Privacy Policy

1. Who we are

Dibs is the trade name under which Diogo Pereira, a sole trader, tax number PT267875630, with business address at Rua Barão Forrester 752, 2.º Esq., 4050-273 Porto, provides this service. Diogo Pereira is the controller referred to in this policy.

This Privacy Policy explains how we process personal data through Dibs, the purposes we use it for, who we share it with, how long we keep it, and the rights of the people the data concerns.

For any question about privacy or data protection, you can contact us at [email protected].

2. Our roles in processing data

Depending on the situation, we may act as a controller or as a processor, within the meaning of the General Data Protection Regulation (GDPR).

When we are the controller

We are the controller of data relating to:

• the businesses that use Dibs;
• the users of their team accounts;
• billing contacts;
• people who sign up for Dibs or ask us for access through our website; and
• the use and security of the service itself.

In these cases, we determine the purposes and essential means of processing the personal data.

When we are a processor

When a customer makes a booking with a business through Dibs, that business is, as a rule, the controller of the personal data relating to that booking, and Dibs processes that data on the business’s behalf and in accordance with its instructions.

If you are a customer of a business that uses Dibs and wish to exercise your rights over the data associated with your bookings, please contact that business directly. We will give the business the assistance it needs to respond to your request, as applicable. A business can link its own privacy policy at the bottom of its booking pages.

Dibs is not directed at children. When a business books an appointment for a child, it is the business, as controller, that is responsible for any consent the law requires from the person with parental responsibility.

3. The personal data we process

We may process the following categories of personal data:

Business accounts and team members

Name, email address, phone number, role or access profile, and the information needed to authenticate and use the account.

Passwords are not stored in readable form; they are protected with appropriate hashing mechanisms.

Billing and subscriptions

Billing contact details, information about the plan or subscription taken out, the subscription’s status, and the information needed for administrative, accounting and tax purposes.

Full payment card details are handled directly by our payment provider, Stripe, and are not stored by Dibs.

Signing up

When you sign up for Dibs, we collect the business name, the address you choose for its site, your name, your email address and the password you set. To confirm the email address we send it a 6-digit code, which we keep for one day. We also record that you accepted the Terms of Service and which version you accepted.

Requesting access

If you ask us for access through our website, we collect your business's name, your name, your email address, your phone number if you give it, the plan you are interested in and your message, and use them only to answer you.

Security records

To protect sign-in we keep, for one day, failed sign-in attempts and the codes we send, recorded with the email address and a keyed hash of the IP address, which cannot be turned back into the address without a secret key held only on our servers. We also record significant events on each account, such as plan changes or team logins being created, identifying the role of the person who acted, not their name or email address. The application's technical logs are kept for 14 days; our servers' other logs have a maximum size, beyond which the oldest entries are overwritten. When something fails on our servers, we keep a report of the error, with email addresses, phone numbers and the other personal details we can recognise removed, for up to 90 days after it last happened.

Data processed on behalf of businesses

When we act as a processor, we may process data such as names, contact details, booking information, the messages sent about those bookings, the codes customers use to sign in, and notes the business records about its customers, which may include health data, for example when a health practice records a note about a treatment.

The exact data processed depends on how each business uses Dibs.

4. Purposes and legal bases

We process personal data only when there is an appropriate legal basis.

We may process data to:

• provide, manage and protect the service, including creating and administering accounts, on the basis of the performance of a contract or of steps taken before entering into a contract;
• create your account when you sign up and respond to contact requests, on the basis of steps taken at your request before entering into a contract or, where applicable, our legitimate interest in responding to enquiries about the service;
• manage billing, payments, accounting and tax obligations, on the basis of the performance of the contract and compliance with legal obligations;
• ensure the security and stability of the service and prevent abusive or fraudulent use of it, on the basis of our legitimate interest in protecting Dibs, its users and the associated systems; and
• comply with legal obligations or respond to legitimate requests from competent authorities, where applicable.

When we process data on behalf of a business that uses Dibs, the legal basis for that processing is determined by that business as the controller.

We do not sell personal data or use it for behavioural advertising.

5. Who we share data with

We use service providers that are necessary for Dibs to operate. These providers may process personal data only to the extent needed to provide their services and in accordance with the applicable contractual and legal obligations.

We use the following providers:

• Cloudflare, Inc., which carries all traffic to and from Dibs and protects it against attacks;
• Hostinger, which hosts the servers and database Dibs runs on, in the United Kingdom;
• Google Cloud, for storing the database backups, in the European Union, and the images businesses upload, in the United States;
• Stripe Payments Europe, Ltd., for payment processing and subscription management;
• Google Maps Platform, to find and check addresses when a business sets up its locations — our servers send it only the address being searched, never data about customers;
• Hostinger, for sending emails about accounts and bookings; and
• BulkGate, in the Czech Republic, for sending SMS messages about bookings, where the business uses them.

We may also disclose personal data to public authorities, courts or other bodies where the law requires it or where it is necessary to establish, exercise or defend legal claims.

When we act as a processor, we use other providers only as permitted by the agreements we have with the businesses that are the controllers.

6. International data transfers

Some of our providers may process personal data outside the European Economic Area. Our servers are in the United Kingdom, which the European Commission has recognised as providing an adequate level of protection.

In particular, Cloudflare, Google and Stripe belong to groups based in the United States and may process data there. All three are certified under the EU–US Data Privacy Framework, which the European Commission found to provide an adequate level of protection in July 2023; where a transfer is not covered by it, we rely on the European Commission's standard contractual clauses.

Where personal data is transferred internationally, we seek to ensure that the transfer takes place under a legally recognised mechanism, such as:

• an adequacy decision adopted by the European Commission;
• standard contractual clauses approved by the European Commission; or
• another transfer mechanism permitted by applicable law.

Where necessary, appropriate supplementary measures to protect the transferred data are also assessed and adopted.

You can contact us at [email protected] for more information about the mechanisms that apply to the relevant international transfers.

7. Data retention

We keep personal data only for as long as necessary for the purposes for which it was collected, also taking into account legal, accounting, tax and contractual obligations and any need to defend legal claims.

In particular:

• account data is kept for as long as the account is in use. If its access stays restricted or suspended for 6 months, its data is deleted, after warnings to its administrators at least 30 days before and again 7 days before (if no administrator can be warned, or a subscription is still active, we resolve that first); it can also be deleted sooner on request, within 30 days. In both cases we keep what the law requires and a record that the account existed: its name, its address on Dibs, its billing history and its record of significant events, which identifies roles, never people;
• billing documents and records are kept for 10 years, as Portuguese tax law requires;
• codes sent to confirm an email address or to sign in, and records of failed sign-ins, are deleted after one day;
• the application's technical logs are deleted after 14 days, and our servers' other logs are overwritten as they reach their maximum size;
• error reports, with the personal details we can recognise removed, are deleted 90 days after the error last happened;
• requests sent through our contact form are deleted 12 months after they were last updated;
• database backups are deleted after 30 days; and
• data processed on behalf of a business is kept and deleted in accordance with that business's instructions, and at the latest as described for account data above; messages sent to its customers are deleted after 90 days.

When data is no longer needed, it will be deleted or anonymised, unless the law requires it to be kept.

8. Security

We take technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

Among other measures, Dibs:

• keeps each business's data separate, with the separation enforced by the database itself (row-level security);
• encrypts all traffic to and from Dibs (TLS);
• stores passwords only as one-way hashes (bcrypt), and limits repeated sign-in attempts;
• gives each user access only to what their role allows; and
• keeps database backups in a private, encrypted storage bucket that the application can add to but cannot read or delete.

No information system can guarantee absolute security, so we review and update our security measures in line with risks and technological developments.

9. Your rights

Under the GDPR, you may have the right to:

• obtain confirmation of whether we process your personal data and request access to it;
• ask for inaccurate or incomplete data to be corrected;
• request the erasure of your data, where applicable;
• request the restriction of processing;
• object to certain processing, in particular processing based on legitimate interests;
• request data portability, where the legal conditions are met; and
• withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise your rights, contact us at [email protected].

We may ask for information reasonably necessary to confirm your identity before responding to your request.

If your request concerns data we process solely on behalf of a business that uses Dibs, we may forward it to that business or assist it in responding.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

10. Cookies and local storage

Dibs uses cookies and local storage technologies that are necessary for the service to work.

We currently use the following authentication cookies:

• dibs_at, used as a short-lived session token; and
• dibs_rt, used to renew the session.

These cookies are configured to prevent, wherever technically applicable, access by scripts running on the page, and are used solely for authentication, security and keeping the session active.

We may also use your browser’s local storage to save options such as your chosen language and other display preferences.

We do not use our own cookies for behavioural advertising or for analysing use of the service.

Cloudflare, which carries Dibs' traffic, may set cookies that are strictly necessary to protect the service against automated access.

Address searches run on our servers, so your browser does not load Google Maps, and the site's font is served by Dibs itself. Images a business uploads, such as its logo and banner, are served from Google Cloud, so your browser requests them from Google's servers, which receive your IP address. Because all of these cookies and stored data are strictly necessary, we do not ask for consent to use them.

11. Changes to this Policy

We may update this Privacy Policy from time to time, in particular because of changes to Dibs, to our providers or to the applicable legal obligations.

Whenever the policy changes, we will update the date shown at the top of this document.

Where the changes are materially relevant to the businesses that use Dibs, we will seek to tell them by email or by another appropriate means.