This English text is a translation provided for convenience. The Estonian version of this document is authoritative; in case of any discrepancy, the Estonian text prevails.
Broneerimine.ee is booking software: businesses (salons, clinics, studios and other service providers) manage their calendar, client base and bookings here, and their clients can book an appointment.
The purpose of this document is to explain which personal data is processed when the service is used, who is responsible for it, who it is passed on to, and what your rights are. We follow the General Data Protection Regulation (GDPR).
The legal operator of the service — referred to in this text as "the platform operator" — is Pintek OÜ (registry code 14174956, address Savi 7, Pärnu), e-mail info@broneerimine.ee.
Responsibility is split between two parties, and the difference matters:
Technically, each business's data is separated from every other business's: each record belongs to one business and is accessible only to that business's users.
If you are a client who has booked an appointment with a business, that business is the first address for questions about your data. The platform operator then acts on the business's instructions.
The business's own analytics and advertising tools. A business may have us load its own Google Analytics and Meta Pixel on its booking page and website. They run only after the visitor agrees in the cookie notice on the business's page; nothing is loaded before that. The business is the controller of the data these tools collect and answers questions about that data. Consent can be withdrawn with the “Cookie settings” link at the bottom of the business's page. This choice is separate from your cookie choice on broneerimine.ee's own pages.
If you register as a user yourself in order to run your own business here, the platform operator is the controller of your own account data.
If you submit the broneerimine.ee contact form or describe an integration you need, the platform operator is the controller of that enquiry data. We use the data to answer your enquiry and assess the scope of possible work.
Legal basis for contact-form enquiries. If you request a quote or other steps towards a possible contract on your own behalf, we process the enquiry data under Article 6(1)(b) GDPR in order to take steps at your request before entering into a contract. If you act on behalf of a business or send another type of question, the basis is Article 6(1)(f) GDPR: our legitimate interest in answering messages addressed to us, assessing possible cooperation and keeping the business correspondence needed for that purpose. You have the right to object to processing based on legitimate interests.
Business users. For a user account we process: name, e-mail address, phone number and password (stored only as a hash). If you sign in with a Google or Facebook account, we receive from that service the data needed to identify your account.
Mobile app. If you use the Broneerimine mobile app to run your business, we also process device data: a random identifier created for each installation of the app, the platform (Android or iOS), the app version, the language and the time of last use. If you allow notifications, we also process the device's notification token, which we store encrypted. When you sign in or out, we record the event, the time and the IP address in a security log; after a failed sign-in, also the e-mail address that was entered. The biometric lock (fingerprint or Face ID) works only on your device: we do not receive or store biometric data.
Contact forms. When you send us a message, we process your name, contact details, business name and message. To assess an integration, we may also ask for your field of activity, the device or system provider and model, the number of locations and rooms, doors or units, the setup status, and the workflow you need. Do not enter API keys, access codes or passwords in the form.
Businesses' clients. A business may hold the following data on its client card: name, date of birth, phone number, e-mail address, language preference, consents for receiving SMS and e-mail notifications, and free-text notes.
For a booking we process: the client, the employee serving them, the service, the time and status, and the booking's notes.
A business can also add its own questions to the booking form. Their content is determined by the business itself, so we cannot list them exhaustively here — they may contain any data the business considers necessary for providing its service. The choice of questions and their lawfulness are for the controller, i.e. the business, to decide.
The client card's notes field holds up to 10,000 characters of free text about a named, identifiable person. Depending on the field of activity, a business may also write data there that is a special category under the GDPR — health data, for example.
What is written there, and on what legal basis, is decided by the business as controller; the platform operator does not use or analyse that content. The data processing agreement between businesses and the platform operator is a separate document and does not form part of this privacy policy.
We use the following sub-processors to provide the service:
Beyond these, we do not share personal data with third parties, except where the law requires it.
We state plainly here what the system does today:
The database copy of contact-form and integration-enquiry data is deleted automatically no later than 12 months after submission. The enquiry is also sent to the platform operator's e-mail address. That copy is kept for as long as needed to answer the enquiry, assess the work, or resolve a possible dispute; the mailbox does not share the database's automatic 12-month deletion.
The system also deletes automatically:
When you ask us to close an account or to delete data for good (see below), we delete the data within 30 days of receiving the request. Only data that the law requires us to keep remains.
You have the right to find out which data about you is processed, to receive a copy of it, to demand correction of inaccurate data, to restrict processing, to object to processing and to demand erasure of your data.
If your data is processed by a business whose client you are, contact that business first — it is the controller. The platform operator helps the business fulfil the request.
You also have the right to contact the Estonian Data Protection Inspectorate (www.aki.ee).
A deletion request can be submitted by e-mail. Write to info@broneerimine.ee. We respond to a request within ten working days at the latest.
In the Broneerimine mobile app you can also request deletion of your account in the app itself: More → Account & security → Delete account.
The scope of deletion depends on who the controller is — a fuller explanation is on the Data deletion page.
We use Google Analytics on the broneerimine.ee website, the schedule generator and the business admin. It shows us which pages are viewed, where visitors come from (a search engine, for example) and how many of them create an account. We use this to improve the website's content and ease of use.
Google Analytics collects the pages viewed, the time and duration of the visit, the domain of the previous website, browser and device details (for example the browser version and device model), and the approximate location to city level. Of the page address we send only the path, not the query parameters — so the e-mail address in a password reset link, for example, never reaches Google. From the business admin we send the page pattern (for example /clients/:slug), not the address of a specific client or booking, together with the business's short name from the address. We do not send your name, e-mail address or user ID to Google.
Google Analytics keeps data on individual visits for 14 months; aggregate statistics are kept longer. Google Signals and ad personalisation are turned off.
We do not use Google Analytics on businesses' booking pages, websites, the booking widget or the mobile app. A business may use its own analytics and advertising tools on its booking page and website; see “Who is responsible for your data”.
The legal basis is our legitimate interest in understanding how the website is used (Article 6(1)(f) GDPR). Analytics starts when the page opens. If you do not want it, choose “Essential only” in the cookie notice, or change your choice with “Cookie settings” in the site footer. We then stop analytics and delete the analytics cookies. Your choice also applies on later visits.
Essential cookies keep you signed in, remember your language and your cookie choice, and protect forms. Without them, signing in and booking are not possible.
Analytics cookies are set by Google Analytics:
Your cookie choice is stored in the cc_cookie cookie for about 6 months. You can refuse analytics cookies in the cookie notice (“Essential only”) or in the site footer (“Cookie settings”), and we then delete them. Your choice applies on every broneerimine.ee page that uses Google Analytics.
Cookies are small text files that a website stores in your browser. All common browsers allow cookies to be deleted and their use restricted — consult your browser's manual for this.
If we change this privacy policy, we publish the new version on this page.
Questions concerning privacy can be addressed to the platform operator: info@broneerimine.ee.