Privacy Policy
This policy explains what personal data Gooingto collects, why, who receives it and what rights you have. Gooingto is operated from Georgia and offers its service to businesses and individuals in the European Union, so this policy is written to comply with the EU General Data Protection Regulation (GDPR) and, where it applies, the personal data protection law of Georgia.
1. Who is responsible
Gad Lopez Alvarez, tax ID 305465181, Kote Marjanishvili St. N 49, Chugureti district, Tbilisi, Georgia. Privacy contact: [email protected].
We act in two roles:
- Data controller for the data of businesses that open an account, website visitors and billing data.
- Data processor for the data of the clients who book appointments with a business. The business is the controller of that data; see the Data Processing Addendum. If you are a client of a business and want to exercise your rights, contact that business first.
2. Data we collect
| Who | Data |
|---|---|
| Businesses (account holders) | Email, business name, description, address, logo/photo, phone/WhatsApp numbers of the business and its professionals, availability, panel settings and language, plan and trial dates. The password and PIN are stored hashed, never in plain text. |
| Clients who book | The name they enter, the requested day and time, the professional chosen and, where provided or received through WhatsApp, their WhatsApp number. Confirmation happens in WhatsApp, a separate service with its own privacy policy. |
| Paying customers | Payment and invoicing data are collected and held by Paddle as merchant of record. We receive only the subscription status, plan, the customer and subscription identifiers and the next renewal date. We never see your card number. |
| Everyone | Technical data: IP address, browser type, date and time of the request, and the cookies described in the Cookie Policy. |
3. Why we use it and on what basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Create and run your account, your public page and the booking tools | Performance of a contract |
| Send service emails: account confirmation, password and PIN recovery, plan notices | Performance of a contract |
| Manage subscriptions, billing and refunds | Performance of a contract; legal obligations |
| Keep the service secure, prevent fraud and abuse, limit repeated requests | Legitimate interest |
| Answer your questions and requests | Legitimate interest; contract |
| Comply with tax, accounting and other legal duties | Legal obligation |
We do not use your data for advertising, we do not profile you and we do not make automated decisions that have legal effects on you. We do not sell personal data.
4. Who receives your data
| Provider | Purpose | Location |
|---|---|---|
| Acens Technologies, S.L. (Hostalia) | Web hosting, database and email | Spain (EU) |
| Resend, Inc. | Sending service emails | United States (Standard Contractual Clauses / EU-US Data Privacy Framework) |
| Paddle.com Market Limited | Payments, taxes and invoices as merchant of record (an independent controller of payment data) | United Kingdom (adequacy decision) |
When a client taps to confirm a booking, their own device opens WhatsApp; that exchange is between the client, the business and WhatsApp (Meta). We may also disclose data when required by law or to defend our rights.
5. How long we keep it
- Account and booking data: while the account exists. When an account is deleted, its data is removed from our systems; copies in backups are overwritten within a limited period.
- Billing records: as long as the tax and commercial laws that apply to us require.
- Technical logs: a short period needed for security.
- Businesses decide how long they keep their clients' data and can delete bookings from the panel.
6. Your rights
You can ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest, by writing to [email protected] from the address linked to your account. We answer within one month. You can also lodge a complaint with your data protection authority: for example the Spanish Data Protection Agency (AEPD, aepd.es) if you are in Spain, or the Personal Data Protection Service of Georgia (pdps.ge).
7. Security
We use encrypted connections (HTTPS), hashed passwords and PINs, access controls, separation of each business's data and limits on repeated requests. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
8. International transfers
Our servers are located in the European Union. Because Gooingto is operated from Georgia, which is outside the European Economic Area, personal data may be accessed from there; we apply the GDPR safeguards to that access. When a provider is located outside the European Economic Area, transfers are covered by an adequacy decision or by the European Commission's Standard Contractual Clauses.
9. Cookies
We use only the cookies strictly necessary for login sessions and security, and no advertising cookies. See the Cookie Policy.
10. Children
Gooingto is intended for businesses and is not directed at people under 18. Businesses that offer appointments to minors are responsible for handling those data lawfully.
11. Changes
We may update this policy. We will tell you about material changes by email or in the panel.