Bienarothe system for salons and wellness

Privacy Policy

In plain language: what data the Bienaro platform processes, why, and what rights you have.

Version 1.0, effective from 5 October 2026. We will publish changes to this policy on this page; we will also notify businesses of material changes by e-mail.

Who we are

The operator of the Bienaro platform is Toucan Labs s.r.o., IČO (company identification number) 29931631, with its registered office at Husova tř. 1822/6, 370 01 České Budějovice. Contact for everything relating to personal data: info@toucan-labs.cz. We have not designated a data protection officer – we do not meet the conditions of Article 37 GDPR; we repeat this assessment as the platform grows.

Two roles – whom to contact

Bienaro acts in two roles, and who handles your request depends on which one applies:

  • Are you a client of a business (you booked an appointment)? The controller of your data is the business concerned – Bienaro is its processor and processes the data only on its instructions (data processing agreement). Please direct a request for access, rectification or erasure to your business; we will help it with everything technical. The same applies to a review you write for a business: it is displayed on the business’s website and – without your name or initials and without the business’s reply – also on the business’s verification profile on bienaro.com and in the embeddable “Reviews” widget, which the business can place on another website; here too the controller is the business (see “Reviews and the business’s verification profile” below). There is a single exception, and for it we are the controller: the client account that you set up yourself – see “Client account My appointments” below. The record of not showing up for an appointment is data of the business (see “Not showing up for an appointment”).
  • Are you the owner of a business with an account on Bienaro? For data about your account, invoicing and support, Bienaro is the controller – write to us directly.

What data we process

  • Clients of businesses: name, phone number or e-mail address, booking details (service, appointment, optional note), the status of consents and refusals towards the business concerned, any review linked to a completed online booking (it is published on the business’s website and, without your name, also on the business’s verification profile on bienaro.com and in the embeddable “Reviews” widget, see below), the entry on the waiting list if you have us watch for a freed-up or earlier appointment for you, and a one-time verification code if a business that accepts online bookings only from regular and invited clients verifies you before booking. The purpose is handling the booking and the related communication – confirmation, appointment reminder and notice of a change or cancellation; we send the reminder by e-mail if you provided one, and for a business on the Rytmus plan an SMS may also come to the number you provided; if you have no e-mail address with the booking, the booking confirmation also comes by SMS. An offer of an appointment freed up at the last minute is sent only with your consent, which you can withdraw at any time; the message when it is time for your next visit is sent by the business as an offer of its own similar services under Section 7(3) of Act No. 480/2004 Coll. (the Czech Act on Certain Information Society Services), and you can refuse it already at the booking form. We record each grant and each refusal with the time and the version of the text.
  • Owners of businesses and members of their teams: e-mail address, name, securely stored password (and, optionally, two-factor authentication), details of the business and invoicing, messages to support, invitations to sign in; and only if you switch them on yourself: the phone number for the sign-in code by SMS, the public key of the passkey and the subscription to notifications on your phone (the subscription address in the browser). The legal basis is the performance of the contract for the use of the platform (Article 6(1)(b) GDPR), for invoicing a legal obligation (point (c)) and for security logs our legitimate interest in protecting the accounts and the operation of the platform (point (f)). If you ask the help in the administration, we keep operational figures for 90 days (response time, model and usage, topics used, status and lengths; plus an internal account identifier used only to count distinct users) – since 8 October 2026 we have not stored the text of the question or the answer; this is our legitimate interest in operating the service and keeping its costs under control (point (f)), details on the page AI at Bienaro. We send the address of the premises to a map service in order to find its coordinates and render the map – it is information intended for publication on the business’s website, but for a sole trader it is often the same as the home address, which is why we mention it separately (see “Where the data is stored and who helps us” below). And if a team member switches on the subscription to their personal calendar, we process the times of events from it – we do not read or store the title, description, location or attendees of an event; we keep the subscription address encrypted. The basis for the blocks in the calendar is the business’s legitimate interest in its operations (Article 6(1)(f) GDPR), and the subscription can be removed at any time with a single button.
  • Visitors to the websites: no tracking cookies and no profiling – see below. So that we know where people fail to complete a booking, we anonymously measure individual steps (for example “time selected” or “left the form after entering the phone number”) and where you came to the website from (the address of the referring website without the path and the link parameters, for example utm_source) – without cookies, without storing anything on your device, without the IP address and without the data entered: we store only which field you filled in, never what it contained. The legal basis is our legitimate interest in the booking being possible to complete (Article 6(1)(f) GDPR). The source of your visit (for example “Instagram” or the name of a campaign) is also stored with a booking you complete on the website, so that the business can see where people book from; this is the legitimate interest of the business as controller (point (f)), with no additional identifier of you. We delete the records after 90 days, and we respect the “Global Privacy Control” signal – with it, nothing is sent. We keep security logs (e.g. the IP address for important actions) to protect against misuse for 365 days.
  • We do not collect health data or other sensitive data in a structured way – please do not enter it in the booking note either.

Not showing up for an appointment

If you do not show up for a booked appointment without cancelling, the business may mark this on your booking. This record is kept only by the business concerned – other businesses on Bienaro cannot see it, and we do not keep a summary across businesses. The controller is the business; we process the record as its processor. After repeated no-shows, the business may restrict your ability to book with it online. You can still book by phone or in person. The restriction lifts automatically after 12 months in which no further no-show occurs, and the business can reverse an incorrect mark up to 24 hours after the end of the appointment. Please direct a request or objection to the business; we will help it deal with it.

Client account “My appointments”

At bienaro.com/moje you have the “My appointments” overview: your appointments with businesses on Bienaro in one place. You sign in with the phone number you use when booking and a code that we send to it by SMS. On your first sign-in, we will ask you to agree to the account rules (they are part of this chapter); only this agreement creates the account. The code is sent only to a number that you have with one of the businesses on Bienaro. The SMS with the code is sent and paid for by Bienaro, not by the business, and this applies to businesses on every plan. You do not need an e-mail address for the account.

Which appointments you will see. For a business with which you booked online yourself, you will see all your appointments. An appointment that the business entered for you itself (for example after a phone call, by import or through a connected program) and that you have not yet confirmed, you will see only as the question “Is this your appointment?” with the name of the business, the day and the time – without the service and without notes. If you answer “Yes”, you will see all your appointments with that business, including past ones. If you answer that you do not recognise the appointment, the question disappears and we let the business know that the number probably contains a typo – without any data about you or about who answered. We store your answer with the time.

Other ways into the account. You can also sign in to an account already created in other ways, but you always enter your phone number: with a password that you set up in the account settings, with a code sent by e-mail if your account has an e-mail address that you added and verified yourself, or with a passkey (see below). We send the code by e-mail only to such addresses; an address that a business keeps about you or that you gave when booking is not sufficient for signing in. Creating the account and changing sensitive settings in it (password, passkey, e-mail addresses, signing out of all devices) is possible only immediately after signing in with a code sent by SMS.

Remembered device. When signing in, you can tick “Remember this device for a year”: the sign-in then lasts one year in this browser; without the tick, only until you close it. After signing in with a passkey, it lasts 30 days. It is held by a functional cookie that is necessary for what you yourself asked for, not for tracking; it carries only a signed identifier of your client card and sign-in details. Signing out removes it. Changing or removing the password, deleting a passkey, removing an e-mail address and the “Sign out on all devices” button also sign out all other devices.

Passkey. Immediately after signing in with a code sent by SMS, you can create a passkey in the account settings and then sign in with your fingerprint, your face or your device PIN. For this we store only the public key, the key identifier, a usage counter (it helps detect a copied key), the key type, when you created it and last used it, and a label if you enter one. The private key never leaves your device, and we do not have it; the stored data cannot be used to sign in. During sign-in, a short-lived functional cookie carries a one-time challenge. If you lose your device, you sign in with your phone number and a code sent by SMS; you can remove the old passkey in the settings. Deleting the account also deletes all its passkeys.

Password and two-factor authentication. You set up a password in the account settings immediately after signing in with a code sent by SMS; the username is your phone number. It must have at least 10 characters, and we reject the most commonly used passwords. We do not store the password itself, only its hash (scrypt with a random salt), from which the password cannot be recovered. After five wrong attempts from one connection, signing in with the password is stopped for 15 minutes; after 20 wrong attempts in total, it is locked for everyone for the same time (except in a browser in which you have already signed in); we therefore also store the number of failed attempts and the time of the lock. The code sent by SMS keeps working. A forgotten password is not restored via an e-mail link: you sign in with a code sent by SMS and set a new password in the account. Accounts that previously switched on two-factor authentication with a code from an app continue to enter it after the password and after the code sent by e-mail; we store the secret key from which the app calculates the codes encrypted, together with when you switched the authentication on. It can no longer be newly set up. You can remove the password and two-factor authentication in the settings; deleting the account deletes both.

We are the controller of the account data, as the operator of the platform. The legal basis is the performance of the contract with you (Article 6(1)(b) GDPR) – you asked for the account yourself, and it cannot be kept without this data. The code sent by SMS is necessary so that nobody who does not have your phone in their hand can get to your appointments; the password and the code sent to the verified e-mail address are only further ways into an account you have already created.

  • What data: phone number, when you last verified it with a code sent by SMS, verified e-mail addresses and when you verified them, when you last signed in, when you accepted the account rules, and, for individual businesses, your answer to the question “Is this your appointment?” (when you confirmed or rejected the appointment); if you have a passkey, its public key and the data described above; if you have a password, its hash, when you set it and the counter of wrong attempts; if you use two-factor authentication, its encrypted secret key. For codes we store only their hash (not the code itself), to whom and when they were sent and how many attempts there were, and for the SMS with the code a record of when it was sent (without the text of the message). We only display bookings in the account – they are the same data that the business concerned has; nothing new is created in the process.
  • What we do not do: we do not use the account data for marketing, we do not offer you to other businesses, we do not profile you and we do not link bookings with different businesses other than in your account.
  • To whom we pass the data: hosting (Hetzner, Germany), e-mail sending (Scaleway, France) and SMS sending (GoSMS, Czech Republic) – only to the extent necessary to deliver the code or a notification.
  • How long: until you delete the account with the button directly in the account; otherwise at most until your client card is anonymised after 3 years without a booking. We delete records of codes after 30 days and the record of a sent SMS after 3 years. We keep messages that you send us from the account until they are dealt with and then for at most 2 years.
  • Your rights: you have access directly in the account – you can see your phone number, the verified addresses and your bookings there; we will send a full extract, including the times of verifications and sign-ins, on request. You carry out erasure with the “Delete account” button; the account is deleted, not your bookings with the businesses. For other requests (rectification, portability and others), write to info@toucan-labs.cz.

Have you changed your phone number? Tell the business you go to: the business will ask us to change the number on your client card, and we will make the change. Or write to us from the account via “Write to us”: we will verify the request with the business and change the number on your client card. We will send an SMS about the change to the original number. You then sign in to the account with the new number. We keep the message that you send us from the account (the question or request, the e-mail address for the reply and, for a request, both numbers) until it is dealt with – we close an unresolved request after 90 days – and then for at most 2 years; if you delete the account, we make the data in it unreadable.

What the business sees. It does not see your account, nor your appointments with other businesses. If you answer that you do not recognise an appointment entered by the business, it sees only a notice of a possible typo in the number. Bookings with the business stay with it even if you delete the account; the business, as the controller, continues to decide about them.

What messages we send to clients

A client of a business may receive four kinds of messages from us on behalf of the business:

  • Booking messages – confirmation, notice of a change or cancellation of the appointment, and a reminder if the business sends one. They are part of the agreed service, which is why you cannot unsubscribe from them; they are sent to the e-mail address the client gave and, for a business on the Rytmus plan that has switched SMS on, also by SMS (the confirmation only if the client did not give an e-mail address).
  • Appointment watch – an offer of an earlier appointment or of a place freed up from the waiting list. Only at the client’s express request; it ends with the appointment, with the end of the chosen time range, or via the link in each message.
  • Next visit offer – a message when, according to the client’s usual interval between visits, it is time to come again. Only the business’s own similar services under Section 7(3) of Act No. 480/2004 Coll. (the Czech Act on Certain Information Society Services); it can be refused already when booking and via the link in each message.
  • Offers of free slots – an appointment freed up at the last minute. Only with the client’s consent, which can be withdrawn at any time via the link in each message.

Reviews and the business’s verification profile

A review can be written only by a client whose online booking with the business ended as completed, and it is published with the client’s consent, which they give by submitting the form after reading on it where the review will appear. On the business’s website it is displayed with the rating, text, date and first name, or only initials if the author chooses so in the form. If the business has the “Reviews” section switched on on its website (a business that only manages bookings with us: publishing of individual reviews in the administration), the text of the review is displayed on the business’s website and on the reviews page on Bienaro – the business’s verification profile at bienaro.com/overit/…, which shows all of its published reviews, newest first, with the full text and the exact date of the review, without the author’s name or initials and without the business’s reply. In addition, the business can place the “Reviews” widget on another website, with a summary, the three most recent reviews with the text (the widget shortens longer texts) and the exact date, and a link to all reviews – also without the name and without the business’s reply. “Without a name” does not mean anonymous: whatever you write in the text is visible wherever the review is displayed, including any names you mention in it. The controller of the data in the review is the business; Bienaro is its processor and keeps the profile and the widget on its instructions (Article 2 of the data processing agreement). If the business switches off the “Reviews” section on its website, the reviews also disappear from the profile and from the widget; the average and the number of ratings remain on the profile. You can withdraw your consent to publication at any time by requesting removal of the review from the business or from us at info@toucan-labs.cz – the review then disappears from the business’s website, from the profile and from the widget at the same time; we do not currently offer separate removal from the profile only. This does not affect the lawfulness of the publication before the withdrawal. The reasons for which we ourselves hide or remove a review, and how to report an objectionable review (also using the Nahlásit hodnocení (“Report review”) link below the list on the verification profile, which opens a contact form), are described on the page How reviews work.

Cookies

We use only cookies that are necessary for operation or that the user has expressly requested: the sign-in session (owners of businesses, 7 days), the saved choice of language of the Bienaro website (“bienaro_landing_locale”), the choice of administration language (“bienaro_admin_locale”) and the switched-on Work mode (“bienaro_admin_focus”) – all three are set only after you click the switch and last one year –, the sign-in to the client account “My appointments” (“bienaro_account” – until the browser is closed; with “Remember this device” ticked, one year; after signing in with a passkey, 30 days), short-lived cookies of a sign-in to the account in progress (the prompt for the code or passkey, the phone number entered; at most 15 minutes), “bienaro_account_z” (2 hours; the business from whose website you came to the overview), “bienaro_account_known” (one year; it recognises a browser in which you have already signed in, so that other people’s password attempts do not lock you out – it remains even after signing out and does not sign you in anywhere), “bn_lang_prompt” (one year; it remembers that you closed the offer of another language), in the administration “bienaro_admin_menu_tip” (one year; a closed tip) and a short-lived password confirmation (“bienaro_reauth”, 5 minutes), and technical cookies protecting against spam and attacks (Cloudflare). Account cookies are created only after an action of yours. In addition, the browser remembers in its local storage the expanded parts of the administration and the business setup wizard in progress; nothing is sent from it to the server. All of them fall under the exemption from consent under Section 89(3) of Act No. 127/2005 Coll. (the Czech Electronic Communications Act). We do not use any analytics or marketing cookies on bienaro.com – which is why you will not find a cookie banner here. Should this change in the future, the consent banner will be added before the first measurement cookie.

Business websites set only cookies that you request yourself: if a business offers bookings only to regular and invited clients, the verification by code in progress (“bienaro_otp_…”, 15 minutes), the verification created after it (“bienaro_client_…”, 30 days), and access to bookings by password or secret link (“bienaro_invite_…”, 30 days), and “bn_lang_prompt” (one year) if you close the offer of another language of the website. All of them are created only after an action of yours – merely browsing the website sets none of them. The browser remembers a booking you have started in its local storage until the tab is closed, so that you do not lose it when you return to the page, and it also remembers a closed announcement strip; nothing is sent from it to the server. The booking form is protected against bots by the Cloudflare Turnstile service; when booking, your browser therefore connects to Cloudflare, which processes the IP address and technical details of the browser. If a business switches on visitor measurement or advertising, its website will show you a consent banner; your choice is saved in the cookie “bienaro_consent_…” (12 months), and the tools (Google Analytics 4, Meta Pixel – only on the business’s own domain – and Sklik) are loaded only after consent; their cookies apply only to the address of that website, not to other businesses on Bienaro. If the business also switches on server-side conversions for Meta, then, after your consent to marketing, once a booking is completed it passes Meta from the server a record of the booking with a hash of your phone number and e-mail, your IP address and browser details – the business is the controller for this and we are its processor. The tools are listed by name, together with who operates them, on the “Business information” page of the website concerned, where the choice can be changed at any time.

Where the data is stored and who helps us

  • booking database and backups: Hetzner, Germany (EU),
  • e-mails: Scaleway, France (EU),
  • errors and diagnostics: Sentry in the EU data region – error reports are also sent from your browser; we clean the content of the reports so that they contain no personal data, and the IP address is processed during transmission,
  • network traffic and protection (DNS, encrypted connection, protection of forms against spam and attacks): Cloudflare – global network; processes the IP address and technical details of the request,
  • AI – website texts, their translations and help in the administration: Anthropic (USA) – we send the business’s information and texts (name, field, city, services, texts of the website, price list and frequently asked questions, the text of a public page entered for import) and the question you ask the help; they may contain names of people, for example the owner or team members. We send nothing from the records of clients and bookings; details on the page AI at Bienaro.
  • map and address search for the premises: Mapy.cz (Seznam.cz, a.s., Czech Republic) and, as a fallback, Nominatim and map tiles (OpenStreetMap Foundation, United Kingdom) – we send only the address and the name of the business, possibly the coordinates of the map section, never client data. If the operator of the business inserts a link to their listing on Mapy.cz in shortened form, we check once, when it is saved, where it leads – only the code from the link is sent,
  • delivery of notifications to the phones of owners and staff: browser push services (Google, Apple, Mozilla) – they receive only the subscription address and content encrypted with the keys of your device, which they cannot read themselves; the subscription is created exclusively by you switching it on in the administration,
  • SMS sending: GoSMS s.r.o. (Czech Republic) – the sign-in code for account owners, a notice to the owner that the SMS credit has run out (to the account’s verified number), the code for the client account “My appointments” and a notification of a change of its phone number, and on behalf of the business the booking confirmation (if you do not give an e-mail address), appointment reminders and the verification code on the business’s website (phone number and text of the message). We send SMS only to Czech, Slovak and Austrian mobile numbers; we do not send reminders between 21:00 and 8:00. We send messages from businesses to their clients by SMS only for businesses on the Rytmus plan that have switched them on; for the others, the same is sent by e-mail and nothing about them goes to the SMS provider. We send and pay for the code for the client account on every plan.
  • printing and delivery of printed materials: Just Print s.r.o. (Czech Republic) and carriers – they receive the name of the business, the delivery address and a phone number for the courier, and the printer the print data with the business’s details (name, website address, QR code); nothing about your clients. This concerns the welcome kit with the first payment for the Rytmus plan and printed materials that you order,
  • payments for the plan: we read the details of an incoming payment (counter-account and payer’s name, amount, variable symbol) from the statement of our account at Fio banka, a.s. (Czech Republic); we use them to match the payment and to check for misuse of referral rewards,
  • notifying search engines of website changes (the IndexNow protocol): only the addresses of the pages of the business’s website are sent,
  • connecting the business to its other programs (application programming interface and outgoing messages about bookings): only for a business on the Rytmus plan that has requested and set them up with us – booking details, including the client’s name and contact details, then go to the program the business has chosen and for which it is responsible as the controller,
  • registration of a custom domain: the registrar and the domain registry receive the details of the domain holder (registrant) – the name of the business, address, e-mail and phone number – if you request a new domain.

The map on the business’s website tracks nobody. We assemble the map section on our server and send it to the visitor as an image from our address. The client’s browser therefore does not connect to any map service and sends it nothing until the visitor taps. Below the map we offer only links (“Open in: Mapy.cz, Google Maps, Apple Maps”) – there is no embedded third-party map or measurement script on the page, so no cookie is created because of the map and no consent is needed. Tapping a link is the visitor’s choice; only then does the page of the map service concerned open, and its rules apply. We look up the address on the map only when the operator of the business saves or types it in the administration.

We verify the IČO in ARES. When the operator of the business fills in the IČO (company identification number) in the administration, we query it in the public register ARES (Ministry of Finance of the Czech Republic) and fill in from it the name, registered office and the entry in the commercial register. What is sent is a single piece of data – that IČO, nothing about clients. ARES is a public register kept by a public authority, not our supplier, which is why you will not find it in the list above. We keep the response in the server’s memory for one day so that we do not ask unnecessarily.

We do not sell data and never offer the clients of one business to another.

Website preview for business owners

Before we visit a business with an offer, we may prepare a temporary website preview for it. For this we use only the business’s public business details: name, field, address or municipality, the business’s phone number, price list and opening hours, and possibly text from its public website; the texts of the preview are written by artificial intelligence (Anthropic, USA), and Mapy.cz helps find the address. We do not take over the business’s clients’ data or photos from third-party profiles. The preview is at an address that cannot be guessed, search engines do not index it, and it sets no cookies. The legal basis is our legitimate interest in offering the service (Article 6(1)(f) GDPR); for a sole trader, these are their personal data, and they can object to the processing at any time at info@toucan-labs.cz – we will then delete the preview immediately. We delete the content of the preview after its validity ends (24 hours, 72 hours or 7 days, as chosen), earlier on request, or within an hour after the business sets up its website based on it; we keep a record without content (a hash of the link and the times) for a further 30 days.

Codes and referrals

If a business applies an introductory offer code or a referral code, we record which business applied it and when. For a referral code, we additionally store a hash of the IP address from which it was applied (not the address itself), and we compare the login accounts, e-mails, phone numbers, IČO, sign-in IP addresses and payment counter-accounts of the referring and the referred business so that we can detect self-referral. The legal basis is our legitimate interest in preventing misuse of rewards (Article 6(1)(f) GDPR). We delete the hash of the IP address as soon as the referral is settled or rejected, at the latest after 90 days.

Transfers outside the EU. Nominatim is operated by the OpenStreetMap Foundation in the United Kingdom, for which the European Commission has adopted an adequacy decision; only the address of the premises is sent to it. Cloudflare, Sentry, Anthropic and the push services of Google, Apple and Mozilla have their registered offices in the USA. The transfer relies on the standard contractual clauses of the European Commission or, where applicable, on an adequacy decision (the EU-U.S. Data Privacy Framework), supplemented by a limitation of the scope of the data transferred: Cloudflare processes traffic data (IP address, request headers), Sentry only technical errors without personal data in the EU data region, Anthropic the business’s information and texts and questions asked of the help (which may contain names of people) and the text of a public page during import, and the push services only the subscription address and encrypted content that they cannot read. We will provide documentation of the mechanisms used and the assessment of the impact of the transfer on request.

How long we keep data

  • client data: 3 years from the last appointment that was not cancelled (for a client without a booking, from the entry in the business’s records) – then the business loses access to the card, and we anonymise the data as soon as no other business keeps it; for that period the client’s relationship with the business continues,
  • data of clients of a deleted business who are kept neither by another business nor in a client account: we anonymise it when the business is deleted,
  • record of messages to clients (reminders, review requests, offers, SMS – when, which message and through which channel; without the text of the message): 3 years,
  • technical record of e-mail delivery (address, type of e-mail and delivery status; without content): 12 months,
  • clients’ sign-in codes: 30 days (the code itself is valid for 15 minutes),
  • client account “My appointments”: until you delete the account, at most until the client card is anonymised (3 years without a booking); passkeys, the password hash and the two-factor authentication key together with the account, or earlier if you remove them; codes for the account 30 days,
  • entry on the waiting list: for the duration of the chosen time range and a further 30 days after it is dealt with,
  • messages sent to an interface chosen by the business: 30 days,
  • restriction of online bookings after a no-show: 12 months from the last no-show,
  • subscription to notifications on the phone: until switched off, at most 90 days after the first unsuccessful delivery,
  • record of consents and refusals: it is kept separately for each business and we keep it until the client’s data is anonymised, at most until the business is deleted – proof of consent must not disappear before the consent itself, and a refusal must remain in effect,
  • records of steps in the application (product measurement, without identifying a person): 90 days, then they are deleted without any summary,
  • messages to support: 2 years from closing,
  • security logs (including the IP address for important actions): 365 days,
  • audit log of changes in the administration: 3 years,
  • operational events: 3 years, then only a monthly summary without any link to a person,
  • a prepared client export: the download link is valid for 7 days,
  • website preview for business owners: for the duration of its validity (at most 7 days), a record without content 30 days,
  • hash of the IP address for a referral code: until the referral is settled, at most 90 days,
  • server image backups at the hosting provider: 7 days,
  • invoicing documents: for the period required by law,
  • sign-in session: 7 days,
  • cancelled account or business: 14 days to reconsider if you cancel it yourself in the administration, otherwise no later than 30 days from the end of the contract; the cancellation can be reversed until the period ends, after which anonymisation follows – details on the page Account deletion.

Your rights

You have the right of access to your data, to rectification, erasure, data portability, restriction of processing, to object, and to withdraw consent at any time; the withdrawal does not affect the lawfulness of processing before the withdrawal. We handle requests free of charge and without undue delay, no later than one month from receipt; in complex cases the period may be extended by a further two months, of which we will inform you. There is no automated decision-making that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). If you are not satisfied, you can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

If you are a client of a business, please direct a request concerning data about your bookings to the business as the controller – as its processor, we will assist it under the data processing agreement. If you contact us by mistake, we will pass the request on to the business without undue delay and let you know. The exception is your client account “My appointments”, for which we are the controller: you delete it yourself in the account settings; for other requests concerning it, write to info@toucan-labs.cz. Deleting the account does not delete the bookings with the businesses (see “Client account My appointments”).

Do you have an account on Bienaro? You cancel the account and the business yourself in the administration – the procedure, the period to reconsider and an overview of what is deleted and what remains by law are on the page Account deletion.

Questions: info@toucan-labs.cz · Data processing agreement · AI at Bienaro · Account deletion · back to the home page