隱私權政策簡要概述

I. 介紹

這是 SimplyBook.me 的隱私權政策，將解釋我們如何在所有的營運業務中，遵守一般資料保護條例 (EU) 2016/679 ( GDPR 個資法規範) 及其他國家＆國際適用的法律和法規。

我們已實施措施和記錄，並符合 GDPR 資法規範認證，因此可以負責處理您的個人資訊。尊重 GDPR 規範的原則（合法性、公平性及透明度、利用目的限制、資料. 最少蒐集、正確性、儲存限制、完整性機密性（安全性）和責任制 ）是我們所有營運業務處理個人數據的重要核心。

II. 與我們有關的資訊

我們是 SimplyBook.me Ltd，提供一套包括促銷和行銷系統、銷售系統以及客戶聯絡系統等多種功能的預約預訂解決方案（統稱為“服務”）。您可以查看我們的使用者條款，其中包含有關我們服務和法律義務的詳細資訊，此外還可在這裡查看我們的資料處理協議概覽及簽署版本。

為了遵守 GDPR 規範，當您造訪我們的官網 www.simplybook.me 及其他由我們營運的子網站時，我們將知會您我們是「資料控管者」，並根據您接受之敝司營運的網站 使用者條款政策(T&C)，對您的個人資料能有其決定權。

對於本文件以及所有隱私和個人數據保護之目的，我們的資訊和聯繫方式如下：

• 公司名稱:

  SIMPLYBOOK.ME LTD

• 聯絡信箱:

  support@simplybook.me & legal@simplybook.me

• 註冊地址:

  Nafpliou 28, Medical Court, Floor 4, Flat/Office 401, 3025, Limassol, Cyprus

• 資安官:

  dpo@simplybook.me

• 公司註冊編號:

  HE387490

• UK 代表:

  UKRepresentative@simplybook.me

III. 我們所蒐集與您有關的資訊

Our Purposes and Legal Basis for Processing

We process your personal data for the following specific, clearly defined purposes:

Detailed Data Categories and Processing Purposes

使用數據

What We Collect: Website interaction data including IP address, geographical location, browser type and version, operating system, referral source, session duration, page views, navigation paths, time stamps, and user interaction patterns.

Data Source: Automatically collected through analytics tracking systems (Google Analytics, internal logging systems).

Specific Processing Purposes:

Analyze which booking pages have highest conversion rates to optimize user experience.

Identify technical issues causing booking abandonment.

Understand geographic distribution of users to optimize server locations.

Track feature usage to prioritize development resources.

Generate performance reports for service provider partners.

Customize language and regional settings based on location data.

Legal Basis: Legitimate interests, meaning monitoring and improving website functionality and user experience.

帳戶資料

What We Collect: Information provided during registration including full name, contact email address, phone number, profile photos, professional bio, service preferences, account settings, and profile customization data.

Data Source: Directly provided by you during account creation or profile updates.

Specific Processing Purposes:

Create and maintain individual user accounts with unique identifiers.

Display service provider profiles to potential clients with accurate contact information.

Enable password reset and account recovery processes.

Customize booking interface based on user preferences and settings.

Facilitate direct communication between service providers and clients.

Generate personalized booking recommendations based on profile information.

Maintain account security through authentication and access controls.

Important Note: This specific information will be available on your booking site, supplied by us, on a widget that may be inserted into the user's own website, on users social media profiles, on our directory sites where all system users are displayed, unless they specifically opt out of being displayed there.

Legal Basis: Contractual obligation and legitimate interests which are necessary for providing booking platform services.

Client Booking Data

What We Collect: Information entered by your clients when making bookings including client name, contact details, appointment preferences, special requests, and booking history.

Data Source: Your clients when they book appointments through your booking interface.

Specific Processing Purposes:

Process and confirm client appointment bookings.

Send booking confirmations and reminders to your clients.

Enable service providers to view and manage their appointment schedules.

Generate client contact lists for service providers.

Process appointment modifications and cancellations.

Create booking reports and statistics for service providers.

Enable repeat booking functionality for returning clients.

Legal Basis: Legitimate interests and contractual obligation, enabling effective appointment booking and management.

Service Provider Information

What We Collect: Professional details including name, business address, phone number, email address, professional photos, service descriptions, qualifications, pricing information, and availability schedules.

Data Source: You (as service provider) or authorized account administrators

Specific Processing Purposes:

Display service provider profiles on public booking pages and directory listings.

Enable client search and filtering by service type, location, and availability.

Generate booking widgets for embedding on external websites.

Create service provider listings on social media integration pages.

Process appointment requests and match clients with appropriate providers.

Generate marketing materials featuring service providers (with consent).

Enable client reviews and rating systems for service quality.

Important Note: This specific information will be available on the user’s booking site, supplied by us, on a widget that may be inserted into users own website, on users social media profiles, on our directory sites where all system users are displayed, unless they specifically opt out of being displayed there.

Legal Basis: Contractual obligation and legitimate interests, as this is the core functionality of our booking platform service.

Publication and Marketing Data

What We Collect: Content created for services, products, promotions, and business information including text descriptions, images, pricing, terms and conditions, and promotional materials

Data Source: You or authorized account users

Specific Processing Purposes:

Display service and product information to potential clients.

Enable online booking and purchasing functionality.

Create a searchable database of available services.

Generate promotional materials and featured listings.

Enable social media sharing and marketing integrations.

Process online payments and generate service receipts.

Provide comparison tools for clients to evaluate options.

Important Notice: Information published through our platform may be visible worldwide via internet searches and social media sharing. We cannot control how third parties use or share publicly available information, even after your account is deleted from our end.

Legal Basis: Contractual obligation and legitimate interests - enabling service promotion and client discovery.

Customer Support Data

What We Collect: Information from support inquiries including correspondence content, technical issues described, account information referenced, and resolution records

Data Source: You, your clients, or authorized users submitting support requests

Specific Processing Purposes:

Provide technical support and troubleshooting assistance.

Resolve billing and account-related inquiries.

Track and analyze common user issues to improve platform functionality.

Maintain support ticket history for follow-up assistance.

Generate internal reports on support effectiveness and response times.

Provide training materials and FAQ updates based on common questions.

Legal Basis: Legitimate interests - providing effective customer support and service improvement

Transaction and Financial Data

What We Collect: Purchase information including payment details, transaction amounts, billing addresses, invoice records, refund requests, and financial reporting data.

Data Source: You when making purchases or processing payments through our platform

Specific Processing Purposes:

Process subscription payments and service purchases.

Generate invoices, receipts, and financial statements.

Handle refund requests and billing disputes.

Maintain financial records for accounting and tax compliance.

Prevent payment fraud and unauthorized transactions.

Generate revenue reports for business operations.

Process tax calculations and regulatory financial reporting.

Data Retention: Financial transaction data is retained for 7 years to comply with accounting regulations and VAT reporting requirements.

Data Processing Location: Processed using our internal Notando Accounting System on EU-hosted dedicated servers.

Legal Basis: Legal obligations, required for proper accounting practices and financial compliance.

Marketing Communication and Newsletter Data

What We Collect: Email addresses and communication preferences for users who subscribe to newsletters or marketing communications.

Data Source: You, when explicitly subscribing to communications.

Specific Processing Purposes:

Send requested newsletters with platform updates and new features.

Deliver opted-in promotional communications and special offers.

Provide important service announcements and policy updates.

Send educational content about maximizing platform usage.

Conduct voluntary surveys for service improvement.

Withdrawal Rights: Consent can be withdrawn at any time by clicking unsubscribe links or contacting our support team.

Legal Basis: Consent, freely given and withdrawable consent for marketing communications.

General Correspondence Data

What We Collect: All communications sent to us including email content, contact forms, chat messages, and related metadata.

Data Source: You, when contacting us through any communication channel.

Specific Processing Purposes:

Respond to inquiries and provide requested information.

Maintain communication records for follow-up and reference.

Resolve complaints and service issues.

Improve our services based on user feedback and suggestions.

Comply with legal obligations requiring communication record-keeping.

Legal Basis: Legitimate interests, such as proper business administration and effective user communication.

Additional Legal Basis for Processing

Beyond the specific purposes listed above, we may process personal data for these additional legitimate interests:

Legal Defense: Establishing, exercising, or defending legal claims in court proceedings, administrative procedures, or out-of-court dispute resolution.

Business Protection: Protecting our business interests against risks, maintaining insurance coverage, managing operational risks, and obtaining professional legal or financial advice.

Regulatory Compliance: Meeting evolving regulatory requirements and industry standards for data protection and business operations.

IV. 我們將您的資訊存放在哪?

Your personal data is stored on servers located in three reputable data centres, in Canada, France and Singapore all of which meet the R82 and R81 APSAD standards and work according to ISO/IEC 27001 standard. Check out how we always prioritise the importance of information security, here.

針對我們的企業版客戶，我們提供位於 加拿大、英國、澳洲、比利時或任何其他地點的專屬伺服器，將視其可用性和其他需求及法律義務為準。

V. 您的資料將被保存多久？?

我們必須遵守與資料保存＆資料刪除有關的多項法律義務。因此，再所有情況下，我們只會再此處所樹的處理目的之所需的時間內，保存您的數據，同時遵守 GDPR 的「資料保存」原則。這意味著，只要您仍然是我們系統的用戶，您就可以隨時編輯這些資訊，並透過取消使用系統來請求刪除。由於我們將所有的資料庫備份時間設定為 30 天，因此這些資訊在我們伺服器中，最久可能將存放 30 天，當超過此天數上限，該資料將會被刪除。

VI. 隱私納入設計＆設計由隱私出發

我們已實施了“適當的技術和組織措施”，以有效遵循資料保護原則並保護個人權利。具體而言，我們將在《一般個人資料保護規則》（GDPR）要求下進行資料保護影響評估（“DPIA”），以識別和最小化項目的數據處理風險。

• 資安團隊

  此外，我們的所有安全措施都是 SimplyBook.me Ltd 整體資訊安全管理系統（“ISMS”）的一部分，符合 ISO/IEC 27001 標準。

• 醫療數據隱私 / 受保護的健康資訊

  您可以透過帳號中的備註上傳某些醫療資料或受保護的健康資訊（根據 1996 年健康保險可攜與責任法 "HIPAA" 的定義）。

  為了提供我們的 SimplyBook.me 軟體和服務，我們可能會限制對此類訊息的訪問，並作為業務夥伴遵守適用的 HIPAA 規定。

  查看我們如何遵守 HIPAA 規範，請點擊這裡。

VII. 共享您的個人資訊

為了有效營運公司並提供完美的服務、產品和功能，我們必須共享您的部分個人數據。這些共享僅限於為了特定目的和確保業務營運所需的範圍和時間。因此，我們提供的服務不會受到威脅，您的權利也不會受到侵犯。

(a) 為了提供我們的其他服務 / 產品而進行共享：

SimplyMeet.me 會議預約排程解決方案

我們是 SimplyMeet.me 解決方案的所有者，為您提供線上會議排程軟體，幫助您更輕鬆的安排會議預約。您可以點擊 此處 查看 SimplyMeet.me 官方網站及相關的法律文件。

SBPay Basic & Pro 金流整合服務

SBPay 金流整合服務視根據我們的 服務條約及條款 T&C 提供給使用者的服務，此功能讓我們的「接受付款」客製功能更加全面且完善。

為了提供任一版本的 SBPay 金流整合服務，我們將蒐集和儲存：所有處理的交易數據、時間、您的客戶姓名、付款金額、購買的內容（是否為重複性購買）、IP 位址與交易有關的金流平台等。

請注意，我們不會儲存完整的信用卡資訊 － 以避免識別卡片所有者的身分。

數據儲存於：德國（歐盟）的 Google Cloud 中。

Booking.Page 全球最大預約服務平台

SimplyBook.me Ltd 是 Booking.Page （預約目錄）的所有者及營運商，該網站在英國的 OVH 伺服器託管 - 閱讀更多關於 OVH 的 安全標準基礎設施和軟體資訊。

我們已根據 標準合約條款 (SCC) 來處理相關數據，並且明確知會您相關資訊：當您明確允許在 Booking.Page 中發佈公司資訊、服務供應者資訊及評論等資料時，您同意將這些數據傳輸到 EEA 之外的範圍，並且以本條款的規定為基準。

AI Helper & Third-Party AI Models

To enhance our services, we offer an AI Helper tool. When you use this feature, we process certain data to provide and improve the service. You are interacting with an artificial intelligence system when using our AI Helper feature.

We collect the text and queries you input into the AI Helper, as well as interaction data such as logs and usage patterns for analytics.

Legal Basis: Legitimate interests & contractual obligations, meaning to provide enhanced AI-powered assistance within our system services.

Purpose of Processing: This data is used exclusively to provide responses, improve the AI Helper's functionality, and maintain the security of the feature.

Data Retention: AI Helper interaction data is retained for as long as the chat remains open.

Data Sharing with Third-Party AI Services: The AI Helper utilises third-party AI models to process your queries. By using the feature, you acknowledge that the input you provide will be shared with these external systems for processing in accordance with their respective data processing agreements.

Your Rights: You have the right to access, rectify, delete, or port your AI Helper data. Contact us at dpo@simplybook.me to exercise these rights.

Important Notice: The AI Helper has inherent limitations in accuracy and may not be suitable for all types of queries. Human oversight is available through our support channels. As the AI Helper is an automated tool, you are solely responsible for the information you input. Do not share any sensitive personal, financial, or confidential information when using the AI Helper.

(b) 作為 team.blue 集團的一員共享：

SimplyBook.me 是 team.blue 集團的一部分，我們可能會與集團內的其他實體共享用戶的個人數據，但須遵守我們內部全球數據共享框架的規定。

team.blue 集團由多個品牌和子公司組成，通過內部數據共享可以改善協調和資源分配。這使得在產品、活動和客戶服務改進方面的合作更加高效。個人數據可能會在 team.blue 集團公司之間共享，用於市場統計、內部管理和報告目的，但僅限於為了預期用途所需的數量，並採取適當的保護措施以防止未經授權的訪問或披露。

(c) 與子處理器共享：

我們已委任了一些子處理者，我們將與其共享您的個人數據，包括：

協助我們提供服務的指定服務供應商、業務合作夥伴和第三方供應商

根據法律要求，法律機構、監管機構以及其他第三方。

與位於歐盟和歐洲經濟區（EEA）內的各方進行的所有數據處理活動均遵循 GDPR 及相關數據處理協議的規定。

當我們將你的個人數據轉移到不在歐盟或歐洲經濟區的國家時：

Find a list of sub-processors as part of our online DPA here.

Where there is a change to this list, we will notify you and you can submit any objection via email to legal@simplybook.me, within 15 days.

VIII. Cookies 和第三方技術（統計和分析）

General Statements:

a) 出於安全和檢測欺詐行為的目的，SimplyBook.me Ltd 已實施自動控制系統，利用 cookies 及其他類似的追蹤技術來追蹤和分析用戶在網站上的某些行為，這些行為與其 IP 位置和其他與網站瀏覽相關的個人數據相關。此類處理的結果是，如果訪客試圖在網站上進行欺詐行為，例如試圖多次利用同一促銷活動而無權這樣做，SimplyBook.me Ltd 保留將該人排除在促銷活動之外或採取任何其他適當措施以保護自身的權利。

b) 使用 cookies 和類似技術來追蹤分析，幫助我們檢查和評估 SimplyBook.me Ltd 線上廣告的效果和質量，從而提升廣告表現和 SimplyBook.me Ltd 提供的服務。

c) SimplyBook.me Ltd 使用 cookies 以實現功能性和統計目的，檢測欺詐行為，以及衡量廣告活動和服務的效果。

Cookies

Like most websites, we use cookies and we wish to clarify here that cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies. If you need to know more, find everything in our Cookies Policy.

統計與分析

In order to improve our website and product, we use tools for statistics and analysis in order to obtain an accurate overview on how visitors interact with our system and our website, so we can make it better. Note that where possible, we enable relevant settings in the tools we use and mention below, in order to minimise the personal data we process.

Google Analytics：由 Google 愛爾蘭有限公司（“Google”）提供的網站分析服務，讓我們能夠追蹤並分析我們網站的使用情況，並生成活動報告，與其他 Google 服務共享這些報告。

You can learn more by consulting Google’s official documentation and Google Analytics Opt-out Browser Add-on Download Page.

Matomo: an analytics service provided by InnoCraft, an open-source web analytics tool, to track and analyse visits to our website. Matomo collects data such as IP addresses (anonymised), browser information, and pages visited. This helps us understand how you interact with our site and as well as admin interface of your account, and hence help us improve your experience.

Visit Matomo’s website for more information: https://matomo.org/gdpr-analytics/.

Leadinfo：這是由荷蘭鹿特丹的Leadinfo B.V.公司提供的潛在客戶生成服務。它會根據IP地址識別哪些公司訪問我們的網站，並顯示一些公開的相關信息，比如公司名稱或地址。此外，Leadinfo會放置兩個第一方cookie，以提供有關訪問者如何使用我們網站的透明度，並且該工具會處理來自提供表單輸入的域名（例如“leadinfo.com”），以將IP地址與公司相關聯並提升其服務。

For additional information, please visit www.leadinfo.com. On this page: www.leadinfo.com/en/opt-out you have an opt-out option. In the event of an opt-out, your data will no longer be used by Leadinfo.

IX. 行銷推廣溝通

為了聯繫您進行營銷和促銷目的，我們需要您的明確同意，並且告知您我們將如何處理您的個人數據。因此，通過在註冊過程中點擊接收行銷和促銷更新，您即同意並允許我們使用您的個人數據，並通過電子郵件、簡訊或即時消息（如 WhatsApp）與您聯繫。

您的個人數據僅會儲存在我們的內部資料庫中，用於市場行銷和通訊目的，我們不會將您的個人數據與第三方共享，除非他們作為我們的服務供應商並且是我們業務運營的一部分。這意味著我們已建立了合作關係，並受到資料保護和隱私條款的保障。

針對 使用系統之用戶溝通,，我們使用自托管的行銷自動化工具，來避免外部平台存取我們的用戶數據。因此，我們會在我們系統中追蹤用戶使用狀況，在用戶允許我們與他們進行聯繫時（透過勾選註冊流程中的行銷選項）在適當的時間點發送相關的電子郵件和系統更新資訊以協助用戶使用。

作為我們行銷工作的一部分，並為了 SimplyBook.me Ltd 的合法利益，我們可能會根據軟選擇加入豁免向我們的客戶發送行銷電子郵件或簡訊，宣傳類似的產品或服務。這項豁免使我們能夠聯繫現有客戶，提供與他們之前從我們這裡購買的產品或服務類似的產品或服務。

在所有情況下，您的個人數據都將根據我們的指示來處理（我們做為數據控制者），並遵守本政策之規範。我們不使用行銷自動化平台，也 不會 對您的個人數據進行任何自動決策的處理。

取消訂閱選項將適用於所有我們用於行銷目的的溝通管道。

X. 您的權益

根據 GDPR 規範，您為「資料當事人」並擁有以下可自由行使之權利：

存取的權利

修正的權利

刪除的權利

限制資料處理的權利

反對資料處理的權利

資料調閱的權利

向監管機構投訴的權利；

撤回同意的權利。

若您希望使用任何權利，請透過電子郵件 dpo@simplybook.me 或 UKRepresentative@simplybook.me 與我們聯繫。

Data Deletion Requests for Meta (Facebook) Users

To request the deletion of your data, please send an email to dpo@simplybook.me with the following information:

Subject Line: "Facebook Data Deletion Request"

Body of Email: Please include your full name and the email address or user ID associated with your Facebook account so we can accurately locate your data.

Once we receive your request, we will begin the process of permanently deleting your data from our systems. We will send you a confirmation email once the deletion is complete, which may take up to 30 days to process.

For your security, we also recommend you remove the connection to Facebook within your Facebook account by going to Settings & Privacy > Settings > Apps and Websites.

如果您在歐盟（EU）或歐洲經濟區（EEA）之外，GDPR 不適用，請閱讀以下部分。

SimplyBook.me Ltd 不會 出售或分享用戶的個人資訊。上述權利可以由相關個人透過上述提供的聯繫方式免費行使，並/或在您的帳號中根據適用情況行使，在某些條件和例外情況下，SimplyBook.me Ltd 必須遵守相關法律/法規。上述條款優先於本文件中可能存在的任何其他不一致或相衝突的資訊。

XI. Information Related to Meta (Facebook) Services

To enhance our services, we offer several optional integrations with Meta platforms (Facebook and Instagram). This section explains how data is collected and used when you or your clients use these features.

1. Social Login.

End users have the option to use their social media profiles (including Facebook) to log in or register when booking an appointment on your page, simplifying the booking process.

Data Collected During Client Social Login:

Public Profile Information (Name, Email, Profile Picture): To identify the client, pre-fill their booking details, and personalize confirmations.

Meta User ID and Authentication Tokens: To securely verify the client's identity and maintain their login session for viewing their booking history.

Purpose: To provide a convenient and secure authentication method for your clients, helping to prevent fraudulent bookings and allowing clients to easily manage their appointments.

Legal Basis: Consent (when the client chooses to use social login) and Contractual Necessity (to provide the login service they have requested).

2. Business Page Integration.

You can connect your account to your Facebook Business Page or Instagram Business Profile. This enables end-users to book your services directly from your social media presence.

What data we collect:

Your Meta User ID, authentication tokens, and a list of the business pages you manage so you can select the correct one to connect.

Your public Business Page information (e.g., Page name, Page ID).

The purposes of processing data include:

enabling a "Book" button on your page or profile;

displaying your services on your page with booking capabilities;

allowing clients to book appointments directly through Meta platforms;

syncing booking information between your Account and your social media presence.

Legal Basis: Consent, when you authorise the connection and Contractual Necessity, in order to provide the login/integration service you requested.

Important note: This integration does not work for personal accounts and you can disconnect this integration at any time through your Account settings.

3. Data We Share with Meta (Meta Pixel and Conversions API).

We offer an optional feature that allows you to integrate a Meta Pixel with your booking page. This is a powerful tool for tracking client activity and measuring the effectiveness of your advertising campaigns.

What data we collect on your behalf:

Event Data: Actions you take on our site, such as viewing a page, starting the booking process, or completing an appointment.

Technical and Usage Data: Your IP address, browser type, device information, and click patterns.

Transaction and Conversion Data: Confirmation that a booking was made, the service category, and the value of the booking. We do not share sensitive payment details like credit card numbers.

The purposes of processing data include:

Measure Ad Performance: Track conversions and understand the return on your ad spend.

Retarget Visitors: Show relevant ads to people who visited your booking page but did not book.

Build Audiences: Create Custom Audiences from your visitors or build Lookalike Audiences to find new clients.

Analyse User Behavior: Understand how clients interact with your booking page to optimise its layout and services.

Legal Basis: Legitimate Interest. You have a legitimate interest in marketing your business and improving your services. Your clients can object to this processing through cookie consent tools and their browser settings.

How Meta Processes Your Data

When you interact with our services through platforms that integrate with Meta (such as Facebook, Instagram, or WhatsApp), data is exchanged with Meta Platforms, Inc. This applies to various interactions, including but not limited to, using social login options, sharing content directly to Meta platforms, or engaging with our content on Meta's properties.

Once data is shared with Meta through any of these integrations, Meta acts as an independent data controller and has the primary responsibility for how that data is processed, stored, and used from that point onward, operating under their own distinct data policies, terms of service, and privacy practices, not our own.

We act as the initial party collecting data, but we do not retain control over how Meta utilizes this data after it has been transferred to their systems. Our agreement with you covers our data handling practices; however, Meta's subsequent use of the shared information falls under their responsibility.

We strongly encourage all users to thoroughly review Meta's privacy policies, terms of service, and any other relevant documentation, with information regarding how Meta collects, uses, shares, and protects your personal data when you interact with their services, including data received from third-party integrations like ours.

You have full control over your data and the connection between our service and Meta.

You can disconnect your Meta account at any time in your Account settings. You can also revoke our app's permissions directly in your Facebook or Instagram settings under "Apps and Websites."

You can manage the ads you see on Meta platforms through your Facebook Ad Preferences and review how your data is used in the Off-Facebook Activity tool.

You can manage tracking technologies through our website's cookie consent banner and your browser settings.

You have the right to request the deletion of the data we hold about you that was received from Meta.

XII. 隱私權變更記錄

我們可能會隨時調整文件內容，以反映法律或相關執行方式的改變。請密切關注我們的網站以獲得任何更新。若我們有任何重大修改，也會主動通知您。

Last update: 24/09/2025

Version: 3.2

先前的通用版本，可參考。