verification profile on bienaro.com (verified website addresses, a summary of ratings and – if the business has the Reviews section switched on on its website – a list of all published reviews with the text and the date of the review, without the author’s name and without the business’s reply), the embeddable “Reviews” widget, which the business can place on another website (a summary, at most the three most recent published reviews with the text – the widget shortens longer texts – and the date of the review, without the author’s name and without the business’s reply, and a link to all reviews), communication with clients by e-mail and SMS (confirmations, reminders, review requests, offers with consent or on the basis of the existing-customer exemption under Section 7(3) of Act No. 480/2004 Coll., on certain information society services), a waiting list for freed-up slots, the “My appointments” page on the business’s website with a link to the client account, verification of the client by a one-time code on the website of a business that accepts online bookings only from regular and invited clients, records of consents, statistics on the business’s data, data export, and also the application programming interface (API) and outgoing messages (webhooks), which Bienaro makes available at the business’s request and the business then sets up in the administration, and the subscription to a team member’s personal calendar, if the business switches it on in the administration.

The nature of the processing consists in particular of collection, storage, structuring, consultation, use, disclosure to other processors under Article 7, restriction, erasure and anonymisation, carried out predominantly by automated means.

The purpose is the supply of the service under the terms and conditions. Bienaro does not process client data for its own purposes; in particular, it does not use it for marketing, for offering clients to other businesses, for profiling or for training artificial intelligence models; the exceptions to the processor role and the business verification profile, which Bienaro maintains on the instructions of the business, are described in the paragraphs below.

Business verification profile. Bienaro maintains the profile at bienaro.com/overit/… (verified website addresses, a summary of ratings and the page with all reviews) for the duration of the agreement on the instructions of the business given by this agreement and by chapter 7 of the terms and conditions. It serves to let the client verify that the business’s website runs on the platform, and at the same time protects the Bienaro brand and trust in the ratings. Bienaro displays published reviews on it only for as long as the business publishes them on its website (Reviews section switched on), and does so for all of them, with the full text and the date of the review, without the author’s name or initials and without the business’s reply; it does not use them for anything else. On the same instruction, they are also shown by the embeddable “Reviews” widget, which the business places on another website from the administration: at most the three most recent with the text (the widget shortens longer texts), without the author’s name and without the business’s reply, with a link to all reviews. A business that only manages bookings on the platform and has its website elsewhere gives this instruction by switching on the publishing of individual reviews in the administration. The business may withdraw this instruction at any time by switching off the Reviews section on its website, or by switching off the publishing of reviews (Article 5 – settings in the administration); the profile continues to show the average and number of ratings.

No-shows. If the business marks a booking as a no-show, this is the business’s data, and Bienaro processes it as processor for that business; it is not shown to other businesses and no summary across businesses is kept. Any restriction of a client’s online booking is decided by the business on the basis of its own data; the restriction applies only to self-service booking on the website and lapses after 12 months without a further no-show.

Client account. An exception is the account that a client of the business has at bienaro.com/moje (the “My appointments” overview). The client signs in to it with their phone number and a code sent by SMS, which Bienaro sends and pays for; once the account has been created, also with a password or with a code sent to the e-mail address that the client has verified in the account themselves. For the data of this account, Bienaro is the controller on the basis of the contract with the client (Art. 6(1)(b) GDPR). For a business with which the client has booked through the booking form themselves, or at which the client has confirmed an appointment as their own, the account shows the client their bookings; an appointment that the business has entered itself (manually, by import or through the interface) and that the client has not yet confirmed is shown only as a query with the name of the business, the day and the time. The business consents to this display of its bookings to the client. If the client answers that they do not recognise the appointment, Bienaro shows the business a notice about a possible typo in the phone number, without any information about who answered. The “My appointments” page on the business’s website merely links to the account. Bienaro does not use the account data for marketing, for offering clients to other businesses or for profiling. The business sees neither the client’s bookings with other businesses nor the client’s account.

Product measurement. Bienaro anonymously counts the steps of the booking form (for example “selected a time” or “left the form”) so that it can improve it. This is Bienaro’s own purpose, not processing for the business, and it does not reach clients’ personal data: no cookie or other identifier is stored on the device, and neither the IP address nor the content of completed fields is stored – only which field was completed. The records expire after 90 days. We respect the “Global Privacy Control” signal; when it is present, nothing is sent.

3. Duration of the processing

For the duration of the agreement on the use of the platform and, after it ends, for a further 14 days if the business cancelled the account itself in the administration, otherwise for no more than 30 days (Article 12); the data drops out of the server image backups within a further seven days. Even during the term of the agreement, the retention periods for the individual categories of data apply – in particular three years without a non-cancelled booking for client data – and they are set out in Article 12.

4. Categories of data subjects and type of personal data

The data subjects are the clients of the business (customers who book an appointment with it or who have been served by it) and the members of the business’s team to the extent that the business publishes them on its website.

The type of personal data that is processed:

  • identification and contact data of the client: name, phone number, e-mail,
  • booking data: service, appointment, price, team member, booking status and an optional note from the client (no more than 500 characters),
  • the note and labels that the business keeps about the client itself, the marking of a no-show for an appointment and any restriction of online booking,
  • the status of consents to offers in relation to the business and their history (time of giving or withdrawal and version of the consent text),
  • a log of messages sent (recipient address, template, delivery status; without the content of the message) and the client’s cadence profile (the usual interval between visits),
  • a review linked to a completed visit (rating, optional text, choice of signature – first name or initials – and date of submission),
  • for team members, their name and portrait photo, if the business or the team member uploads one to the business’s website (photos are stripped of EXIF metadata during processing),
  • an entry in the waiting list (requested service, window of days, part of the day, optional note, status and times of the offer; the contact details themselves are kept on the client card),
  • a one-time verification code and the client’s link on the website of a business that accepts online bookings only from regular and invited clients (stored in the database only as a cryptographic hash, valid for 15 minutes),
  • for team members who switch on the subscription to their personal calendar, the times of events from that calendar – the title, description, location and participants of the event are neither read nor stored,
  • the client’s phone number for delivering SMS messages,
  • the source of a booking from the business’s website (link parameters, for example utm_source, the address of the referring website without the path and the type of click from an ad – without a visitor identifier) and, for a business that has switched on server-side conversions for Meta, until the conversion is sent, also the visitor’s IP address and browser details, Meta ad click identifiers and a hash (SHA-256) of their phone number and e-mail (Article 5).

Special categories of personal data under Art. 9 GDPR are not collected by the platform in a structured way, and the platform is not intended for processing them. The business undertakes not to enter them into the system, not even in free-text notes. If it nevertheless enters them, it does so at its own responsibility as controller and is obliged to secure its own legal basis for doing so. For this reason, only the time of an event is ever stored for the personal calendar subscription, never its title.

5. Instructions of the controller

  • Bienaro processes personal data only on documented instructions from the controller. Documented instructions mean this agreement, the terms and conditions, the settings that the business makes in the administration, the data that it enters into the system and written instructions sent to the contact address under Article 15.
  • Bienaro will transfer data to a third country or an international organisation only on the instructions of the controller or where required to do so by Union or Member State law; in such a case, it will inform the controller of that legal requirement in advance, unless that law prohibits it.
  • If Bienaro considers that an instruction infringes the GDPR or other data protection rules, it will immediately inform the controller; until the matter is clarified, it is entitled to suspend the execution of the instruction.
  • Bienaro makes the application programming interface (API) and outgoing messages (webhooks) available on request (the business requests them in the administration under Settings → API and webhooks or by email to support); data leaves through them only for a business that has set them up itself in the administration. If the business issues itself an access key or sets up outgoing messages to an address it chooses itself, this is its instruction to transfer data to the recipient it has chosen. The business as controller is responsible for the choice of such a recipient, for the contract with that recipient, for the legal basis of the transfer (including a transfer outside the European Union if the recipient is established outside it) and for protecting the access key; Bienaro is responsible for sending the message only to the chosen address, signed and over an encrypted connection.
  • If the business switches on server-side conversions for Meta in the administration (under Settings → Measurement and advertising it enters a Conversions API access token and ticks the box with the instruction), this is its instruction to transfer data about bookings from its website to Meta Platforms Ireland Limited, which it has itself chosen as the recipient. Bienaro transfers data only for visitors who have given consent to marketing cookies on the business’s website, and only: the type and time of the booking event, the address of the booking page with the link parameters, the phone number and e-mail in the form of a hash (SHA-256), by which Meta matches the booking to the account that uses this contact, the IP address, information about the browser and click identifiers from Meta ads. It does not transfer the name, note, service or price. The business as controller is responsible for the contract with Meta (acceptance of Meta’s Business Tools Terms, including the joint controller addendum), for the legal basis of the transfer – the visitor’s consent, which Bienaro collects on the business’s behalf through the banner on its website – and for informing visitors, for which Bienaro provides it with the texts of the banner and of the Information page; Bienaro is responsible for sending the data only with consent, only to this extent, over an encrypted connection and only to the account to which the business’s token belongs. It stores the token in encrypted form, and the business can delete it at any time; this immediately ends the transfer.
  • If the business or a member of its team enters the address of a personal calendar for subscribing to blocks, this is an instruction to download from that address. Bienaro stores only the time and identifier of each event; it does not read the title, description, location or participants. The subscription address is stored in the database in encrypted form and is decrypted only by the server-side part of the service.
  • The controller is responsible for the lawfulness of the processing, the accuracy of the data and compliance with the obligation to inform its clients. For this purpose, the platform provides it with the “Business information” page on its website with a default text under Art. 13 GDPR; the controller is responsible for its content and keeping it up to date.

6. Confidentiality

Only persons who need to know the personal data in order to perform this agreement have access to it, and only to the extent necessary. These persons have committed themselves to confidentiality by contract or are under a statutory obligation of confidentiality; the obligation continues even after their cooperation with Bienaro ends. Changes, data exports and support access to the business’s account are recorded in an audit log.

7. Other processors (sub-processors)

The controller grants Bienaro a general authorisation to engage other processors. As at the effective date of this version, they are:

  • Hetzner Online GmbH (Germany) – operation of servers, the database and backups,
  • Scaleway SAS (France) – sending e-mails to the business’s clients,
  • Cloudflare, Inc. (USA, global network) – network protection, DNS, TLS and protection of forms against spam; processes operational data such as the IP address and request headers,
  • Functional Software, Inc. (Sentry) – monitoring of technical errors with EU data residency; we clean the content of reports so that they contain no personal data, and when a report is transmitted from a visitor’s browser, the visitor’s IP address is processed,
  • GoSMS s.r.o. (Czech Republic) – delivery of SMS messages: the sign-in code for the account owner and a notice to the owner that the SMS credit has run out, and, to the business’s clients, booking confirmations (if the client did not give an e-mail address), appointment reminders and the verification code on the business’s website (phone number and message text); SMS are sent only to Czech, Slovak and Austrian mobile numbers; codes for the client account are sent by Bienaro as controller at its own expense, and this is not processing for the business,
  • Google LLC, Apple Inc. and Mozilla Foundation (USA or global network; the delivery address is determined by the account owner’s browser) – delivery of notifications to the phones of the owner and team members; the content of the notifications is encrypted with the device’s keys and the service does not read it.

Anthropic, PBC (USA) is not another processor of clients’ personal data. We pass to the artificial intelligence information about the business and what it offers (name, field, city, services and their descriptions), the texts of the website, price list and frequently asked questions that the business has written and has generated, edited or translated, the text of the public page that the business itself has entered for import, and the question that the owner or a team member asks the help in the administration. These texts may contain names of persons (for example of the owner or team members). Nothing from the records of clients and bookings is sent to the model; please do not write clients’ data into website texts or into questions to the help. This is described in detail on the AI at Bienaro page.

Seznam.cz, a.s. (Mapy.cz) and OpenStreetMap Foundation (Nominatim) are not other processors of clients’ personal data: they receive only the address of the premises, the name of the business and the coordinates of the map section, so that the coordinates can be found and the base map for the business’s website can be rendered. For this processing, Bienaro is the controller, and it is described in the privacy policy. The map image is assembled by Bienaro’s server; the client’s browser does not connect to the map service.

Bienaro has concluded a contract with each other processor that imposes on it obligations corresponding to this agreement. Bienaro is liable to the controller for their activities as if it were carrying out the processing itself.

Changes. Bienaro will notify the controller by e-mail of any intended addition or replacement of another processor at least 30 days in advance. The controller may raise a reasoned objection to the change within the same period. If the objection cannot be resolved, either party may terminate the agreement on the use of the platform with effect from the day on which the change is to take effect; Bienaro will refund the proportionate part of the subscription in accordance with the list in the final chapter of the terms and conditions.

The current list is set out in Annex 1 to this agreement and at bienaro.com/cs/dpa; any change to it is notified in accordance with this Article.

8. Location of data and transfers outside the EU

Clients’ personal data is processed by the following categories of services:

  • booking database and backups – Hetzner, Germany; no transfer outside the EU,
  • e-mails – Scaleway, France; no transfer outside the EU,
  • SMS – GoSMS, Czech Republic; no transfer outside the EU,
  • errors and diagnostics – Sentry in the EU data region; report content without personal data, the IP address when transmitted from the browser; for support interventions from the USA, the standard contractual clauses of the European Commission or the EU-U.S. Data Privacy Framework,
  • network traffic and protection – Cloudflare, global network; operational data (IP address and request headers); standard contractual clauses and the EU-U.S. Data Privacy Framework,
  • phone notifications for the owner and team members – browser push services (Google, Apple, Mozilla), USA or global network; only the delivery address and content encrypted with the device’s keys, which they cannot read; standard contractual clauses or the EU-U.S. Data Privacy Framework.

AI – website texts, translations and help (Anthropic, USA, standard contractual clauses) does not work with the client records: it receives only the business’s information and texts under Article 7, which may contain names of persons. Bienaro does not sell clients’ personal data and never offers the clients of one business to another. Bienaro will provide the controller on request with an overview of the current transfer mechanisms and the assessment of their impact.

9. Security (Art. 32 GDPR)

Taking into account the nature, scope and purpose of the processing and the risks to clients’ rights, Bienaro has implemented in particular the following measures:

  • encryption in transit (TLS),
  • daily server image backups with the hosting provider in Germany, retained for seven days, and a written plan for restoring operation,
  • encryption of the address of a team member’s subscribed personal calendar,
  • protection against automated attacks at network level (WAF and request rate limiting),
  • passwords stored only as a cryptographic hash, optional two-factor authentication and mandatory verification for bulk export of clients,
  • separation of the data of individual businesses and role-based access control; clients’ personal data is not accessible to any other business,
  • an audit log of changes in the administration and to bookings, of data exports and of support access,
  • records of marketing consents with the time of giving or withdrawal and the version of the text, with access only to the extent necessary for operation,
  • restriction of message processing (suspension of communication with a specific client) as a technical tool for exercising the right under Art. 18 GDPR,
  • anonymisation of client data after three years of inactivity.

The measures may evolve; Bienaro must not change them in such a way that the level of protection falls below the level in force when the agreement was concluded.

10. Assistance with clients’ rights (Art. 28(3)(e) GDPR)

A client’s request is handled by the business as controller. Bienaro will provide it with reasonable technical assistance so that it can meet the time limit under Art. 12(3) GDPR, i.e. without undue delay and at the latest within 30 days of receipt of the request:

  • access and data portability (Art. 15 and 20) – self-service export of clients and visit history (for security reasons, it requires two-factor authentication, and the file is ready within 72 hours of the request), or an extract on the instructions of the business,
  • rectification (Art. 16) – editing the client card in the administration; the client’s phone number, which is the key to their client card across businesses and to their account, is changed at the request of the business by Bienaro support, by a person other than the one who submitted the request,
  • erasure (Art. 17) – anonymisation of the client’s data with a single function that covers the client card, the client’s link to the business, notes on bookings, entries in the waiting list, sign-in codes, booking snapshots sent to the interface chosen by the business and the status of consents; the records of consents and refusals are deleted together with the erasure of the entire client card, so that a refusal continues to apply; bookings remain without personal data for the business’s accounting and statistical records. The record of missed visits and the blocking of online booking at the business do not lapse upon erasure: they are based on the legitimate interest of the business, and the block is lifted separately after 12 months without a further no-show,
  • restriction of processing (Art. 18) – suspension of outgoing communication with the client concerned and switching off of consents,
  • objection and withdrawal of consent (Art. 21 and Art. 7(3)) – the unsubscribe link in every marketing message takes effect immediately in relation to the business that sent the message, and is recorded in the records of consents.

If a client contacts Bienaro directly by mistake, we will forward the request to the business without undue delay and inform the client accordingly; we do not handle the request ourselves. An exception is a request by an author to remove their review: Bienaro handles it itself under chapter 7 of the terms and conditions (removal with the reason “at the author’s request”), removes the review from the business’s website, from the verification profile and from the embeddable “Reviews” widget at the same time and notifies the business; this is a general instruction of the controller given by this agreement.

11. Assistance under Art. 32 to 36 and personal data breaches

  • If Bienaro becomes aware of a personal data breach, it will notify the affected businesses without undue delay after becoming aware of it (Art. 33(2)) and will provide them with the information they need for their own notification to the supervisory authority, in particular the nature of the breach, the categories and approximate number of records concerned, the likely consequences and the measures taken.
  • Bienaro will assist with the data protection impact assessment and with prior consultation of the supervisory authority (Art. 35 and 36), where this is required and concerns the processing carried out by the platform.
  • Bienaro maintains records of the categories of processing activities carried out on behalf of the controller (Art. 30(2)) and will make them available to the controller on request.

12. Erasure and return of data after termination

  • After the end of the supply of the service, Bienaro will delete the clients’ personal data or, at the choice of the business, return it; the business must make its choice no later than the end of the cooling-off period under the following point. Return means making the export under Article 10 available – the export therefore needs to be requested at least three days before closing the account.
  • If the business does not make a choice, Bienaro will delete the business’s data, including client data that is held neither by another business nor by a client account, after the cooling-off period has expired: within 14 days if the business cancelled the account itself in the administration, otherwise within 30 days at the latest from the end of the agreement. Until the end of that period, the cancellation can be withdrawn and the data restored.
  • The data drops out of the server image backups at the latest when they expire, i.e. within a further seven days. During this time, the backups are protected as a whole and are not used for any purpose other than restoring operation.
  • The retention rule also applies during the term of the agreement: a client who has had no non-cancelled booking for three years loses their link to the business, their data is anonymised and the business no longer sees it, not even for older bookings.
  • Shorter periods apply to operational records: the record of messages to clients (without the text of the message) three years, the technical record of e-mail delivery 12 months, verification codes 30 days, an entry in the waiting list 30 days after it is dealt with, messages sent to the interface chosen by the business 30 days, the audit log 3 years and the restriction of online booking 12 months from the last no-show.
  • An exception is retention that Bienaro is required to carry out under Union or Member State law (in particular accounting and tax records), and Bienaro’s operational records of the performance of the agreement: the technical record of e-mail delivery (at most 12 months), the audit log (at most 3 years) and communication with support. They are retained only to the extent necessary and for that purpose.

13. Evidence and audits (Art. 28(3)(h) GDPR)

Bienaro will make available to the controller on request the information necessary to demonstrate that it complies with the obligations under this Article. The controller is entitled to carry out an audit or inspection, or to have one carried out by an independent auditor bound by confidentiality, no more than once every 12 months and after notice given at least 30 days in advance; in the event of a suspected security breach or on the instructions of the supervisory authority, also at any other time and at shorter notice.

The audit takes place during working hours, must not disrupt operations disproportionately and must not disclose the data of other businesses or information that would endanger the security of the platform. The costs are borne by the controller, unless the audit demonstrates a material breach of Bienaro’s obligations.

14. Duration, changes and liability

  • The agreement remains in force for the duration of the agreement on the use of the platform. The clauses on confidentiality, erasure and evidence continue to apply after it ends.
  • We will notify changes to this agreement by e-mail at least 30 days before they take effect, sent to the address registered in the business’s account; the notice contains an overview of the changes, the effective date and a link to the new wording. Each version of the agreement bears its number and effective date, and the business’s account records which version the business accepted and when. Until the effective date, the administration displays a notice about the new version. If the business does not agree with a change, it may terminate the agreement on the use of the platform by the effective date; we will refund the proportionate part of the subscription in accordance with the list in the final chapter of the terms and conditions.
  • The liability of the parties is governed by Art. 82 GDPR. The limitation of liability under the terms and conditions does not apply where the law does not permit it, in particular for claims of data subjects and sanctions imposed by the supervisory authority.
  • The agreement is governed by Czech law; it is issued in Czech and the Czech version is binding.

15. Contact

Please send instructions, requests for assistance and notices under this agreement to info@toucan-labs.cz. We use the same address to notify businesses of security breaches. No data protection officer has been designated, as the conditions of Art. 37 GDPR for doing so are not met; we repeat this assessment as the platform grows.

Recommendation on photos of team members

A team member’s photo on the business’s website is that person’s personal data, and the controller is the business as employer or contracting party. We recommend basing publication on the consent of the team member concerned, which can be withdrawn at any time; on the platform, withdrawal is carried out by removing the photo in the profile. Publication can also be based on the legitimate interest in presenting the business, but in that case the team member should be informed in advance and any objection should be upheld. The choice and the evidence for it are in the hands of the business; Bienaro processes the photo only as processor.

Annex 1 – List of other processors as at 5 October 2026

For each processor, the category of service, registered office and country of processing, purpose and scope of data, and the legal basis for the transfer are stated. Any change to the list is notified in accordance with Article 7.

  • Booking database and backups – Hetzner Online GmbH – Germany (Falkenstein), registered office in Gunzenhausen; operation of servers, the database and backups, i.e. all platform data; European Union, no transfer to a third country.
  • E-mails – Scaleway SAS – France (Paris); sending e-mails to the business’s clients: recipient address and message content; European Union, no transfer to a third country.
  • SMS – GoSMS s.r.o. – Czech Republic; delivery of SMS messages: phone number and message text (booking confirmation, appointment reminder, verification code on the business’s website), only to Czech, Slovak and Austrian mobile numbers; Czech Republic, no transfer to a third country. Codes for the client account are sent by Bienaro as controller at its own expense, and this is not processing for the business.
  • Network traffic and protection – Cloudflare, Inc. – USA, operation in a global network with European points of presence; network protection, DNS, TLS, protection of forms against abuse (Turnstile), WAF and request rate limiting; processes operational data – IP address and request headers; adequacy decision under the EU-U.S. Data Privacy Framework, supplemented by the standard contractual clauses of the European Commission under Cloudflare’s data processing agreement.
  • Errors and diagnostics – Functional Software, Inc. (Sentry) – USA, EU data residency; monitoring of technical errors – we clean the content of reports of personal data, and when a report is transmitted from a visitor’s browser, the visitor’s IP address is processed; data residency in the European Union, for support interventions standard contractual clauses or the EU-U.S. Data Privacy Framework under Sentry’s data processing agreement.
  • Phone notifications – Google LLC, Apple Inc., Mozilla Foundation (browser push services) – USA or global network; the delivery address is determined by the account owner’s browser; delivery of notifications to the phones of the owner and team members, the content is encrypted with the device’s keys (RFC 8291) and the service does not read it; standard contractual clauses or the EU-U.S. Data Privacy Framework under the terms of the respective service, scope limited to the delivery address and unreadable content.

Expressly excluded from this list are providers that do not handle the personal data of the business’s clients: Anthropic, PBC (USA; AI – website texts, translations and help in the administration: only the business’s information and texts, which may contain names of persons, the text of the public page that the business itself has entered, and the question asked of the help; standard contractual clauses), Just Print s.r.o. (Czech Republic) and carriers that produce and deliver the welcome kit and ordered printed materials (only the name of the business, the delivery address, a phone number for the courier and print data with the business’s details), Seznam.cz, a.s. and OpenStreetMap Foundation (only the address of the premises, the name of the business and the coordinates of the map section), Google, Apple and Microsoft as the source of a personal calendar (we only query the address chosen by the business; nothing is transferred to them) and ARES (Ministerstvo financí ČR, the Czech Ministry of Finance) – a public register to which only the company ID (IČO) is sent. Also excluded from the list is Meta Platforms Ireland Limited (Ireland) – only for businesses that have switched on server-side conversions for Meta: it is a recipient chosen by the business, not another processor of Bienaro (scope and conditions in Article 5).

Questions: info@toucan-labs.cz · terms and conditions · privacy policy · AI at Bienaro · back to the home page