Last updated: October 21, 2026
This Privacy Policy explains how we handle personal data collected through the Easy!Appointments website at https://easyappointments.org and when you contact us or buy our services. It does not cover the self-hosted Easy!Appointments software you run on your own server: when you self-host, you are the controller of the data in your own installation, and no data is sent to us.
Who is responsible for your data
The data controller for this website is Alex Tselegidis, trading as Easy!Appointments (sole proprietor).
- Address: Löwenstr. 34, 63067 Offenbach, Germany
- VAT identification number: DE305794612
- Contact: info@easyappointments.org
What we collect and why
| When | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| You visit the website | Standard server log data such as IP address, browser type, referring page, and timestamps | Operate and secure the website | Legitimate interests (Art. 6(1)(f)) |
| You allow analytics cookies | Usage data collected by Google Analytics (pages viewed, approximate location, device) | Understand traffic and improve the site | Consent (Art. 6(1)(a)) |
| You subscribe to the newsletter | Your email address, the time of your request and of your confirmation, and single-use confirmation and unsubscribe tokens | Send you the newsletter you asked for, using a double opt-in | Consent (Art. 6(1)(a)) |
| You use the contact or quote form | Name, email address, the services you select, and your message | Respond to your enquiry | Steps before a contract / legitimate interests (Art. 6(1)(b)/(f)) |
| You buy a service | Billing details and payment confirmation processed by Stripe; we receive order and invoice information, not full card numbers | Process your order, provide invoices, meet tax obligations | Contract / legal obligation (Art. 6(1)(b)/(c)) |
Cookies and consent
We load Google Analytics only after you opt in through our cookie banner. You can change or withdraw your choice at any time using the "Cookie Settings" link in the website footer. Declining analytics does not affect your ability to use the site.
Apart from analytics, this website stores the following in your browser. These are set by the website itself, are not shared with anyone, and are not used to profile you:
- cv-cookie-consent (browser local storage) - records your cookie choice and the time you made it, so the banner is not shown again. Kept until you clear your browser storage.
- blogSeen (browser local storage) - records the date of the newest blog post you have already seen, so the "new posts" dot in the navigation can be hidden. Kept until you clear your browser storage.
- ea-currency (browser local storage) - remembers the currency you picked for prices (EUR, USD or GBP). Kept until you clear your browser storage.
- Google Analytics cookies (for example _ga, _gid) - set by Google only if you allow analytics. When you withdraw consent we stop further analytics requests and remove these cookies on a best-effort basis.
Spam protection
Our contact, quote, and newsletter forms use Cloudflare Turnstile to detect automated abuse. Turnstile processes technical signals from your browser to confirm you are a human, and when we verify a submission your IP address is sent to Cloudflare as part of that check. This is necessary to protect our forms from spam (legitimate interests, Art. 6(1)(f)). The Turnstile script is currently loaded on every page of this website, and it runs when the page loads rather than only when you submit a form.
Content loaded from third-party networks
Some page assets are not served from our own servers, so your IP address and basic browser information reach those providers when a page loads. These requests currently happen when the page loads, before you make a cookie choice:
- jsDelivr - the Bootstrap Icons stylesheet and icon font files (cdn.jsdelivr.net).
- Shields.io - the GitHub star, fork, and download badge images shown on the home page (img.shields.io).
- Cloudflare - the Turnstile script described above (challenges.cloudflare.com).
- Stripe - the payment library used by our checkout (js.stripe.com).
Service providers we share data with
We use the following processors to run the website and services. Each processes data only on our instructions and under appropriate safeguards:
- Stripe - payment processing and invoicing.
- Google Analytics (Google) - website usage analytics, loaded only with your consent.
- Cloudflare (Turnstile) - spam and abuse protection on our forms.
- jsDelivr - delivery of the icon stylesheet and icon fonts.
- Shields.io - delivery of the GitHub badge images on the home page.
- Our email and hosting providers - to deliver the website, send transactional emails, and store enquiry correspondence.
We do not sell your personal data, and we do not use it for third-party advertising.
International transfers
Some of these providers may process data outside your country, including in the United States. Where that happens, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.
How long we keep data
We keep enquiry correspondence for as long as needed to handle your request and a reasonable period afterwards. We keep order and invoice records for the statutory retention period, which in Germany is up to 10 years (Section 147 AO, Section 257 HGB). Analytics data is retained according to our Google Analytics configuration. We delete or anonymise data when it is no longer needed.
Newsletter records are kept until you unsubscribe; using the unsubscribe link in any newsletter email deletes your record. For each issue we send, we keep a log of the addresses it went to, so an interrupted send never mails anyone twice; an address stays in those logs after you unsubscribe, and we remove it on request. Subscribers carried over from our previous website keep their original opt-in date as the record of their consent. A subscription request that is never confirmed is not deleted automatically - email us and we will remove it.
To limit form abuse, our server records the IP address of form and checkout requests together with the time of each request. These entries are removed once they fall outside the relevant throttling window (currently 24 hours for the contact form and one hour for the newsletter and checkout endpoints), the next time that endpoint is used.
Data we process on your behalf (hosting and migration)
If you purchase Managed Hosting or Data Migration, we may process personal data contained in your Easy!Appointments installation on your behalf. In that case you are the controller and we act as your processor. We process such data only to provide the service, and a data processing agreement is available on request at info@easyappointments.org.
Your rights
Subject to applicable law, you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent at any time (without affecting processing already carried out). To exercise any of these rights, email info@easyappointments.org. You also have the right to lodge a complaint with a data protection authority. Our competent supervisory authority is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit); you may also contact the authority where you live.
Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS) and trusted payment infrastructure. No method of transmission or storage is completely secure, but we work to protect your information and to limit access to it.
Changes to this policy
We may update this policy from time to time. The "Last updated" date above shows when it last changed. Significant changes will be highlighted on this page.
Contact
For any privacy question or request, contact us at info@easyappointments.org.