GDPR Compliance Statement

This GDPR Compliance Statement of SimplyBook.me Ltd explains the key elements of GDPR and how we comply with it.

Click below to read more about specific policies:

  • 개인정보 처리방침

    our approach to privacy, processing of personal data and our measures for security.

    Details
  • Data Processing Agreement

    part of the T&Cs for users, includes a list of sub-processors.

    Details
  • Job Application Privacy Policy

    how we protect the privacy of job applicants.

    Details
  • Cookie Policy

    what cookies we collect & why.

    Details

If you have any questions and want to find our more, contact our dpo@simplybook.me.

Woman with a laptop
What is GDPR image

What is GDPR?

The General Data Protection Regulation 2016/679 (the “GDPR”) is the law of the European Union and the European Economic Area regarding data protection and privacy. The GDPR was implemented on 25.05.2018 and allows EU citizens to better control their personal data while modernising and unifying the rules allowing businesses to reduce red tape and to benefit from greater consumer trust.

Find out more for the data protection and the approach of the European Commission, on their official website

How are we complying with GDPR?

The efforts of SimplyBook.me Ltd to comply with the requirements of the GDPR staterted before its implementation in 2018 by appointing a Data Protection Officer (“DPO”) who together with the security team of the company ensured that among other issues:

  • Internal policies and procedures are drafted, maintained and followed in all business operations
  • The online Terms & Conditions have been reviewed and amended
  • The online Privacy Policy has been reviewed and amended
  • We have prepared a Data Processing Agreement to be concluded between you and SimplyBook.me Ltd, and made it available on our website
  • Additional online policies are made available for users and visitors
  • Our contractual relationships with our suppliers are assessed and additional documentation for privacy and data protection is concluded - the Data Processing Agreements/Addendums.
  • Old suppliers have been scrutinised and some have been dropped just for security’s sake.
  • All members of the company go through a privacy and data protection training server security has been hardened even further.
  • Back up procedures have been changed to minimize personal information storage for deleted systems.

The key steps areas we took in order to ensure compliance with the GDPR:

  • Personal data protection icon

    Restricted access to Personal Data

    - We follow the principle of least privilege in our business operations.

    - For the level of access employees are instructed to use in diagnosing and resolving problems as well as responding to customer support requests.

    - All employees have signed a Data Processing Addendum to the contract of employment and have provided a clean criminal record as part of our hiring process.

    - All employees are legally binding to comply with the internal policies and procedures of the implemented Information Security Management System.

    CUSTOMER SUPPORT REQUESTS: Upon activation of the double authentication feature of the System, we DO NOT have any access to your account and system. However, when you need quick assistance from our support team, you may give our representative a temporary code so they can help them out with settings if needed.

  • HIPAA icon

    Protection of medical information - Patients Details

    Medical information is considered as “sensitive personal data” and it may be stored in the system, in a component called “SOAP”. The SOAP component has now been enhanced to be encoded at rest so that no one can have access to this information, even if they break into the user’s system, or even into SimplyBook.me servers UNLESS they have the secret key. This key can be kept on an USB drive, or in a computer’s folder - but never on the SimplyBook.me servers. Just make sure that the computer is well protected, so that if it is stolen, thieves would not have easy access to the hard disk. Same applies to the USB drive, this can also be encrypted with a code that only you remember.

    HIPAA FEATURE: For users that want to harden security even more, the HIPAA Custom Feature is available to the Standard and Premium Subscriptions. This allows users to set automatic system log out after predefined time, like 20 minutes after the system was being used. It also allows users to get notifications upon each login into the system. Furthermore, this feature disables personal data to be sent over email or SMS, it removes client’s and service names from these notifications, making it harder for snoopers to see personal data.

  • Products promotions icon

    Right to withdraw consent to processing of Personal Data

    All our email communications have included the option to unsubscribe via specific and easy to find links. This has now also been added to the promotions emails so clients that have unsubscribed from getting these messages will not be receiving them. This has though fortunately not been a problem as clients are generally happy to receive promotions from their favorite providers.

How can we help you comply with the GDPR?

As you will have the responsibility to ensure the protection of your clients’ personal data, we have made key changes to our system, in order to make sure you can comply with the GDPR. Specifically, some changes make the security enhanced - and you are better protected in case someone gets hold of their equipment while some other features in the system make the user’s permission for client’s data and communication better. Check illustrations below for more information on this.

We provide 4 Custom Features, free for all:

  • Google authenticator icon

    이중 보안 모듈

    강화된 로그인 보안 시스템을 위한 이중 보안 모듈. 데이터 유출의 대부분의 경우는 누군가 기기를 가상 또는 현실에서 가져가 시스템 및 데이터에 접근하려고하는 것을 의미함으로, 이용자가 이중 보안 모듈을 빠르게 이용할 수 있어야 합니다.

  • Delete history icon

    내역 삭제 모듈

    사용자가 시스템 내에서 예약을 한 데이터 주체에 보관할 기간을 설정할 수 있습니다. 데이터를 보관할 필요가 없는 경우, 이 도구는 예약이 완료된 후 30일 (예: 사용자 설정에 따름) 후에 자동으로 데이터를 삭제합니다. 사용자가 클라이언트 로그인을 설정하고, 멤버십 등을 설정해 놓은 경우, 이 모듈을 사용해서는 안됩니다.

  • Terms and conditions icon

    이용 약관 모듈

    이용자는 데이터 사용 방법에 대해 인간이 해독 가능한 언어 (법적으로는 무효할 수 있음)로 작성된 자신만의 개인 정보 보호정책을 설정할 수 있습니다.

  • Cancellation policy icon

    Cancellation Policy module

    취소 정책에 대한 세부 정보를 지정할 수 있습니다.

Admin interface:
Access to 3 groups of personal data

Personal data

  • 회사 정보

    usually publicly available on the internet in order for clients to be able to book.

  • 시스템 사용자 정보

    고객들이 예약을 위해 선택할 수 있도록 모든 유저들이 볼 수 있도록 인터넷에서 이용 가능

  • 클라이언트 정보

    Never available on the internet for other than system users to see

Each of these groups can access an interface to see and print out all information stored in the SimplyBook.me system. Additionally, upon request, all client details can be deleted with the use of a simple button.

Please note that these records can only be accessed by users after a simple authentication procedure by re-entering the password and if they have double authentication, they will be asked for a verification code to get access.

As client data is often part of statistical information about sales and bookings, the data is not all deleted but made completely unrecognisable but still kept usable for statistic purposes.

Some friendly advice on your compliance with GDPR

  • Enhance your security

    it is recommended for users to harden the security on mobile devices using long passwords, and automatic deletion of phone data when there are several wrong passwords attempts. This will avoid thieves getting hold of double-authentication access code.

    All users should set auto screen lock to decrease the risk of snooping from people that may be browsing the workplace. Here is a link that describes how this can be done on Windows based computers: 4 ways to lock your Windows 10 PC.

  • You as Data Controller

    Remember that you are responsible to draft, maintain and operate in accordance with a privacy policy towards your own clients and no one can make this for you, as this is something you decide. Get professional advice or check your local data protection authority/body on this document and make it in a clear, concise manner.

    Remember to make a link to our Privacy Policy where we illustrate how we process the subject's data on your behalf, and what transfers take place.

처음 SimplyBook.me을 사용하시나요?

SimplyBook.me가 온라인 예약을 관리하는 데 어떤 도움을 주는지 더 알고 싶으신가요? 저희 스케줄링 소프트웨어에 대해 알아 보려면 비디오를 보세요.

Video tutorial illustration 영상 보기 정말 간단합니다.