Privacy Policy

Who is responsible for your data

When you make a booking through this form, your personal data is collected on behalf of the business you are booking with ("the business"). The business is the data controller for the information you submit. SNTB provides the booking platform and processes your data on the business’s behalf as a data processor.

What data we collect

• Your name, phone number and/or email address
• Details of the service, date and time you selected
• Any notes or additional information you choose to provide
• Basic technical data (such as IP address and browser type) needed to operate the booking form securely

Why we collect it

We use this data solely to process your booking request, confirm your appointment, and contact you if needed regarding your visit. We process it on the basis of your consent and, where applicable, in order to take the steps needed to provide the service you requested.

How long we keep it

• Your data is kept only for as long as necessary to fulfil the booking and any related legal or accounting obligations, after which it is deleted or anonymised.
• For recovery after a failure, the booking database is copied every night into encrypted backups stored in the EU. Daily copies are kept for up to 35 days and monthly copies for up to 12 months. Data deleted or anonymised in the booking system remains in these backups until they expire, and they are not used for any other purpose.

Who we share it with

• Your data is not sold or shared with third parties for marketing purposes. It may be shared with service providers who help us operate the booking platform (such as hosting providers), under appropriate confidentiality obligations, or where required by law.
• Staff of the business who handle bookings are notified about your request and its later changes, including messages you send in the booking chat. These notifications contain your name and the details of your request and are delivered in the booking system and, depending on each staff member’s settings, by Telegram or by email to their mailbox.

Sub-processors we use

• Amazon Web Services (AWS SES) — sending confirmation and notification emails. Data is processed in the EU (eu-north-1, Stockholm).
• Amazon Web Services (AWS S3) — storage of uploaded files, including support attachments. Data is stored in the EU (eu-north-1, Stockholm).
• Telegram — optional appointment notifications, only if the business enables them. Telegram operates outside the EU/EEA; such transfers rely on your consent and appropriate safeguards.
• GitLab — publishing pipelines for the websites; processes only organisation/site metadata, not your booking data.

Short links and QR codes

• A business may share short links or QR codes that lead to its booking page or its website. When you open such a link or scan such a code, we record a visitor code calculated one-way from your IP address and browser with a key that changes every day (your IP address cannot be recovered from it), your browser type, the site you came from, your country and whether you came through a QR code. Your IP address itself is not stored. These click records are deleted after 90 days.
• If you then send a booking request, the request records which link led you to it, so that the business can see which of its links bring bookings. We do this on the basis of the business’s legitimate interest in measuring its own links. This information stays with your booking request for as long as the request is kept.

Your rights

• Access your personal data
• Have inaccurate data corrected
• Have your data erased
• Restrict how your data is processed
• Object to the processing of your data
• Receive your data in a portable format
• Withdraw your consent at any time

Exercising your rights and complaints

To exercise any of these rights, contact the business directly using the contact details on their website. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with your local data protection supervisory authority — in Latvia, the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv).

Contact

Questions about this policy, or about how the booking platform itself handles data, can be sent to privacy@sntb.org.