Tarrez Privacy Policy

1. Introduction

This Privacy Policy explains how Tarrez ("Tarrez", "we", "us", or "our") collects, uses, stores, and otherwise processes personal data when you:

• visit the Tarrez website;
• submit an application to use Tarrez;
• communicate with us;
• use Tarrez as a business customer; or
• interact with a booking website or service powered by Tarrez.

Tarrez provides software and online services exclusively to businesses and professional users.

We are committed to handling personal data responsibly and in accordance with applicable data-protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), where applicable.

At present, Tarrez is operated under the name Tarrez and has not yet been registered as a separate legal entity.

Contact

If you have any questions regarding this Privacy Policy or the processing of your personal data, you can contact us using the email address above.

2. What Personal Data We Collect

The personal data we collect depends on how you interact with Tarrez.

2.1 Application Data

When you apply to use Tarrez, we may collect:

• First name;
• Last name;
• Business email address;
• Business name;
• Business VAT identification number;
• Business type;
• Country; and
• Selected Tarrez plan.

We collect this information because Tarrez is a business-to-business service and needs information about the applicant and their business in order to review applications and establish and manage a customer relationship.

2.2 Customer and Account Information

If you become a Tarrez customer, we may process information necessary to:

• manage your customer account;
• provide your selected Tarrez plan;
• configure and operate your service;
• manage your subscription;
• communicate with you;
• provide customer support;
• manage payments and billing; and
• maintain records necessary for legal and business purposes.

2.3 Communication Information

If you contact Tarrez, we may process the information contained in your communication.

You may contact us through:

• email;
• our contact form; or
• social media.

Depending on the communication, this may include your name, email address, social-media account information, message content, and any other information you choose to provide.

2.4 Booking Information

Tarrez provides booking software that allows businesses to offer appointments to their customers.

When an individual makes a booking through a Tarrez-powered booking website, the booking system may process information such as:

• full name;
• phone number;
• email address, if provided;
• selected service;
• appointment date;
• appointment time; and
• booking status.

This information is submitted by the individual making the booking and is processed through the Tarrez platform for the business operating the relevant booking website.

3. Tarrez's Role Regarding Booking Data

It is important to distinguish between Tarrez's own processing and the processing of booking information on behalf of our business customers.

When a business uses Tarrez to operate its booking system, that business generally determines:

• why customer information is collected;
• what information is collected;
• how the information is used; and
• how long the information should be retained.

For this type of processing, the business generally acts as the data controller, while Tarrez generally acts as the data processor.

For example, if a customer books an appointment with a business through a Tarrez-powered website, the business is generally responsible for deciding why the customer's name, phone number, email address, and appointment information are processed.

Tarrez processes this information in order to provide the booking and appointment-management service to that business.

The processing of booking data is governed by the applicable Data Processing Agreement (DPA) between Tarrez and the relevant business customer.

Tarrez does not use individual booking information for its own advertising, marketing, or behavioral profiling.

4. How We Use Personal Data

Depending on the circumstances, Tarrez may use personal data for the following purposes.

4.1 Processing Applications

We use application information to:

• review applications;
• communicate with applicants;
• verify business information where appropriate;
• determine the requested Tarrez plan;
• create customer accounts; and
• take steps toward establishing a customer relationship.

4.2 Providing Tarrez Services

We use customer information to:

• provide the Tarrez service;
• configure and manage customer accounts;
• provide booking functionality;
• provide websites and booking pages;
• manage subscriptions;
• provide customer support;
• communicate important service information; and
• maintain and secure our services.

4.3 Billing and Payments

Tarrez uses Stripe to assist with billing and payment-related activities.

Information submitted during the Tarrez application process may be provided to Stripe for purposes including:

• creating or configuring a customer profile;
• billing;
• payment processing;
• subscription administration;
• tax-related information; and
• maintaining payment records.

The information provided to Stripe may include your name, email address, business name, VAT identification number, country, business type, and selected plan.

Stripe may process personal data under its own privacy terms and may act as an independent controller for certain processing activities.

4.4 Communications and Support

We process information contained in communications with us in order to:

• respond to questions;
• provide support;
• investigate issues;
• communicate about your account or service;
• respond to requests; and
• maintain records of relevant business communications.

4.5 Security and Legal Purposes

We may process personal data where necessary to:

• protect the security of Tarrez;
• detect and prevent fraud or abuse;
• investigate security incidents;
• enforce our agreements;
• establish, exercise, or defend legal claims;
• comply with legal obligations; or
• protect our rights and legitimate business interests.

5. Legal Bases for Processing

Where the GDPR applies, Tarrez processes personal data using the legal basis appropriate to the specific processing activity.

These may include:

Performance of a contract or steps before entering into a contract

We may process information where it is necessary to take steps requested by an applicant before entering into a contract or to perform a contract with a customer.

Legal obligations

We may process personal data where necessary to comply with legal obligations, including applicable tax, accounting, financial, or regulatory requirements.

Legitimate interests

We may process personal data where necessary for our legitimate interests, such as:

• operating and securing our services;
• preventing fraud and abuse;
• communicating with customers;
• maintaining business records;
• improving service reliability; and
• establishing, exercising, or defending legal claims.

Where we rely on legitimate interests, we consider the rights and interests of the affected individual.

Consent

Where we specifically rely on consent as the legal basis for processing, we will request consent in an appropriate manner.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn and does not affect processing that has another valid legal basis.

6. Application Consent

Our application form includes a consent checkbox relating to the processing of personal data for the application and the use of third-party services.

The existence of this checkbox does not mean that every processing activity carried out by Tarrez is necessarily based on consent.

Different processing activities may have different legal bases, as described in this Privacy Policy.

7. Booking Data Retention

Tarrez is designed to minimize the retention of identifiable booking information.

Individual booking records are retained for the period necessary to provide the relevant booking and appointment-management functionality.

When the relevant booking period has passed, identifiable booking information is automatically removed from the active booking system and is no longer available through the business dashboard.

Tarrez does not intentionally retain individual booking information indefinitely.

Tarrez also does not use identifiable booking information for its own advertising, marketing, or behavioral profiling.

Technical backups, logs, or infrastructure copies may be subject to separate retention periods determined by the relevant infrastructure provider. Where such copies exist, they may not be immediately deleted at exactly the same time as information is removed from the active application.

8. Aggregated Analytics

Certain Tarrez plans include business analytics features.

These features may provide information such as:

• number of bookings;
• customer counts;
• service popularity;
• average service duration;
• revenue information;
• historical booking statistics; and
• other business-performance information.

Tarrez is designed so that historical analytics do not display individual customers' names, phone numbers, or email addresses.

The underlying identifiable booking records may be deleted while aggregated statistics remain available for historical business reporting.

Where information has been genuinely anonymised so that an individual can no longer be identified, that information is no longer personal data under the GDPR.

Until information has been properly anonymised, Tarrez will treat it as personal data where required by applicable law.

9. Where Data Is Stored

Tarrez uses Lovable Cloud as part of the cloud infrastructure used to operate the Tarrez application and store data processed through the platform.

This may include:

• application data;
• customer account information;
• booking information;
• analytics-related information; and
• other information required to operate the Tarrez service.

Access to Tarrez data is restricted to authorized Tarrez personnel.

Tarrez does not currently permit customer businesses to connect their own external applications or integrations to the Tarrez platform.

The specific hosting region used by the Tarrez application may depend on the configuration of the relevant Lovable Cloud environment.

Tarrez will use appropriate contractual and technical measures for the processing of personal data by cloud infrastructure providers.

10. Third-Party Service Providers

Tarrez relies on selected third-party providers to operate its services.

10.1 Lovable Cloud

Tarrez uses Lovable Cloud for application infrastructure, including cloud hosting and data storage.

Lovable provides infrastructure and services used to operate applications built through its platform.

Where Lovable processes personal data on Tarrez's behalf, the relevant processing will be subject to appropriate contractual and data-protection arrangements.

10.2 Stripe

Tarrez uses Stripe for billing and payment-related services.

Stripe may process information provided by Tarrez for customer profiles, payments, subscriptions, tax information, fraud prevention, and related purposes.

Stripe may process personal data under its own privacy documentation and contractual arrangements.

Tarrez does not intentionally send end customers' booking information to Stripe merely because those customers make bookings through a Tarrez-powered website.

11. International Transfers

Some service providers used by Tarrez may process personal data outside the European Economic Area.

Where personal data is transferred to a country outside the EEA and applicable law requires a transfer mechanism, Tarrez will use an appropriate legal safeguard, such as:

• an adequacy decision;
• Standard Contractual Clauses;
• another legally recognized transfer mechanism; or
• another safeguard permitted under applicable data-protection law.

The location of data processed through Lovable Cloud may depend on the region selected for the relevant environment.

Tarrez will not intentionally make international transfers of personal data without an appropriate legal basis where one is required.

12. Data Security

Tarrez takes reasonable technical and organizational measures designed to protect personal data against:

• unauthorized access;
• unauthorized disclosure;
• accidental loss;
• destruction;
• alteration; and
• other unauthorized or unlawful processing.

Access to Tarrez systems and stored information is restricted to authorized persons.

Tarrez also uses security measures provided by its cloud infrastructure and payment service providers.

However, no online service, storage system, or method of transmitting information over the Internet can be guaranteed to be completely secure.

If Tarrez becomes aware of a personal-data breach requiring notification under applicable law, Tarrez will take the required steps to investigate, contain, and address the incident and make any notifications required by law.

13. Data Retention for Tarrez Customers

Tarrez retains customer and application information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

When a customer cancels or the contractual relationship ends, Tarrez intends to delete personal data that is no longer necessary for providing the service.

Certain information may nevertheless need to be retained where necessary for:

• tax or accounting requirements;
• legal obligations;
• fraud prevention;
• establishing, exercising, or defending legal claims; or
• other legitimate legal purposes.

Once such information is no longer required, it will be deleted or otherwise handled in accordance with applicable law.

14. Your Rights

Where the GDPR applies, you may have the right to:

• obtain confirmation as to whether we process your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing;
• request data portability where applicable;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a supervisory authority.

These rights are not absolute and may be subject to conditions and exceptions provided by applicable law.

15. How to Exercise Your Rights

To exercise your rights or ask questions about our processing of personal data, contact:

Please provide enough information for us to understand your request.

We may need to verify your identity before responding to certain requests.

Where a request is made under the GDPR, Tarrez will handle it within the applicable statutory time limits.

16. Complaints

If you believe that Tarrez has processed your personal data unlawfully, we encourage you to contact us first so that we can investigate and attempt to resolve the matter.

You also have the right to lodge a complaint with the competent data-protection supervisory authority.

For Poland, the relevant supervisory authority is the:

President of the Personal Data Protection Office (UODO) — Urząd Ochrony Danych Osobowych

17. Marketing

Tarrez does not currently send marketing newsletters or promotional communications.

We may send communications that are necessary for operating the service, such as:

• application-related communications;
• account-related messages;
• billing or payment information;
• service notices;
• security notifications; and
• responses to support requests.

These operational communications are not marketing communications.

If Tarrez begins sending marketing communications in the future, we will comply with applicable marketing and data-protection requirements.

18. Automated Decision-Making and Profiling

Tarrez does not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals.

Tarrez does not create behavioral advertising profiles of booking customers.

19. Children's Data

Tarrez is a business-to-business service and is not directed toward children.

Tarrez does not knowingly collect children's personal data through its own application process.

Businesses using Tarrez are responsible for ensuring that their own services, booking processes, and customer-facing privacy practices comply with applicable laws concerning children where relevant.

20. Changes to This Privacy Policy

We may update this Privacy Policy when necessary to reflect:

• changes to our services;
• changes to our data-processing practices;
• changes to third-party providers;
• changes in applicable law; or
• changes to our security or operational practices.

When we update this Privacy Policy, we will change the "Last updated" date at the beginning of the document.

Where required by law, we will provide additional notice regarding material changes.

21. Contact

For questions, requests, or concerns relating to this Privacy Policy or the processing of personal data, contact: