Privacy policy

Version of 9 November 2026.

This document explains which personal data we process on zapisum.com and in the app.zapisum.com application, why, for how long, and what your rights are. It has been prepared in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

This is a translation. In case of discrepancies, the Polish version prevails.

1. Data controller

  1. The controller of personal data is Rebel Code sp. z o.o., pl. Bankowy 2, 00-095 Warszawa, Poland, KRS: 0000962361, tax ID (NIP): 1182239077 (“Operator”, “we”).
  2. We have not appointed a Data Protection Officer. For any matter concerning personal data, write to gdpr@zapisum.com.

2. Who this policy applies to

  1. Visitors to zapisum.com.
  2. Businesses and people who created a Zapisum account (“Customers”) and people given access to the panel by a Customer (“Users”).
  3. People who book appointments with Customers through a Zapisum booking page (“Bookers”). The controller of their data is the Customer they book with; we process it on the Customer’s behalf as a processor (see section 13).

3. Purposes and legal bases

  1. Creating and maintaining the account, providing the service and performing the contract, including the trial — Art. 6(1)(b) GDPR.
  2. Invoicing and accounting — Art. 6(1)(c) GDPR in connection with tax and accounting law.
  3. Answering messages and requests, handling complaints, keeping the service secure, establishing and defending legal claims — Art. 6(1)(f) GDPR (our legitimate interest).
  4. Account-related e-mails (address confirmation, password change, end of trial, changes to the terms) — Art. 6(1)(b) and (f) GDPR.
  5. Integration with Google, Microsoft or Apple calendars — only at your request, when you connect a calendar in the panel — Art. 6(1)(b) GDPR.
  6. Analysing traffic on zapisum.com (Matomo) — only with your consent — Art. 6(1)(a) GDPR.
  7. Keeping proof of your consent decision — Art. 6(1)(c) GDPR in connection with Art. 7(1) GDPR (duty to demonstrate consent).

4. What data we process

  1. Account data: business name, first name, e-mail address, password hash (we never store the password itself), panel language.
  2. Sign-in with Google — if you create an account or sign in with Google, we request only the openid, email and profile permissions. We receive your Google account ID, e-mail address and name; we use them only to create your account and sign you in, and we store the Google account ID and e-mail address. We do not store your profile picture. This data is covered by the rules for information received from Google APIs described in section 5.
  3. Billing data: company name, address, tax ID, payment history.
  4. Data the Customer enters into the system: services and prices, working hours, people and workstations, logo, photos, message content.
  5. Bookers’ data (on the Customer’s behalf): name, e-mail address, phone number, chosen service and time, answers in the booking form, booking change history.
  6. Technical data: IP address and browser information in server logs, the cookies described in section 10 and, with your consent, information about your visits collected by Matomo.

5. Data from Google, Microsoft and Apple calendars

  1. Connecting a calendar is optional. A Customer or User does it in the panel for a chosen team member. Without a connection Zapisum works normally; it just cannot see busy times from the external calendar.
  2. Google Calendar — we request these permissions: the Google account’s e-mail address (userinfo.email), to show which account is connected; the list of calendars (calendar.calendarlist.readonly), so you can choose a calendar; free/busy information (calendar.freebusy), i.e. only the time ranges in which you are busy — without titles, descriptions or attendees of your events; and management of events created by Zapisum (calendar.events.owned), to add appointments booked in Zapisum to the chosen calendar, update them when rescheduled, delete them when cancelled and, for online appointments, attach a Google Meet link.
  3. Microsoft Outlook / Microsoft 365 — we request: User.Read (account e-mail address and name), Calendars.ReadWrite (reading busy times and managing appointment events created by Zapisum) and offline_access (keeping the connection without signing in again).
  4. Apple Calendar (iCloud) and other CalDAV calendars — we connect using the server address, login and app-specific password you enter in the panel.
  5. How we use this data: solely so that the booking page does not offer times when you are busy, and so that booked appointments appear in your calendar. We do not use it for any other purpose.
  6. What we store: encrypted access tokens or app-specific password, the ID and name of the chosen calendar, the connected account’s e-mail address and the IDs of events created by Zapisum. Free/busy information is fetched at the moment available times are calculated and is not stored.
  7. Who we share it with: no one. We do not sell this data, do not use it for advertising, profiling or training artificial intelligence models, and do not transfer it to third parties except where required by law. Our staff do not read this data unless you agree (e.g. when reporting a problem), it is necessary for security purposes, or it is required by law.
  8. Zapisum’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy
  9. How to disconnect: in the Zapisum panel, in the settings of the team member. On disconnecting we immediately delete the tokens and revoke them with the provider. You can also revoke access directly: Google — https://myaccount.google.com/permissions, Microsoft (personal account) — https://account.live.com/consent/Manage, Microsoft (work account) — https://myapps.microsoft.com, Apple — by deleting the app-specific password in your Apple ID settings.

6. Whether providing data is required

  1. Providing data at sign-up is voluntary but necessary to create an account and use the service.
  2. Billing data is a statutory requirement if you want to receive an invoice.
  3. Connecting a calendar is entirely optional.

7. Your rights

  1. Right of access to your data and to receive a copy.
  2. Right to rectification.
  3. Right to erasure. You can delete your account yourself in the panel (see section 8).
  4. Right to restriction of processing.
  5. Right to data portability.
  6. Right to object to processing based on our legitimate interest.
  7. Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
  8. Please send requests to gdpr@zapisum.com. If you booked an appointment with one of our Customers, the best place to send your request is that Customer — they are the controller of your data; we will also forward any such request we receive.
  9. Right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority of your country.
  10. We do not make automated decisions or carry out profiling.

8. How long we keep data

  1. Account data — for the duration of the contract. Once you request account deletion in the panel, the booking page stops accepting appointments immediately, and the account with all its data is permanently deleted after 30 days. Until then you can reverse the decision.
  2. Bookers’ data — until the Customer’s account is deleted, but no longer than the period set by the Customer (3 years after the appointment by default). After that the booking is anonymised automatically: we remove the name, e-mail address, phone and form answers.
  3. Calendar data — until the calendar is disconnected or the account is deleted.
  4. Billing documents — for the period required by tax law (as a rule 5 years from the end of the tax year).
  5. Correspondence — for as long as needed to handle the matter and then until any claims become time-barred.

9. Recipients

  1. The provider of the server infrastructure Zapisum runs on.
  2. The e-mail delivery provider we use to send system messages, confirmations and reminders.
  3. We host Matomo analytics and the consent register ourselves, on our own infrastructure. We share analytics data with no one.
  4. Our accounting office and invoicing system provider — to the extent necessary for billing.
  5. Google, Microsoft or Apple — only when you connect a calendar yourself, and only as described in section 5.
  6. Entities authorised by law, in particular tax authorities, courts and law enforcement — only at their request.
  7. Every entity processing data on our behalf does so under a data processing agreement and only on our documented instructions.

10. Cookies and browser storage

  1. zapisum.com uses necessary cookies and — only with your consent — Matomo analytics cookies. We do not use Google Analytics, Google Tag Manager or any advertising tools.
  2. We run analytics in Matomo, which we host ourselves. Until you consent, Matomo collects nothing: it sends no request and sets no cookies.
  3. cc_cookie — necessary cookie, kept for 182 days. Stores your consent choice and consent ID.
  4. NEXT_LOCALE — necessary cookie that remembers the chosen site language.
  5. _pk_id — Matomo analytics cookie, kept for 13 months. Recognises a returning visitor. Only after consent.
  6. _pk_ses — Matomo analytics cookie, kept for 30 minutes. Keeps the current visit together. Only after consent.
  7. _pk_ref — Matomo analytics cookie, kept for 6 months. Remembers where you came to the site from. Only after consent.
  8. zapisum:currency — browser storage entry (localStorage) that remembers the currency chosen in the pricing section. It is never sent to the server.
  9. wizyty_session — necessary cookie in app.zapisum.com that keeps you signed in to the panel. It is encrypted and not accessible to scripts on the page.
  10. Necessary cookies do not require consent, as the site and panel would not work properly without them.
  11. You can change or withdraw your consent at any time via “Cookie settings” in the site footer. Withdrawing is as easy as consenting and immediately deletes the Matomo cookies. It does not affect the lawfulness of processing before withdrawal.

11. Consent register

  1. We record each of your consent decisions as proof that consent was given, changed or withdrawn (Art. 7(1) and Art. 5(2) GDPR).
  2. We record: the consent ID assigned to your browser, the version of this policy, the chosen categories and services, the site language, browser information (User-Agent), the page address without parameters, a timestamp and a hash of your IP address.
  3. The IP address is stored only as an irreversible, salted cryptographic hash. The raw IP address is not stored.
  4. Entries are kept for 5 years from the last change of the given consent and then deleted.
  5. The register contains no data that lets us identify you directly. You will find your consent ID in “Cookie settings” — by providing it you can request access to or deletion of your saved consents.

12. Transfers outside the EEA

  1. We process data on infrastructure located in the European Economic Area — this includes Matomo analytics and the consent register.
  2. If you connect a Google, Microsoft or Apple calendar, data is exchanged with that provider at your request. These providers may process data outside the EEA under standard contractual clauses approved by the European Commission or an adequacy decision (EU-US Data Privacy Framework).

13. Zapisum as a processor

  1. For Bookers’ data and other data the Customer enters into the system, the Customer is the controller and the Operator is the processor under the data processing agreement contained in the Terms of Service.
  2. We process this data solely to provide the service and on the Customer’s documented instructions.

14. Security

  1. Connections to the site and the application are encrypted (HTTPS). Passwords are stored only as hashes, and calendar tokens and passwords are encrypted.
  2. Only the Customer and the Users the Customer has granted access can see data in the panel.

15. Changes to this policy

  1. This policy may change, in particular when the service’s features, the tools we use or the law change. Each version is dated below the title.
  2. We will inform Customers about material changes by e-mail.

16. Contact

  1. Data protection matters: gdpr@zapisum.com.
  2. Other matters: support@zapisum.com, phone +48 507 058 755.