Privacy Policy

This Privacy Policy describes what data AtGuest (referred to as "we," "us," or "the service") collects, how we use, store, and protect it. By using the service, you agree to the terms of this Policy. Since atguest is established in the European Union, the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) applies to the processing of your data. If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, also applies to you.

1. Who We Are

The atguest service is provided by AtGuest, s.r.o., a company registered in the Slovak Republic under registration number [IČO], with its registered office at [Address, Slovak Republic]. You can contact us regarding privacy matters at privacy@atguest.com.

2. Who Is the Controller and Who Is the Processor

It's important to distinguish between two types of data that pass through atguest:

• Business owner and staff data (your account, contacts, subscription payment) — here atguest is the data controller and independently determines the purpose and means of processing.
• Your business's customer data (those who book through your widget) — here you, the business owner, are the controller, and atguest acts only as a processor acting on your instructions. This means you are responsible for obtaining your customers' consent to process their data, while atguest processes this data only to the extent necessary to provide you with the service's functions (bookings, reminders), and does not use it for its own marketing purposes.

3. What Data We Collect

Depending on how you use atguest, we may collect:

• Business owner data: name, email, phone number, business name and address, subscription payment details.
• Staff data: name, contact details, schedule, information about services and compensation entered by the business owner.
• Business customer data: name, phone number, email, booking history — entered through the booking widget or by the business owner.
• Technical data: IP address, browser type, data about service usage (cookies, analytics).

4. Legal Basis for Processing Data

We process your data on one of the following legal bases (GDPR, Art. 6):

• Performance of a contract — to provide you with the service's functions.
• Consent — for marketing communications and optional cookies.
• Legitimate interest — for analytics, security, and fraud prevention.
• Legal obligation — for tax and financial reporting.

5. How We Use Data

• To provide the service's functions — bookings, reminders, analytics, payroll calculation.
• To process payments through payment providers.
• To send service-related messages (confirmations, reminders, invoices).
• To improve the service and provide technical support.
• To fulfill legal obligations.

6. Who We Share Data With

We do not sell personal data. Data may only be shared with service providers necessary for atguest to operate:

• Payment providers (Stripe, LiqPay, Fondy) — to process payments and deposits.
• SMS/email/Viber providers — to send reminders to customers.
• Hosting and infrastructure providers — to store data.

Each such provider processes data in accordance with its own privacy policy and only to the extent necessary to provide its service.

7. International Data Transfers

Although atguest is established in the EU, some providers we use (including Stripe) may process data outside the European Economic Area. In such cases, the transfer is carried out on the basis of recognized safeguard mechanisms — Standard Contractual Clauses or European Commission adequacy decisions.

8. Data Retention and Deletion

Data is retained for the duration of your subscription. After cancellation, data is retained for an additional 90 days — during this time, it can be exported or the account can be restored. After 90 days, data is permanently deleted, except where longer retention is required by law (e.g., financial reporting). Data that no longer allows identification of a specific individual (anonymized or aggregated) may be retained longer for statistical and service-improvement purposes.

9. Data Security

We apply technical and organizational measures to protect data, including encryption of payment data on the side of payment providers and restricted internal access within the atguest team. No method of data transmission or storage is 100% secure, so we cannot guarantee absolute security. You are responsible for the confidentiality of your password and for any actions taken through your account.

10. Children's Privacy

atguest is not intended for individuals under 16 years of age and is not designed to collect children's personal data. If you believe a child under 16 has provided us with personal data without parental consent, please contact us at privacy@atguest.com — we will delete such data.

11. Business Transfers

In the event of a merger, acquisition, or sale of atguest's assets, your data may be transferred to the new party as part of such a transaction. We will notify you of any material change in control over your data before it takes effect.

12. Your Privacy Rights

If you are in the European Union, you have rights under the GDPR. You have the right to:

• Access the data the service holds about you.
• Request correction of inaccurate data.
• Request deletion of data ("right to be forgotten").
• Request restriction of data processing.
• Receive your data in a structured format to transfer it to another service (data portability).
• Object to data processing, including for marketing purposes.
• Withdraw your consent to data processing at any time.
• Lodge a complaint with the data protection authority in your country of residence, or with the Slovak Data Protection Office (Úrad na ochranu osobných údajov SR), where atguest is established.

If you are a California resident, you have rights under the CCPA/CPRA. You have the right to:

• Know what categories of personal information we have collected about you and why.
• Request deletion of your personal information.
• Request correction of inaccurate personal information.
• Opt out of the sale or sharing of your personal information. We do not sell personal information.
• Not be discriminated against for exercising any of these rights.

Before fulfilling a request, we may ask you to verify your identity — this is necessary to prevent fraudulent requests. To exercise these rights, contact us at privacy@atguest.com.

13. Cookies

We use cookies for the operation of the service (authentication, saving settings) and for website usage analytics. For more details on cookie types and how to manage them, see the cookie settings banner on the website. You can also manage cookies through your browser settings.

14. Changes to This Policy

We may update this Policy. We will notify you of material changes in advance by email or through a notice within the service. Continued use of the service after the changes take effect constitutes acceptance of the updated Policy. The date of the last update is shown at the top of this document.

15. Contact Us

Questions about this Policy can be sent to privacy@atguest.com.