1. Who is who
When you record your clients, their appointments and their payments in PontoAgendado, it is your business that decides why and what for. That makes your business the controller.
We store and process that data on your behalf, in order to provide the service. We are the processor.
This document is accepted at sign-up and serves as the written contract required by Article 28 of the General Data Protection Regulation.
2. Subject matter, duration and purpose
The subject matter is the processing needed to run your calendar, client records, services performed, internal billing, commissions and online booking.
The duration is that of your subscription, plus the retention period set out in section 8.
The purpose is solely the provision of the service. We do not use this data for our own ends, we do not analyse it for advertising, and we do not share it with anyone.
3. What data and whose
- Data subjects: your business's end clients and the members of your team.
- Client data: name, phone, email, document number when you fill it in, booking history, services performed and amounts paid.
- Staff data: name, contact details, services they perform, commissions and payments.
- Free-text notes: note fields contain whatever you write in them. We recommend not recording health information or other special categories of data without a lawful basis.
4. Your instructions
We process the data only on your documented instructions, which are given through normal use of the service and through written requests you send us.
If an instruction of yours appears to us to infringe the GDPR, we tell you before carrying it out.
If the law requires us to process the data differently, we inform you beforehand, unless the law itself prohibits it.
5. Confidentiality and security
Everyone on our side with access to the data is bound by confidentiality, and that access is limited to what is strictly necessary.
Security measures include encryption in transit, isolation between businesses enforced on the server, token-based authentication, passwords stored only in hashed form, rate limiting and backups.
6. Other processors
You give us general authorisation to use the suppliers below, all of them bound by obligations equivalent to those in this document.
- Supabase: authentication, database and storage of the files you upload.
- Hetzner: application servers, in Germany.
- Vercel: hosting for the website and the dashboard.
- Stripe: subscription payments, with no access to your clients' data.
- Resend: delivery of emails, including the notices sent to your clients.
7. Changes to the list
If we want to add or replace a supplier, we give at least 30 days' notice by email.
If you object on reasonable grounds, we look for an alternative. If there is none, you may cancel the subscription without penalty, with a refund of the unused part of the period already paid.
8. Return and deletion
While the account is active you can export the data at any time from the dashboard.
Once the subscription ends, we keep the data for 30 days so the account can be recovered, and then delete it, including from backups at the next rotation cycle.
If you prefer it deleted immediately, just ask us in writing.
9. Data subject requests and incidents
If one of your clients contacts us directly to exercise their rights, we forward the request to you and do not answer on your behalf, unless you instruct us to.
We give you reasonable assistance in answering those requests and in meeting your obligations on security, impact assessments and prior consultation.
If there is a data breach affecting you, we notify you without undue delay, with the information available to us, so that you can meet the 72-hour deadline towards the supervisory authority.
10. Demonstration and audit
We make available the information needed to demonstrate compliance with these obligations.
With reasonable notice and at most once a year, you may request further information about the security measures in place, unless an incident justifies an extraordinary request.
PontoAgendado
pontoagendado@gmail.com