Our privacy policy

Who we are

DutchCalendar is a service for scheduling appointments. Responsible for the data in this policy is DutchCalendar, a trade name of Tristan de Lange (Leeuwarden). You can reach us at info@dutchcalendar.com.

Two kinds of people use DutchCalendar, and that makes a difference:

• Businesses and their staff, with an account. We are responsible for their data.
• Customers who book an appointment with such a business. The business is responsible for their data; we process it on behalf of that business, under our data processing agreement.

If you have an account

If you have an account, we process:

• your name and e-mail address;
• your password, only as an unreadable hash. If you log in with a link by e-mail, we have no password;
• the details of your business, such as the name, the KvK number (Dutch Chamber of Commerce), addresses, your logo and your colour;
• your working hours, days off, appointment types and what you schedule, such as cars or rooms;
• your team: who is in it, with which role, and the e-mail address of the people you invite;
• your own video call link for online appointments, such as a fixed Zoom link, if you fill it in;
• if you connect DutchCalendar to your website: your API keys, only as a hash, and the addresses of your webhooks, with their secret encrypted;
• when you log in: a session, with the IP address and the browser you logged in with.

We use this data to make DutchCalendar work for you: that is the agreement we have with you. We use the IP address and the browser to secure your account; we have a legitimate interest in that.

Against abuse, we count how many appointments come in through your link. If unusually many come in at a new business, we get a notice with the name of the business and the owner's e-mail address, without any customer data. We have a legitimate interest in that too.

We only e-mail you about your account and your appointments, such as confirming your e-mail address, a new password or a new booking. No advertising.

If you book an appointment

If you book an appointment with a business through DutchCalendar, that business is responsible for your data. We process it on behalf of the business, only to arrange the appointment. It concerns your name, your e-mail address, your phone number if you fill it in, your answers to the questions of the business, and the appointment itself: what, when and with whom.

• The business and its staff see your appointment in their dashboard. If the staff member has connected a calendar, the appointment with your details is in that calendar too.
• You get a confirmation by e-mail, a reminder the day before, and a message if the appointment changes or is cancelled.
• If the appointment is online, you get the link of the video call: from Microsoft Teams, Google Meet or a fixed link of the staff member. Teams and Meet are made by the staff member's connected calendar, with the appointment that already goes there. What happens in the call itself falls under the service of that link.
• If the business connects DutchCalendar to its own systems, with our API or webhooks, your data goes there too. The business is responsible for that.
• We use your IP address only to stop abuse: for a few minutes we keep track of how often bookings are made from one address. We do not store it.
• Also against abuse, one e-mail address can make at most 5 appointments a day at the same business. For that we only look at the appointments already at that business.

Do you have a question about your appointment, or do you want to see or delete your data? Ask the business. If you e-mail us, we pass your question on to the business and help it to handle your request.

You can try DutchCalendar at two made-up businesses: Kapsalon Noor and Autobedrijf De Vries. There, we ourselves are responsible for what you fill in. We send you no e-mail, nothing goes into a calendar, and we delete it within 24 hours. A made-up name and address are fine too.

If you connect your calendar

Staff can connect their calendar from Google, Microsoft (Outlook, Hotmail and Microsoft 365) or Apple (iCloud). They don't have to. If you do, this is how it works:

What we read

The list of your calendars and their names. From the calendars you switch on: only the start and end of your events in the next two months, whether you are busy then, and whether you declined an invitation. Never the title, description, location or attendees of your events. iCloud sends the whole event; of that, we only use the start and end. With Google and Microsoft we also read whether a calendar can make a video call itself (Google Meet or Microsoft Teams).

What we write

Appointments made through DutchCalendar, in the calendar you choose, with the details of the customer. If the appointment type chooses Teams or Google Meet, the appointment asks your calendar to add a video call. We only change and delete events that DutchCalendar itself put in your calendar.

What we store

The access to your calendar (a token, or for iCloud an app-specific password), encrypted. The busy times of the next two months, which we replace on every update. And for each appointment we put in your calendar, a reference, so we can change it later, with the link of the video call if your calendar made one. We send that link to the customer.

What for

Only to keep customers from booking a time when you are already busy, and to put new appointments in your calendar. Not for advertising, not to train AI models, and we sell nothing. People don't look at it, unless you ask us for help, or it is needed for security or by law.

Disconnecting

You do that in your dashboard, under Agenda's (calendars). We then immediately delete the access, the busy times and the references, and at Google we also revoke our access. Appointments that are already in your calendar stay there: they are yours. You can also revoke the access in your Google, Microsoft or Apple account.

For each provider, we ask for this access:

• Google: calendar.events.owned, to view, create, change and delete events in calendars you own, and calendar.calendarlist.readonly, to see the list of your calendars.
• Microsoft: Calendars.ReadWrite, to read your calendars and put appointments in them, User.Read, for your name and e-mail address, so you see which account is connected, and offline_access, so the connection keeps working without you logging in again and again.
• Apple: an app-specific password that you create at Apple yourself, and can revoke there too.

DutchCalendar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you use the iPhone app

With the iPhone app you see your appointments on the go. On your phone, the app only keeps your login session, in the secure iOS keychain. It fetches appointments and customer data from us while you use the app, and it does not store them on your phone.

Just like on the website, we keep the IP address and the device you logged in with along with the session, for as long and for the same purpose. You see the session in your account under ‘Andere apparaten’ (other devices). The app only talks to our own server and uses no analytics, advertising or crash reporting services.

Who helps us

A few companies process data for us:

• TransIP (the Netherlands). Our server, the database with all data and the backups are at TransIP, in a data centre in the Netherlands.
• Resend (United States). Resend sends our e-mails, from Ireland, and for that receives the e-mail address, the name and the content of each e-mail. Resend keeps logs and data about the sending in the United States. That is allowed, because Resend takes part in the EU-U.S. Data Privacy Framework and has a data processing agreement with us.
• Google, Microsoft and Apple, only if you connect your calendar. We then exchange data with the provider of your calendar, as described above. What they do with it is in their own privacy policy.

So your customer data is stored in a database in Europe. We do not sell data, and give it to no one else, unless the law requires us to.

How long we keep data

• Your account and your business: as long as your account exists. If you delete your account, we delete your data. If you were the only one in your business, the business and all its appointments go with it. If you work in a team, your appointments stay with the business, under the name ‘Oud-medewerker’ (former staff member).
• Appointments of customers: as long as the business has an account. After that, we delete them.
• A login session, with IP address and browser: until you log out, or until the session expires after 30 days without use.
• Links in e-mails to log in or to confirm your address: until they expire.
• Invitations for your team: until a day after they are used or revoked, or 30 days after they expire.
• Busy times from your calendar: only those of the next two months, replaced on every update.
• Notifications to your webhooks: 30 days.
• Test bookings through the API: 30 days after the appointment.
• Appointments at the demos: at most 24 hours.
• Technical logs of our server, with IP addresses: at most 14 days.
• Backups: at most 30 days.

Cookies

We set no cookies on this website and on the booking pages. Only when you log in do we set a cookie that keeps you logged in, and while you connect a calendar one more, for ten minutes. They are needed to make the app work. We don't use cookies to track you or for advertising, and no analytics services. That is why we don't ask for your consent either.

Security

• Everything goes over an encrypted connection (https).
• The database can only be reached from our server. We manage that server only with a key, not with a password, and it gets security updates automatically.
• We store passwords and API keys only as a hash. The access to calendars and the secrets of webhooks are encrypted in the database.
• Each business only sees its own data, and within a business your role decides what you can do.
• If something does go wrong with data, we report it within 72 hours to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority), and to you if the risk to you is high.

Your rights

You may see your data, have it corrected or deleted, and get it in a file you can use elsewhere. You may also object to what we do with it, or ask us to limit its use for a while.

Much of this you do yourself in your dashboard: change your name, e-mail address and password, or delete your account. For the rest, e-mail info@dutchcalendar.com. We answer within a month. If you booked an appointment with a business, ask that business first.

If you disagree with how we handle your data, you may file a complaint with the Autoriteit Persoonsgegevens. We would like to hear it from you first, though.

If this policy changes

If something changes, we update this page and put the new date at the top. If it affects your data, such as a new company that processes data for us, and you have an account, we e-mail you about it in advance.

Google user data

DutchCalendar is a Dutch scheduling app. Businesses can connect their Google Calendar, so customers cannot book a time at which they are already busy, and so new appointments appear in their calendar. This is how we handle the data we receive from Google:

• Access: calendar.events.owned and calendar.calendarlist.readonly, only after the user connects their calendar.
• Use: we read the list of calendars and, from the calendars the user selects, only the start and end time and busy status of events in the next two months, never their title, description, location or attendees. We create events for appointments booked through DutchCalendar in the calendar the user chooses, with a Google Meet conference when the appointment type asks for one, and only change or delete those events. We also read whether a calendar allows Google Meet, and send the Meet link to the customer of the appointment.
• Storage: OAuth tokens are stored encrypted in our database in the Netherlands. Busy times are kept for the next two months only and replaced on every sync.
• Sharing: we do not sell or share Google user data, do not use it for advertising, and do not use it to develop, improve or train AI or machine learning models. No one reads it, unless the user asks us for help, or it is needed for security or by law.
• Deletion: disconnecting the calendar in the dashboard immediately deletes the tokens, busy times and references, and revokes our access at Google. Users can also revoke access at myaccount.google.com/permissions. Deleting the account deletes all of it.

DutchCalendar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Questions: info@dutchcalendar.com.