Mobile-Calendar Privacy Policy
1. Information on the Processing of Personal Data
Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR), we hereby inform you that the User’s personal data may be processed both by the Service Administrator and by the User, depending on the type of data and the purpose of its processing.
2. Personal Data Controller
The controller of the User’s personal data, including, in particular, identification data, contact details, billing information, and data associated with the User’s account within the Service, is:
dpTechnologies s.c.
Tax Identification Number (NIP): 671-184-48-76
ul. Osiedlowa 3
78-111 Ustronie Morskie
Poland
Email: info@mobile-calendar.com
The controller of personal data entered into the Application by the User, including, in particular, data relating to customers, accommodation guests, reservations, telephone numbers, and guests’ email addresses, is the User.
dpTechnologies s.c. processes the personal data of the User’s customers and guests exclusively as a data processor within the meaning of Article 28 GDPR, to the extent necessary to provide the Service.
3. Entrustment of Personal Data Processing (Article 28 GDPR)
To the extent that dpTechnologies s.c. processes personal data of the User’s customers and guests, such processing is carried out on the basis of a data processing agreement within the meaning of Article 28 GDPR.
The entrusted processing includes, in particular:
- Data storage.
- Ensuring system availability.
- Technical support and troubleshooting.
- Creating backup copies.
- Ensuring data security.
Personal data is processed exclusively on documented instructions from the User, with appropriate technical and organizational measures in place.
The User, acting as the controller of their customers’ and guests’ personal data, is responsible for fulfilling the information obligations towards those individuals under Articles 13 and 14 GDPR.
4. Purposes of Data Processing
Processing carried out by the Administrator (dpTechnologies s.c.) includes:
- Providing the Service and Application and managing the User’s account.
- Fulfilling legal obligations, particularly tax and accounting requirements.
- Ensuring system security.
- Handling support requests and communicating with the User.
- Establishing, exercising, or defending legal claims.
- Conducting marketing activities exclusively on the basis of separate consent.
Processing carried out by the User includes:
- Managing reservations and guest information.
- Communicating with customers.
- Processing personal data in accordance with the GDPR and other applicable laws.
Providing personal data is voluntary but necessary for entering into and performing an agreement for the provision of services by electronic means. Failure to provide such data may prevent account registration, use of the Service, or access to certain Application functionalities.
5. Legal Basis for Processing
The Administrator processes personal data on the following legal bases:
- Article 6(1)(b) GDPR – performance of an agreement for the provision of services by electronic means.
- Article 6(1)(c) GDPR – compliance with legal obligations.
- Article 6(1)(f) GDPR – the legitimate interests of the Administrator (security, handling support requests, and legal claims).
- Article 6(1)(a) GDPR – the User’s consent (e.g., marketing).
6. Consent to Marketing Communications
Marketing communications (email, telephone, SMS) are carried out exclusively on the basis of the User’s separate, voluntary consent, given in accordance with the provisions of the Polish Electronic Communications Law (Prawo Komunikacji Elektronicznej – PKE).
Marketing consent:
- Is not a condition for using the Service.
- Is not implied by the acceptance of the Terms of Service or this Privacy Policy.
- May be withdrawn at any time.
Consent may be withdrawn by contacting the Administrator at:
info@mobile-calendar.com.
7. Recipients of Personal Data
Personal data may be disclosed to entities cooperating with the Administrator, including, in particular:
- IT service, hosting, and server infrastructure providers.
- Accounting and bookkeeping service providers.
- Payment service providers.
- Public authorities, to the extent required by law.
Users’ personal data processed by dpTechnologies s.c. as part of the core functionalities of the Service is processed on infrastructure located within the European Economic Area (EEA).
Separate rules governing personal data processing within the Mobi AI functionality are set out in the Artificial Intelligence Policy.
8. Data Retention Periods
- User data – for the duration of the agreement and for up to 6 years after its termination.
- Billing and financial data – in accordance with applicable tax regulations.
- Marketing data – until consent is withdrawn.
- Customer and guest data – in accordance with the decisions of the User acting as the data controller.
9. User Rights
The User has the right to:
- Access their personal data.
- Rectify inaccurate personal data.
- Erase their personal data.
- Restrict the processing of personal data.
- Data portability.
- Object to the processing of personal data.
- Withdraw consent at any time.
Requests concerning personal data rights should be sent to:
info@mobile-calendar.com.
10. Profiling and Automated Decision-Making
The Administrator does not make decisions concerning Users based solely on automated processing of personal data that would produce legal effects or similarly significantly affect them.
11. Complaint to the Supervisory Authority
The User has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO):
President of the Personal Data Protection Office (UODO)
ul. Stawki 2
00-193 Warsaw
Poland
www.uodo.gov.pl
12. Google / Gmail API Integration
The Application enables:
Data obtained through Google APIs is used exclusively for the purpose of providing the email-sending functionality within the Application.
The content of email messages and recipients’ email addresses:
- Are not used for advertising or profiling purposes.
- Are not sold or shared with third parties.
- Are not used to create user profiles.
The User may revoke the Application’s access to their Google account at any time through the security settings of their Google account.
The Administrator does not use data obtained through Google APIs to develop, train, or improve artificial intelligence or machine learning models.
The Application complies with the Google API Services User Data Policy, including its Limited Use requirements.
13. Apple App Store and Google Play
With respect to subscriptions purchased through the Apple App Store and Google Play, Apple and Google act as independent personal data controllers in accordance with their respective terms and privacy policies.
14. Forms Made Available to Third Parties (e.g., Online Check-in)
The Service may enable Users to make online forms available to third parties, particularly guests of accommodation properties (e.g., Online Check-in forms).
In such cases:
- The User (accommodation property operator) acts as the personal data controller.
- dpTechnologies s.c. acts exclusively as a data processor within the meaning of Article 28 GDPR.
- Data entered into the form is processed exclusively for the purpose of providing the services offered through the Service.
Individuals completing the form provide their personal data directly to the User acting as the personal data controller.
15. Contacting the Administrator
dpTechnologies s.c.
ul. Osiedlowa 3
78-111 Ustronie Morskie
Poland
Email: info@mobile-calendar.com
16. Reporting Security Vulnerabilities
The security of your data is our priority. If you identify or discover a security vulnerability in the Mobile-Calendar service or on the mobile-calendar.com website, please report it to: security@mobile-calendar.com.
We undertake to acknowledge receipt of the report within 5 business days and to maintain the confidentiality of the reporting person’s identity, unless disclosure is required by legal proceedings.
Please refrain from publicly disclosing details of the vulnerability until it has been resolved (responsible disclosure).
Our security disclosure policy is also available in the RFC 9116-compliant security.txt file: https://mobile-calendar.com/.well-known/security.txt
17. Artificial Intelligence
The Service may provide functionalities that use artificial intelligence. The use of these functionalities is voluntary and is subject to the rules set out in a separate Artificial Intelligence Policy, which is made available to the User before their first use of the relevant functionality.
In case of any discrepancies or ambiguities, the Polish version of this Privacy Policy shall prevail.
