This agreement governs how Thrasos Charalambous ("Rantevo", "we", the processor) handles personal data on behalf of the business using Rantevo ("you", the controller), under Article 28 of the General Data Protection Regulation (EU) 2016/679.
You do not need to sign it or ask us for it. It forms part of the Terms of Service, so it is already in force between us. If your own compliance process needs a countersigned copy, email support@rantevo.com and we will sign one.
Where this agreement and the Terms of Service disagree about personal data, this agreement wins.
1. Who is who
You are the controller of the personal data your customers give you through your booking site, and of your staff's data in your admin area. You decide why it is collected and what happens to it.
We are the processor. We hold and handle that data to run the booking service for you, and we act on your instructions.
Rantevo is separately a controller for your own account data — your name, your billing details, your support threads. That is not covered here; it is in our Privacy Policy.
2. What we process
Subject matter. Running a booking website, admin area and appointment notifications for your business.
Duration. For as long as your Rantevo account is open, plus the short deletion window in section 9.
Nature and purpose. Storing, organising, retrieving, displaying and transmitting personal data so that appointments can be booked, changed, cancelled and remembered, so confirmations and reminders can be sent, and, if you take payment online, so your customers can pay you through your own Stripe account and be refunded under your rules.
Categories of data subject:
- your customers — people who book, or hold an account on your booking site
- your staff and service providers, whose names, photos and working hours you publish or record
Types of personal data:
- name, email address and phone number
- appointment history: what was booked, with whom, when, at what price, and whether it happened
- if you take payment online, what was paid online for each booking and when — a deposit or the full price — and anything refunded or disputed, and the id of the customer's record on your Stripe account. Card and bank details are typed into Stripe's own page and never reach us (section 5)
- free-text notes typed by a customer when booking, or added by you afterwards
- whether email reminders and SMS reminders are on for the customer — two preferences they can change, not a record of consent
- login credentials, where a customer creates an account on your site — an account whose email address isn't confirmed within 7 days is deleted with them, while the customer's bookings, and any record of the customer that existed before the account, are kept
- the IP address and browser recorded when someone signs in to your site or admin area — kept while that session lasts, and deleted within a day after it ends, when they sign out or when it expires after 7 days unused
- to recognise a device for your staff's sign-in alerts, a keyed hash of the IP address and browser — never the address itself — deleted 90 days after the last alert about that device
- IP addresses counted by the booking and sign-in forms to slow down automated abuse, deleted within two days
Special categories of data. Rantevo has no field for health data and does not ask for any. But a booking note is a free-text box, and if you are a clinic, a physiotherapist or a salon offering treatments, customers will type things into it that count as health data under Article 9. If that is your business, you are processing special-category data and you need a lawful basis under Article 9 for it — usually the customer's explicit consent. Say so in your own privacy notice, and consider telling customers not to put clinical detail in a booking note.
3. Our obligations
We will:
(a) Process only on your instructions. Your instructions are: this agreement, the Terms of Service, the settings you choose in your admin area, and anything you tell us in writing. We will not process the data for our own purposes, with one exception: measuring how Rantevo itself is used, described under PostHog in section 5. For that we are a controller in our own right, not your processor. If we think an instruction breaks data protection law, we will tell you and may pause that instruction until it is resolved.
(b) Keep it confidential. Everybody who can reach your data is bound by a confidentiality obligation that survives their leaving.
(c) Keep it secure. The measures are in section 6.
(d) Use sub-processors only under section 5.
(e) Help you answer your customers. If one of your customers asks you for a copy of their data, or asks you to correct or delete it, the tools in your admin area are how you answer: you can search, edit, export and delete customer records yourself. Where a request needs something the admin area cannot do, email support@rantevo.com and we will help within a reasonable time, at no charge for a reasonable volume.
(f) Help you with security, breaches and impact assessments, to the extent the information is ours to give. Section 7 covers breaches.
(g) Delete or return the data when we stop processing it. Section 9.
(h) Show our work. We will give you the information you reasonably need to show a regulator you complied, including answering a security questionnaire once a year.
4. Your obligations
You warrant that:
- you have a lawful basis for everything you collect through Rantevo, and for the reminders and confirmations we send on your behalf
- you have told your customers what you do with their data, and named us as a processor. We publish a privacy notice on your booking site generated from your business details to help with this. It is a starting point. It is your notice, and it is your job to make sure it is accurate for your business — particularly if you are handling health data
- you do not send marketing through the appointment reminders
- you keep your admin passwords secure and remove staff access when they leave
- anything you tell us to do is lawful
You are responsible for what you put into free-text fields, and for what you tell your staff to put there.
5. Sub-processors
You give us general authorisation to use sub-processors. The current list:
- Supabase — hosts the database holding all of the above. Hosted in Frankfurt, Germany.
- Vercel — hosts and serves the application; its server logs contain IP addresses and are kept for up to 30 days.
- Resend — sends booking confirmations and reminders, and holds a copy of what was sent. Sees the recipient's name and email address.
- Sinch — delivers SMS reminders. Sees the recipient's phone number and the text of the message. Sent through their EU region.
- Cloudflare — object storage for images you upload, including staff photos.
- Anthropic — runs the assistant that drafts first replies to your support conversations. When it looks things up in your account, it sees your staff's names, the services each of them offers, their working hours and the dates of their time off, as well as booking counts and totals — never the reason typed for time off or a closure. It never receives your customers' names, contact details or booking notes that way; it sees customer data only if you paste some into a support message, which you should not do.
- PostHog — measures how Rantevo is used, on rantevo.com, in your admin area and on your booking site, on its EU infrastructure. This is the exception in section 3(a): we use it for our own purposes — to see what to fix and what confuses people — so for it we are a controller in our own right, not your processor. In your admin area it records which pages your staff open and which features they use, tied to the person signed in, and only once they accept analytics when asked. On your booking site it identifies nobody: the visitor's IP address is discarded before anything is recorded, no profile is kept, nothing is stored on the visitor's device, and one in ten visits that reach the booking pages is recorded as a replay with every word on the screen masked.
Your customers' visits to your booking site are not sent to any analytics provider in a form that identifies them. No profile is created, nothing is stored on the visitor's device, and the IP address is discarded before anything is recorded. That is why your booking site carries no cookie banner.
Stripe is not on this list, deliberately. If you take payment online, your customers pay you through your own Stripe account, under your own agreement with Stripe: Stripe works for you, not for us, and for some of what it does, such as preventing fraud, it is a controller in its own right. Turning online payment on is your instruction to send your Stripe account what each payment needs: the customer's name, email address and phone number — which Stripe keeps as a customer record on your account, beside the payment, and emails the receipt to — and the services, the time, the booking reference and the amount. We delete that customer record from your Stripe account when you delete the customer, or when they delete their own account on your site; the payments stay. Card details are typed into Stripe's own page and never reach us. We keep, with the booking, what was paid and whether any of it was refunded or disputed. We make the refunds your cancellation rules call for, and the ones you make from your admin area, through your Stripe account. Your admin area also reads the refunds and disputes on your account from Stripe to show them to you.
Changing the list. We will tell you by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds within that time, tell us and we will try to find another way. If we cannot, you may cancel without penalty and we will refund the unused part of what you have paid.
Each sub-processor is under a written contract with obligations no weaker than these, and we remain responsible to you for what they do.
6. Security
- Each business's data is isolated at the database level, by row-level security policies enforced by Postgres itself, not only by application code. A bug in our code cannot on its own let one business read another's data.
- Passwords are hashed and salted; we never store one in a form we can read.
- All traffic is encrypted in transit. Data is encrypted at rest by our hosting providers.
- Access to production data is limited to people who need it, over individually-issued credentials.
- Backups are taken by our database provider and are encrypted.
- Public forms are rate-limited and protected against automated abuse.
- Changes to the database schema are reviewed, applied by an automated pipeline, and the live schema is checked against the repository on every deployment.
We may improve these measures. We will not weaken them.
7. Breaches
If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within 48 hours, by email to your account address.
We will tell you what happened, which categories and roughly how many people and records are affected, what the likely consequences are, and what we are doing about it. If we do not know all of that yet, we will say what we know and follow up.
Telling your customers is your call, because you are the controller. We will give you what you need to do it.
8. Transfers outside the EEA
We keep data in the European Union wherever the provider offers it. Where a sub-processor is established outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Three (processor to processor), together with the supplementary technical measures those clauses require. You authorise us to enter into those clauses on your behalf.
9. When we stop
When your account closes, we delete your data.
Specifically: the database records — bookings, customers, staff, services, settings — are deleted, and the images you uploaded are deleted from object storage. Backups roll off on their own schedule within 30 days, after which nothing remains.
Your Stripe account is yours. Closing your Rantevo account does not close it, and what Stripe holds about your customers' payments stays under your agreement with Stripe.
If your subscription ends and is not renewed, your booking site and admin area go offline 3 days later. If they stay offline for 90 days, we close the account and delete its data, after emailing you 30 days and 7 days before and showing you the date in your account. While they are offline, you can ask us for a copy of the data. If your site never went live, there is nothing to take offline: we close the account and delete its data 90 days after those 3 days, with the same two emails and the same date in your account first, and until then you can ask us for a copy of the data. An account that never started a subscription is closed and its data deleted 90 days after it was created — or after we started building your site, if that is later — after the same two emails and with the date shown in your account. If we built the site before you asked and you created your account from the link we sent, those 90 days run from the day we built it, not from the day you signed up, and the site is deleted with the account.
Export what you want to keep before you close the account. You can export bookings and customers as CSV from your admin area at any time while it is open. If you need something after closing, ask within 30 days and we will do what we can; after that there is nothing to retrieve.
We keep our own invoices and tax records for you as a customer, because the law requires it. Those are covered by the Privacy Policy, not this agreement, and they contain no data about your customers.
10. Audits
On reasonable written notice, we will answer questions and provide documentation showing we are meeting these obligations, once a year and more often if a regulator requires it or after a breach.
If that is not enough for your regulator, you may audit us or appoint an independent auditor to do so, at your cost, at a time we agree, without disrupting the service and without access to other customers' data.
11. Liability and law
Liability under this agreement is subject to the limits in the Terms of Service, except where data protection law does not allow it to be limited.
This agreement is governed by the law of Cyprus, and the courts of Cyprus have exclusive jurisdiction.
12. Changes
Every version of this agreement is numbered and dated. This page shows the latest one — during a notice period, the version about to take effect — and we will send you any earlier version if you ask. If we change something that materially affects you, we email you at least 30 days beforehand.
Contact
Data protection questions: support@rantevo.com
Thrasos Charalambous Kopaidos 2, 4152, Limassol, Cyprus