Privacy Policy

Introduction

This Privacy Policy explains how GGSTUDIO DIGITAL AGENCY doo Beograd-Zvezdara, as the provider of the Sveska service, collects, uses, stores and protects personal data.

Sveska is a software application/platform for scheduling appointments and managing clients, employees, schedules, finances, reminders and other processes in service-based businesses.

This Privacy Policy applies to the use of Sveska, including:

• the public website sveska.app;
• the business application business.sveska.app;
• the online booking pages available via booking.sveska.app;
• the mobile application;
• SMS/email services;
• customer support;
• demo forms, contact forms and other related functionalities.

By using Sveska, visiting the website, scheduling a demo presentation, using Online Booking or communicating with us, you confirm that you are familiar with the manner of data processing described in this Privacy Policy.

Who Is the Data Controller

The data controller for the processing of the data of website visitors, prospective users, account users, business contacts, billing data, support, demo presentations and its own business purposes is:

In this Privacy Policy, GGSTUDIO DIGITAL AGENCY doo Beograd-Zvezdara is also referred to as “GGSTUDIO”, “we”, “us” or the “Service Provider”.

Sveska refers to the software product/platform that GGSTUDIO develops, maintains and makes available to users.

When GGSTUDIO Is a Controller and When a Processor

When using the website and services, various categories of personal data may be collected and processed, depending on the manner in which the user uses the website or application, that is, the services that Sveska provides.

3.1 GGSTUDIO as a Data Controller

GGSTUDIO is a data controller when it processes data for its own purposes, for example when you:

• visit the public website sveska.app;
• schedule a demo presentation;
• send an inquiry via a form or email;
• communicate with our team;
• open or use a user account;
• use support;
• pay for a subscription;
• receive notifications from GGSTUDIO;
• we use data for security, analytics, the improvement of Sveska or the fulfilment of legal obligations.

3.2 GGSTUDIO as a Data Processor

GGSTUDIO is a data processor when, on behalf of a Business User, it processes the data of that user's End Clients, employees, associates or other persons entered into Sveska.

In that case:

• the Business User is the data controller;
• GGSTUDIO is the data processor;
• GGSTUDIO processes the data on the instructions of the Business User and for the purpose of providing the functionalities of Sveska.

Example: when a salon, clinic, studio, gym or other service-based business enters its clients' data into Sveska for the purpose of scheduling appointments, sending reminders or keeping records, that business is the data controller, and GGSTUDIO processes the data as the technical service provider.

The processing that GGSTUDIO carries out on behalf of the Business User is further governed by the Sveska Terms of Use, in particular by the provisions relating to the processing of data on behalf of the User.

What Data We May Process

Depending on the manner of use of Sveska, we may process the following categories of data.

4.1 Data You Provide Directly

This data may include:

• name and surname;
• email address;
• telephone number;
• business name;
• business type;
• number of employees;
• data you enter into a demo or contact form;
• preferred time for contact;
• the content of the message you send us;
• data you provide during communication with our team.

4.2 User Account Data

When you use the Business Application, we may process:

• the name and surname of the account holder;
• email address;
• telephone number;
• username;
• password in protected form;
• business name;
• business location;
• the user's role in the system;
• data about employees and Authorized Users;
• account settings;
• information about the use of Sveska's functionalities.

4.3 Data About the User's Business

A Business User may enter into Sveska data such as:

• business name;
• activity;
• location;
• working hours;
• employees;
• employee schedules;
• services;
• prices;
• service durations;
• scheduling and cancellation rules;
• information visible on the Online Booking page.

4.4 Data About End Clients

When a Business User uses Sveska for scheduling and managing clients, the data of its End Clients may be processed, such as:

• name and surname;
• telephone number;
• email address;
• appointment time;
• selected service;
• selected employee;
• appointment history;
• attendance, change or cancellation status of an appointment;
• notes entered by the Business User;
• communication related to an appointment;
• other data that the Business User enters into Sveska.

4.5 Payment and Invoicing Data

We may process data necessary for the collection and administration of a subscription, such as:

• the name of the legal entity or business;
• tax identification number (PIB) or other identifying data where applicable;
• billing address;
• selected plan;
• number of employees;
• billing period;
• payment status;
• issued invoices;
• data about additional services, such as SMS campaigns.

We do not store complete payment card details if the payment is made through an external payment processor. In that case, the payment processor processes the data in accordance with its own rules.

4.6 Technical Data

When using the website, the Business Application, the Mobile Application or Online Booking, certain technical data may be processed automatically, such as:

• IP address;
• device type;
• operating system;
• web browser;
• browser language;
• time of access;
• pages and functionalities used;
• activity logs;
• system errors;
• data necessary for the security and stability of Sveska.

4.7 Communication Data

When you communicate with us or when Sveska sends messages, we may process:

• email address;
• telephone number;
• message content;
• time of sending;
• delivery status;
• the user's reply;
• records of communication with support;
• data about the opening of or interaction with an email message, where such functionality is enabled.

Purposes of Data Processing

We process data for the following purposes:

• responding to inquiries;
• organizing a demo presentation;
• creating and maintaining a user account;
• enabling the use of Sveska;
• managing the subscription;
• collection and issuing of invoices;
• providing customer and technical support;
• setting up the system for the User;
• enabling manual and online appointment scheduling;
• sending confirmations, reminders and notifications about appointments;
• enabling SMS/email campaigns initiated by the Business User;
• displaying available appointments on the Online Booking page;
• keeping a client database and appointment history;
• managing employees, schedules and services;
• tracking basic financial information;
• analytics and the improvement of Sveska;
• detecting and preventing misuse;
• maintaining system security;
• fulfilling legal, accounting and tax obligations;
• resolving disputes and protecting GGSTUDIO's rights.

Legal Basis for Data Processing

We process data on the basis of one or more of the following legal bases:

6.1 Performance of a Contract or Pre-Contractual Steps

We use this basis when we process data for the purpose of:

• scheduling a demo presentation;
• responding to a prospective user's inquiry;
• creating and maintaining an account;
• providing the Sveska service;
• collecting subscription payments;
• customer support;
• fulfilling obligations towards the User.

6.2 Legitimate Interest

We may process data on the basis of legitimate interest when it is necessary for:

• the improvement of Sveska;
• analysis of the use of the website and application;
• protecting the system from misuse;
• preventing fraud;
• ensuring stability and security;
• internal administration;
• evidencing communication;
• protecting GGSTUDIO's legal interests.

When we rely on legitimate interest, we take care that such processing does not override the rights and freedoms of the data subjects.

6.3 Consent

We use consent when it is required for certain types of processing, for example:

• certain cookies and analytics/marketing technologies;
• sending certain marketing communications;
• other cases where the law requires consent.

Consent may be withdrawn at any time, but the withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.4 Legal Obligation

We process data when it is necessary to fulfil legal obligations, including:

• tax and accounting regulations;
• retention of business documentation;
• acting upon the requests of competent authorities;
• protecting the rights of data subjects.

6.5 Processing on Behalf of the Business User

When GGSTUDIO processes the data of End Clients or employees on behalf of a Business User, the legal basis for the processing is determined by the Business User as the data controller.

In that case, GGSTUDIO acts as a processor and processes the data for the purpose of providing the functionalities of Sveska.

Online Booking and End Clients

End Clients may use the Online Booking pages available via booking.sveska.app in order to book, change or cancel an appointment with a Business User.

When an End Client uses Online Booking, data such as name and surname, telephone number, email address, selected service, selected appointment, selected employee and other information necessary for booking may be processed.

This data is processed for the purpose of:

• displaying available appointments;
• booking appointments;
• confirming appointments;
• sending reminders;
• changing or cancelling appointments;
• communication between the Business User and the End Client;
• keeping records of appointments in Sveska.

The Business User is responsible for the accuracy of the information displayed on its Online Booking page, including services, prices, appointment durations, employees, location, working hours and cancellation rules.

GGSTUDIO does not provide the service that the End Client books. GGSTUDIO technically enables the use of Online Booking, while the Business User is responsible for the relationship with the End Client and the performance of the service.

SMS and Email Messages

Sveska may enable the sending of service and marketing messages to End Clients.

8.1 Service Messages

Service messages may include:

• confirmation of a booked appointment;
• an appointment reminder;
• notification of an appointment change;
• notification of an appointment cancellation;
• other messages related to the use of the Business User's service.

These messages are sent for the purpose of performing the scheduling service and organizing appointments.

8.2 Marketing Messages and Campaigns

Sveska may enable a Business User to send SMS or email campaigns to its End Clients.

Marketing messages may include promotions, discounts, notifications of special offers, invitations to return and other commercial messages.

The Business User is responsible for having an appropriate legal basis for sending marketing messages, including consent where necessary, as well as for complying with the rules on advertising, consumer protection and personal data protection.

GGSTUDIO provides the technical functionality for sending messages but does not determine the content, the recipients, the time of sending or the legal basis for sending marketing messages.

SMS campaigns may be charged additionally to the Business User in accordance with the applicable price list.

Special Categories of Data

Sveska is intended for the organization of a service-based business and is not intended as a medical information system, an electronic health record, a diagnostic tool or a substitute for the professional records that the User must keep under special regulations.

The User should not enter special categories of personal data, including health data, unless this is genuinely necessary for its business and it has an appropriate legal basis for doing so.

If, due to the nature of its activity, the User enters data that may be sensitive or fall within special categories of data, the User is responsible for ensuring that such processing is lawful, proportionate and compliant with the regulations applicable to its activity.

GGSTUDIO does not determine which data the User enters into notes, comments, appointment history or other fields within Sveska.

Cookies and Similar Technologies

The website and other parts of Sveska may use cookies and similar technologies for the purpose of:

• the proper functioning of the website;
• remembering user settings;
• analysis of visits and use;
• improving the user experience;
• security;
• measuring the effectiveness of campaigns, where applicable.

Cookies may be:

• necessary cookies;
• functional cookies;
• analytics cookies;
• marketing cookies.

The user may configure or restrict the use of cookies through the settings of their web browser or through a cookie management tool, if available on the website.

If the user disables certain cookies, some functionalities of the website or Sveska may not work to their full extent.

More detailed information about cookies may be governed by a separate Cookie Policy available on the website.

Analytics, Technical Tools and Third Parties

For the purpose of providing, maintaining, securing and improving Sveska, we may use third-party services.

Third parties may include:

• hosting and cloud providers;
• SMS gateway providers;
• email services;
• payment processors;
• analytics tools;
• customer support tools;
• error and performance monitoring tools;
• security tools;
• the App Store, Google Play and other distribution platforms;
• other technical and operational partners.

With third parties we share only the data necessary for a specific purpose, such as the operation of Sveska, sending messages, collection, support, security or analytics.

When third parties process data on our behalf, we strive to ensure that they apply appropriate data protection measures and use the data only for the agreed purposes.

Data may also be provided to competent state authorities, courts, regulators or other persons where necessary to fulfil a legal obligation, protect rights or act upon a lawful request.

International Data Transfers

Data may be processed or stored on servers located outside the Republic of Serbia or outside the European Economic Area, if this is necessary for the operation of Sveska or the use of third-party services.

In that case, GGSTUDIO applies reasonable legal, technical and organizational protection measures in accordance with applicable regulations.

Such measures may include the use of contractual obligations, appropriate security measures and cooperation with service providers that apply data protection standards.

Data Retention Period

Data is retained for as long as necessary for the purpose for which it was collected, except where the law requires or permits longer retention.

As a guideline:

• data from contact and demo forms may be retained for up to 12 months from the last communication;
• user account data is retained for as long as the User uses Sveska;
• User Data may be retained for up to 90 days after the termination of the subscription for the purpose of account renewal or data export;
• data on invoices, payments and business documentation is retained in accordance with accounting and tax regulations;
• technical and security logs may be retained for the period necessary for security, analytics, the detection of misuse and the resolution of technical problems;
• data necessary for the protection of GGSTUDIO's rights may be retained for as long as there is a legal basis or need for its retention.

After the expiry of the relevant retention period, data is deleted, anonymized or retained only where there is a legal basis for doing so.

Data Security

GGSTUDIO applies reasonable technical and organizational protection measures to protect data from unauthorized access, loss, misuse, alteration or destruction.

The measures may include:

• access control;
• restricting access to data;
• protection of user accounts;
• technical protection of the infrastructure;
• backups;
• monitoring of system operation;
• internal procedures;
• contractual confidentiality obligations;
• other measures appropriate to the nature of the data and the risk of processing.

Nevertheless, no digital system can be fully protected against all risks. The User is responsible for safeguarding its access credentials, using strong passwords, restricting employee access and notifying us of suspicious activities.

Rights of Data Subjects

In accordance with applicable regulations, a data subject may have the following rights:

• the right of access to their data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure of data;
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability, where applicable;
• the right to withdraw consent, where processing is based on consent;
• the right to lodge a complaint with the competent authority.

To exercise these rights, you may contact us at the email address: contact@sveska.app

If the request relates to data that GGSTUDIO processes on behalf of a Business User, we may refer you to that Business User as the data controller.

Example: if you are an End Client of a salon, clinic, studio or other business that uses Sveska, and you wish to have data about your appointment erased or changed, in certain cases the request should be addressed directly to that business.

Automated Decision-Making

GGSTUDIO does not use personal data for automated decision-making that produces legal effects concerning a person or similarly significantly affects them.

Sveska may use automated functionalities such as sending reminders, displaying available appointments, calculating prices or system notifications, but these functionalities serve the technical and business operation of Sveska.

Links to Other Websites

The public website, Sveska or messages sent through Sveska may contain links to third-party websites.

GGSTUDIO is not responsible for the privacy policies, security, content or conduct of third parties. Before using third-party websites or services, we recommend that you read their privacy policies.

Changes to the Privacy Policy

GGSTUDIO may amend this Privacy Policy from time to time in order to align it with changes in Sveska, regulations, technical requirements or business processes.

The latest version of the Privacy Policy will be available on the website sveska.app.

If the changes materially affect users' rights or the manner of data processing, GGSTUDIO will, where reasonably possible, notify users by email, through Sveska or by a notice on the website.

Continued use of Sveska after the publication of the amended Privacy Policy will be deemed acknowledgement of the changes, to the extent permitted by applicable regulations.

Contact

For any questions regarding this Privacy Policy or the processing of personal data, you may contact us via:

This Privacy Policy is effective as of the date indicated at the top of the document.