Privacy Policy

1.1.This Privacy Policy (the “Policy”) explains what personal data the SlottiBot service processes, for what purpose and on what grounds, how long it is kept, and what rights the person whose data is processed has. The Policy is drawn up in accordance with the Law of Ukraine “On Personal Data Protection”.

1.2.The SlottiBot service (the “Service”, “we”) is provided by [ФОП] [ПІБ ФОП], taxpayer ID (RNOKPP) [РНОКПП] (the “Provider”). The Service is used by businesses that serve their clients by booking — tyre shops, auto repair shops, detailing studios, car washes and similar (each a “business”). The Service consists of:

• the website [домен сайту] (the “Site”);
• the business control panel (the “Panel”), in which a business’s staff manage the schedule, services, bookings and client base;
• Telegram bots — a separate bot for each business, through which its clients book services.

1.3.This Policy covers three groups of people: Site visitors and those who submit a request through the form; staff of businesses who have an account in the Panel; and clients of businesses who book through a bot or whom a business enters into the Panel. Section 3 is addressed primarily to clients.

2.1.The Provider determines the purposes and means of processing on its own and is the controller (volodilets) of the personal data of:

• Site visitors;
• people who submit a request through the form on the Site;
• business staff who have an account in the Panel — to the extent needed for sign-in, account protection and provision of the Service.

2.2.The Provider’s relationship with a business that uses the Service is governed by the Public Offer published on the Site.

3.1.Data of clients who book through a business’s bot, or whom a business’s staff enter into the Panel, is processed on behalf of that business. For such data the business is the controller and the Provider is the processor (rozporiadnyk) within the meaning of Article 4 of the Law of Ukraine “On Personal Data Protection”.

3.2.The business decides which services, opening hours and free time its bot shows, what information the bot asks the client for, how bookings are handled and how client enquiries are answered. It is also responsible for having a legal basis to process its clients’ data.

3.3.The Provider processes client data only on the business’s instructions, to the extent defined by the business’s settings in the Panel, and on the terms of the Public Offer. We do not use client data for our own purposes, do not message clients on our own behalf, and do not share their data with other businesses.

3.4.If you booked through the bot of a tyre shop, auto repair shop or another business and want to find out what data is stored about you, or to correct or delete it, contact that business. If you contact us instead, we will forward the request to the business and help fulfil it.

4.1.A request from the Site:

• name;
• business name — if you provided it;
• email or phone number;
• message text — if you wrote one.

4.2.A business staff account:

• name and email;
• password — only as a cryptographic hash; the password itself is not stored;
• role in the business (for example, owner, administrator, technician) and whether the account is active;
• date and time of the last sign-in;
• to confirm sign-in from a new device — a browser description (user agent), the date the device was last used, and a hash of the device identifier stored in a cookie;
• one-time codes and links for sign-in, invitations and password recovery — only as hashes and with a limited validity period.

4.3.A business’s client — contact and booking data, which we process on the business’s behalf:

• name — as entered by the client or by the business;
• phone number;
• Telegram user and chat identifiers, and the profile data Telegram sends with a message (name, username, interface language);
• booking data: service, date and time, status, price, comment, cancellation reason, and who made the booking — the client or someone else on their behalf;
• other information the business asks for through the bot or enters into the Panel — for example, email, vehicle details, notes and tags;
• the source through which the client reached the bot (for example, a QR code or a link);
• messages the client exchanges with the bot, and the current state of the conversation with the bot;
• records of booking reminders sent — if the business has enabled them.

4.4.If a client books for another person (for example, a family member or the driver of a company vehicle), the client provides that person’s name and phone number and is responsible for having the right to do so.

4.5.Activity log: who performed an action in the Panel and when, which action and on which object, which values changed, and the IP address from which the action was performed.

4.6.The Service is designed for contact and booking data. We do not request or knowingly process the special categories of personal data listed in Article 7 of the Law of Ukraine “On Personal Data Protection”, and a business must not request them through the bot or enter them into the Panel.

5.1.We process personal data for the following purposes and on the following grounds:

• responding to a request and preparing to conclude a contract with a business — on the basis of the consent you give when submitting the form;
• providing access to the Panel, authenticating staff and protecting accounts from unauthorised sign-in — to perform the contract with the business and in the Provider’s legitimate interests;
• booking clients for services, confirming, rescheduling and cancelling bookings, sending booking reminders — on the business’s instructions, to perform the contract between the business and the Provider; the legal basis for processing with respect to the client is ensured by the business;
• keeping the activity log, investigating incidents and preventing abuse — in the Provider’s legitimate interests;
• accounting and tax records, responding to requests from public authorities — to comply with obligations imposed by law.

5.2.You may withdraw consent at any time by writing to [Email для питань персональних даних і договору]. Withdrawal does not affect the lawfulness of processing carried out before it.

6.1.Data is stored on the servers of cloud hosting providers the Provider works with. The servers may be located outside Ukraine; in that case data is transferred in compliance with Article 29 of the Law of Ukraine “On Personal Data Protection”.

6.2.We apply the following safeguards:

• connections to the Site, the Panel and Telegram are encrypted (HTTPS/TLS);
• passwords, one-time codes and session tokens are stored only as hashes;
• businesses’ Telegram bot tokens are stored encrypted;
• staff access is limited by their role and by their own business — one business’s data is not accessible to another;
• sign-in attempts are rate-limited, and sign-in from a new device is confirmed with a code;
• important actions are recorded in the activity log.

6.3.No method of transmission or storage is completely secure, but we take reasonable organisational and technical measures, and we notify a business of any incident affecting its data without undue delay.

7.1.We keep data no longer than necessary for the purpose of processing:

• requests from the Site — up to 3 years from the last contact, or until consent is withdrawn if that happens earlier;
• business staff accounts — for the term of the contract with the business;
• client data, bookings and bot conversations — for the term of the contract with the business; after it ends, the data is deleted or returned to the business within 30 days, unless the law requires longer storage;
• the current state of a conversation with the bot — for a limited time, after which it expires and is overwritten by the next conversation;
• the activity log — separately from business data, for as long as needed to investigate incidents and resolve disputes;
• accounting documents — for the periods set by law.

8.1.We do not sell personal data or share it for advertising. Data may be received only by:

• Telegram — as the channel through which the business communicates with clients; conversations with the bot are also subject to Telegram’s terms;
• the hosting, database and cloud infrastructure providers the Service runs on;
• an email delivery service — for emails to business staff (invitations, sign-in codes, password recovery) and service notifications;
• the business the client books with — regarding that client’s data and bookings;
• public authorities — only in the cases and in the manner provided for by law.

8.2.Each of these parties receives only the data it needs to perform its function.

9.1.The Site uses no analytics, advertising or third-party tracking cookies. We use only strictly necessary ones:

• a language cookie — to show pages in the language you chose;
• an entry in the browser’s local storage (localStorage) with your chosen colour theme;
• in the Panel — a session cookie (HttpOnly) so you don’t have to sign in again, a known-device cookie so you are not asked for a confirmation code every time, and interface preferences (sidebar state, calendar view).

9.2.The corresponding features do not work without these files, so no separate consent is requested for them. You can delete them in your browser settings — you will then need to sign in to the Panel again and re-select your preferences.

10.1.Under Article 8 of the Law of Ukraine “On Personal Data Protection”, you have the right:

• to know the sources of collection and the location of your personal data, the purpose of its processing, and the controller or processor;
• to receive information about the conditions of access to the data, in particular about third parties to whom it is disclosed;
• to access your personal data;
• to receive an answer as to whether your data is processed, and its content, no later than 30 calendar days after the request is received, except as provided by law;
• to submit a reasoned demand to prohibit processing of your data or to change it;
• to have data corrected or destroyed if it is processed unlawfully or is inaccurate;
• to protection of your data against unlawful processing, accidental loss, destruction or damage;
• to withdraw consent to processing;
• to know how automated processing works and to protection against an automated decision that has legal consequences for you;
• to lodge complaints with the Ukrainian Parliament Commissioner for Human Rights or with a court.

10.2.To exercise your rights, write to [Email для питань персональних даних і договору]. We will reply within 30 calendar days and may ask you to confirm that the request comes from you.

10.3.Client requests concerning data related to bookings with a business are handled by the business as the controller (Section 3); we help it fulfil them.

10.4.If you believe your rights have been violated, you may lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or go to court.

11.1.The Site and the Panel are intended for business owners and staff. We do not knowingly collect, through the request form, the data of anyone under 18.

11.2.The bot does not check a client’s age. If a minor books through the bot, their data is processed on the business’s behalf in accordance with Section 3; the business can delete it in the Panel or contact us.

12.1.We may update this Policy. A new version is published on this page together with the date from which it applies.

12.2.We notify businesses that use the Service of material changes that affect them in advance by email.

13.1.For questions about personal data processing, write to [Email для питань персональних даних і договору] or call [Телефон]. The Provider’s details are given below.