Terms for businesses

This is a translation. In case of discrepancy, the Italian version prevails.

They apply to businesses that turn on AgendaCRM’s online booking, and are accepted in the app before turning it on. They also contain the agreement under which I hold your clients’ requests on your behalf.

In brief

AgendaCRM is free. Clients, appointments and stock stay on your device and on your Google Drive.
The booking page is yours: what you write on it is your choice and your responsibility.
Anyone can report to me a page they believe to be unlawful. If I suspend one, I write to you saying what, why and how to challenge it.
Your clients’ requests are held by me on your behalf, in a sealed envelope, for 7 days at most.

1. Who provides the service

AgendaCRM is developed and run by Andrea Salvatore Palla (in these terms, “I”). The terms apply between me and the business that turns on online booking (“you”). Whoever accepts them declares that they can bind the business.

The single point of contact, for users of the service and for the authorities of the Member States, the European Commission and the European Board for Digital Services (Articles 11 and 12 of Regulation (EU) 2022/2065), is info@offlineagendacrm.it. You can write in Italian or in English.

2. The service

AgendaCRM is a free web application for anyone who works by appointment: diary, clients, stock and staff chat. The business’s data lives on its devices and, if it chooses, on the owner’s Google Drive.
Online booking is optional. It publishes a page at the address offlineagendacrm.it/prenota/ followed by the name you choose, with what you decide to show (business name, services, bookable people, free times), and collects your clients’ requests.
The service is meant for people who run a business: companies, professionals, associations.

3. Your page

What you publish (business name, address, phone, services, prices, people’s names, link to your privacy notice) is your choice and your responsibility.
The page presents only your business, with true information. It may not contain unlawful content, offer services prohibited by law, use other people’s names or trademarks without the right to do so, or other people’s personal data without a legal basis.
You explain to your clients how you handle their data: the page shows the link to your privacy notice, if you enter it.
You choose the page’s name, if it is free. It may not suggest that the page belongs to someone else.

4. Reports

Anyone can report to me content they believe to be unlawful on a booking page: at the bottom of every page there is “Report this page”, which prepares an email to info@offlineagendacrm.it. You can also write directly.
The report gives the exact address of the page, the reason the content is thought to be unlawful, the name and email of whoever reports, and contains the statement of good faith that the information is accurate and complete (Article 16 of Regulation (EU) 2022/2065).
I confirm receipt. I examine every report myself, without automated systems, in a timely, diligent and objective way, and I tell whoever sent it the decision, with the means to challenge it.

5. When a page is suspended

I remove or disable access to a page, or part of it, only if the content is unlawful or contrary to point 3: after a report, after an order from an authority, or if I notice it myself.
I remove only what is needed. When it is enough, I ask you to correct it first.
At the latest when the suspension takes effect, I write to your account email saying what I removed, why, on what facts and which rules, whether it came from a report, and how you can challenge it: by replying to that email, and I will review the decision, or before a court (Article 17 of Regulation (EU) 2022/2065).
The suspension concerns only the public page. The data on your devices and on your Drive I do not touch, and could not.
If an authority orders me to act on a page, I carry out the order and tell you, unless the order forbids it.

6. Data processing agreement

When online booking is on, I process on your behalf some data of your clients and your staff. For that data you are the controller and I am the processor. This point is the agreement required by Article 28(3) of Regulation (EU) 2016/679. For everything else (your account, server logs, emails) I am the controller, as the privacy notice explains.

What I do, for how long

Purpose: receiving your clients’ booking requests, holding them until one of your devices collects them, and delivering to your staff’s devices the notifications that announce them.
Duration: as long as booking is on. Each request stays on the server until collected, 7 days at most.

Which data, of whom

People who book (your clients and potential clients): name, phone, email, notes and the service chosen. They travel in a sealed envelope, encrypted in their browser with your business’s key: the key to open it is only on your devices and on your Drive, and I cannot read them.
Outside the envelope, so as not to give the same time twice: day, time, duration, and the identifier of the staff member and of the resource (treatment room, room, equipment). Never the names.
Your staff: the content of notifications, encrypted for the device that receives them, which I cannot read.
I do not ask for special categories of data. If a client writes them in the notes, they stay in the sealed envelope.

How I process them

Instructions. I process the data only for the purposes above, following your instructions: these terms and the choices you make in the app. If an instruction seems to me contrary to the law, I will tell you. If a law obliges me to process them differently, I will tell you beforehand, unless the law forbids it.
Confidentiality. Only I access the server’s data. Anyone who helps me in future will be bound to confidentiality.
Security (Article 32): requests are encrypted in the browser of whoever books; connections are encrypted; the database is in the European Union; the server logs contain no request data; uncollected requests delete themselves after 7 days.
Assistance. I help you, as far as I can, to reply to people exercising their rights and to comply with Articles 32–36. Collected requests are in your archive, and you manage them there. If one of your clients writes to me, I reply that you are the controller and forward the request to you.
Breaches. If I discover a breach of the data I process for you, I notify you at your account email without undue delay, within 48 hours, with the information in Article 33(3) that I have available.
Audits. I give you the information needed to demonstrate compliance with Article 28 and allow audits, including inspections, by you or someone you appoint, agreed in writing with reasonable notice.

Who helps me

You give me a general authorisation to use other processors, with the same data protection obligations. Today they are:

Cloudflare, Inc.	server, database (in the European Union) and delivery of the pages; it sees the sealed envelopes, not the content
Browser notification services	Google, Apple, Mozilla or Microsoft, depending on the browser of your staff’s devices: they deliver the encrypted notifications, without being able to open them

I write to you at least 30 days before adding or replacing one: you can object by replying to the email, or turn booking off. Cloudflare is based in the United States: the transfer relies on the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) and, failing that, on the standard contractual clauses.

At the end

When you turn booking off or delete the account, the page and the uncollected requests are deleted from the server immediately; in the database backups they remain for 7 days at most. Collected requests are already in your archive.

7. Duration, changes and ending

The terms apply as long as online booking is on. You turn it off whenever you like, from Settings → Online booking.
I can stop online booking with at least 30 days’ notice, by email. Without notice only if the law or an authority requires it, or for a serious security problem.
If I change the terms, the new version carries a new date: I write to you and the app asks you to accept it. Until you accept, the page does not update, and after 7 days it stops receiving requests.
Italian law and European Union law apply.

Version of 14 October 2026.