Data protection in your company

Every company that processes personal data, i.e. names, phone numbers or email addresses. For companies with customer appointments, this almost always applies. Processing is permitted, but you must fulfill certain obligations .

You must inform your customers that and why you store their data, for how long, on what legal basis, who is responsible, and what rights they have. Belbo does this automatically by email, with every online booking and as soon as you enter an email address in the calendar. For customers without an email address, make written information available at your business premises.

Yes, on your website and social media pages, clearly linked and easy to find. Your online booking also needs one. For this, Belbo offers the privacy assistant: you specify which features you use, and Belbo creates suitable terms for your booking page, optionally with your own additions.

Yes. Anyone who uses cloud software has data processed on their behalf and needs a contract with the provider for this. You can find the contract with Belbo in the account settings, where you conclude it electronically. This works with any login that has the contract rights.

That depends on how many people in your company regularly work with customer data and which data you process. Especially if you collect health data, it is best to have it checked by experts briefly. If you have appointed a person, enter them in Belbo, and they will automatically appear in your privacy policy.

An overview of which data you process, for what purpose, how long and on what legal basis. Every company that processes data should maintain one. Templates for this are offered, for example, by the chambers of skilled trades and commerce .

She may request at any time to learn which data you store about her and to have it deleted. Through online booking, your customers can securely retrieve their own data themselves. When a request comes in, you receive a message at your location's email address.

For tax reasons you must retain certain data for up to ten years, such as cash register data and financial statements. If someone requests deletion, the person is removed from your customer database, but the tax-relevant information remains in the financial statements. Belbo does not delete automatically after a set period; you decide that.

When you provide information on request, customers can see all the data you store about them. Remarks about punctuality, for example, therefore do not belong in the customer file. You can mark performance-related details such as color formulas, skin analysis results, device settings, or current strengths in EMS training as a trade secret. They will then not be displayed when a request is made. Please check carefully what actually falls under this in your industry .

Yes. Information about health, allergies, medication or pregnancy belongs to the special categories of personal data under Art. 9 GDPR. You should only collect what you really need for the treatment and obtain your clients' explicit consent. How exactly this has to look in your case is best clarified with a data protection consultant.

Your clients complete the medical history form on site on an iPad or in advance by email and sign digitally. This also documents their consent. For treatment series, you ask for the medical history again before each session; earlier versions remain preserved in the client file.

You decide that. Every login gets its own rights, and an employee login can be set up so that it cannot see any customer data at all.

Yes, changes to customer data are logged. 

Only if you connect Belbo yourself to an AI assistant via the MCP interface. The assistant can then access your account data, and individual fields cannot be excluded. Check beforehand whether this fits your privacy concept first.

Yes, if your customers have consented and you can prove it. Belbo only sends newsletters, birthday greetings, review requests and reactivation emails to customers with valid marketing consent, and every message contains an unsubscribe link.

Appointment reminders, confirmations and notices about changed opening hours are not advertising, as long as you do not add anything promotional. Birthday and holiday greetings, reactivation emails and review requests are considered advertising and require consent.

Those are also permitted with consent. Every SMS from Belbo contains a link to unsubscribe. For customers without an email address, you obtain consent in writing and upload the scan to the customer profile .

Then ask them again. The setup assistant in your Belbo calendar will help you with this. Anyone who uses exported customer data in another marketing tool must check the consents there themselves.

Everyone who works with customer data should know the rules. A signed confidentiality agreement is common; templates are available from the chambers. In Belbo, every login gets its own rights. Without the "Kundendatenbank" permission, staff can enter appointments but cannot view or export the entire customer database.

These are protected too. You may show photos and names of your team in online booking only with the consent of the person concerned. In Belbo, you can choose a display name instead of the full name and use an avatar instead of a photo.

In data centers in Germany, plus a physically separate backup in France, both within the EU. Transmission is encrypted end to end, and data is backed up regularly.

Yes, to Belbo as a processor. You must inform your customers of this; the privacy policy of your online booking takes care of the rest. All of Belbo's subprocessors are contractually bound to the GDPR. If you use additional services yourself, add them to the privacy policy of your online booking.

With two-factor authentication. For online bookings, you can additionally secure your customers' registration via SMS TAN or confirmation link .