Privacy Policy

We have not appointed a data protection officer because we do not meet the conditions in Article 37 GDPR. All privacy questions are handled at the address above.

This distinction matters because it decides who your request should go to.

• For the data of a business subscribing to the service, and for visitors to spotdrop.si, we are the controller.
• For customer data created by a booking with a particular business, we are a processor. The controller is the business you booked with. If you are a customer and want to exercise your rights, contact them directly; we will assist them, but we may not change or delete their data without their instruction.
• For subscription billing, invoicing and accounting we are a controller even where the data originated in bookings, because tax law requires it of us.

The relationship with a business is governed by the data processing agreement under Article 28 GDPR.

The SpotDrop app for Android and iOS is for the businesses using the service and their staff. You sign in with an existing account; accounts cannot be created in the app. The app shows and edits the same data as the web dashboard, so the purposes, legal bases and retention periods in this policy apply to it.

The app contains no ads, analytics or tracking libraries and sends no crash reports. It does not read your location, contacts, phone calendar or other files; it accesses photos only when you pick an image to upload. All data between the app and our servers is encrypted in transit (HTTPS). You can turn push notifications off at any time in your phone's settings.

How to request deletion of your account, and which data we are required to keep, is described on the Account deletion page.

Once a period ends we delete or irreversibly anonymise the data. It disappears from backups within 60 days of deletion from live systems at the latest.

We do not sell personal data and do not pass it on for anyone else's marketing. We share it only with the following processors, which act on our instructions under an Article 28 GDPR agreement:

Booking data is additionally received by the business you booked with, which cannot perform the service without it.

We may also disclose data to public authorities where the law requires it, and to lawyers and courts to the extent necessary to establish or defend legal claims.

The service runs on servers in the European Union. Some of our processors are US companies or have US affiliates, so transfers can occur. Those transfers rely on the European Commission's standard contractual clauses under Implementing Decision 2021/914, supplemented by measures such as encryption and access restrictions.

For data where we are the controller you have the right to:

• access your data and receive a copy (Article 15),
• have inaccurate data corrected (Article 16),
• erasure (Article 17) where we have no other basis to keep it,
• restriction of processing (Article 18),
• portability in a machine-readable format (Article 20),
• object to processing based on legitimate interests (Article 21); for direct marketing an objection always succeeds,
• withdraw consent at any time, which does not affect processing before the withdrawal.

Send your request to [email protected]. We answer within one month; for a complex or large request we may extend this by two months and will tell you. There is no charge, except for manifestly unfounded or repetitive requests. To delete your whole account, follow the steps on the Account deletion page.

If you are a customer and your request concerns a booking with a business, address it to that business. If they do not reply, write to us and we will pass it on.

A cookie is a small file a website stores in your browser. We use two kinds:

If you choose Decline, Google Analytics is not loaded. You can change your mind at any time by clearing this site's data in your browser, after which the banner appears again. We use no advertising cookies and no tracking pixels in email.

We use technical and organisational measures appropriate to the risk: encrypted transport (TLS), encryption at rest at our database provider, least-privilege access control, regular backups, network protection against abuse and access logging. Only a necessary few people can reach production data.

If a breach occurs that is likely to pose a risk to your rights, we notify the supervisory authority within 72 hours and, where the risk is high, you as well.

No system is perfectly secure, so please use a strong password and do not share it.

The service is not intended for children. A subscriber must be at least 18. A booking may be made by a person over 15; for anyone younger a parent or guardian must make it.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not profile for marketing.

A business's public page may run an assistant that answers questions about its offering. Your question is sent to the language model provider listed among the processors in order to produce an answer. That provider does not use the content to train its models. Please do not type anything into the conversation you would rather not share.

We may update this policy as the service or the law changes. Subscribers are notified of significant changes by email or in the dashboard at least 30 days before they take effect. The date of the last change is at the foot of this page.