1. Who we are and who is responsible
For the data of a shop’s customers (name, phone, email, booking history), the shop itself is the data controller and Endevoo acts as the processor. If you are a shop’s customer and want to exercise your rights, contact the shop first.
For data about the owners and staff who use the dashboard, and about people who write to us through the website, we are the controller. Contact: [email protected].
2. What data we process
Shop and staff accounts: name, email, password (stored hashed), shop details and hours, settings.
Customers and bookings: name, phone, email, appointments or class bookings, notes and history entered by the shop, session packages and till payments.
Contact form: your name, email, phone (optional) and message.
Technical data: IP address and request details in server logs, for security and troubleshooting. If you turn on push notifications on your device, we store the identifier needed to send them.
We do not ask for or need special categories of data (such as health data). If a shop records such details in notes, it is responsible for having a lawful basis.
3. Why, and on what legal basis
Providing the service (bookings, calendar, reminders, support): performance of a contract.
Replying to messages and early access requests: our legitimate interest in answering people who write to us and, for requests made before a contract, the steps you ask for.
Security, abuse prevention and improving the service: legitimate interest.
Meeting legal obligations, such as tax rules: legal obligation.
Push notifications: your consent, which you can withdraw from your device.
We do not sell personal data and do not use it for advertising.
4. Who we share it with
Only with providers that help the service run, such as server hosting, email delivery and push notification services, and only as far as needed. They are bound by contract to protect the data.
We may disclose data where the law or a competent authority requires it.
Each shop sees only its own customers’ data. There is no access between shops.
5. Cookies and local storage
The website uses no tracking or advertising cookies. We store only your language choice in your browser (local storage), to remember it. The dashboard uses strictly necessary cookies to keep you signed in.
6. How long we keep it
A shop’s data is kept while the account is active and deleted within a reasonable time after it is closed, unless the law requires longer retention.
Contact form messages are kept as long as needed to reply and for a reasonable time afterwards.
7. Security
The connection to the service is encrypted (HTTPS), passwords are stored hashed, and access to data is limited to those who need it. No system is perfectly secure, but if an incident affects you we will tell you as the law requires.
8. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw consent. Write to [email protected] and we will reply within one month.
You can also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
9. Changes
When we change this policy we will update the date at the top and, for material changes, notify you.
If you have any questions, write to us at [email protected].