Privacy Notice

Slota provides appointment-booking and business-management software. Questions about this notice, privacy requests or concerns about how Slota uses personal data can be sent through our contact page. Businesses using Slota remain responsible for their own privacy information and legal obligations to their customers and staff.

For information Slota uses for its own purposes — such as business-account registration, platform billing, security, support enquiries and administration of the Slota service — Slota acts as a controller and decides why and how that information is used.

Where a business uses Slota to store and manage information about its customers, appointments or staff for that business's purposes, the business will generally be the controller and Slota acts as its processor. The business decides what information it collects, why it uses it, how long it needs it and the lawful basis for doing so.

Depending on how Slota is used, this can include names, email addresses, telephone numbers, account identifiers, authentication information, business details, staff profiles, roles, working hours, holidays and availability, customer records, appointment details, services, prices, booking history, cancellation or rescheduling information, reviews, communications preferences, support messages and records of platform activity.

We may also process technical and security information such as IP address, browser/device information, timestamps, authentication/session information, error and diagnostic information, and identifiers needed to prevent abuse and operate the service.

For billing and online payments, payment providers may process card and payment information. Slota does not need to store a customer's full card number or CVC in its application database.

We receive information directly from account holders, staff members and people who contact us; from customers who use a Slota booking page; from businesses that enter or import customer, staff, service and appointment information; and automatically from devices and systems when the service is used. Payment and authentication providers may also return limited status, account or transaction information needed to operate those features.

Contract: where processing is necessary to create and administer an account, provide the Slota service, process platform billing, provide requested support or otherwise perform a contract or take requested steps before entering one.

Legitimate interests: where necessary to operate, secure, maintain and improve Slota; prevent fraud and misuse; keep appropriate business records; understand and resolve technical problems; and protect Slota, its users and others. We consider the impact on individuals before relying on this basis.

Legal obligation: where information must be processed or retained to comply with applicable law, tax/accounting requirements, regulatory requests or lawful orders.

Consent: where the law requires consent, for example for certain optional communications or non-essential storage/access technologies if introduced. Consent can be withdrawn at any time, without affecting processing already carried out lawfully.

When Slota acts only as a processor for a business, the business is responsible for identifying the lawful basis for its processing of customer and staff information.

Businesses can use Slota to manage bookings, customers, staff, rotas, time off, services, communications and related records. Customers may provide information when making a booking and may use secure links to manage an appointment where the business enables those features. Staff may access information relevant to their work through the Staff Portal.

Businesses should only enter, import or otherwise process personal data they are entitled to use and should avoid placing unnecessary sensitive information in free-text fields.

Slota uses Stripe for relevant payment functionality. A business may use Stripe for Slota platform billing and may connect its own Stripe account to accept online appointment payments. Customer appointment payments are processed for the relevant business through its connected payment account; Slota is not the merchant providing the underlying appointment service and does not hold the business's customer funds as an intermediary.

Payment providers may process payment credentials, transaction, fraud-prevention, device and verification information under their own legal responsibilities and terms.

We may disclose information where necessary to providers that support hosting, databases, authentication, file storage, cloud functions, email delivery, payment processing, fraud/security controls and other infrastructure used to provide Slota. This currently includes services supplied by Google/Firebase (including Google Analytics where a visitor consents) and Stripe where their functionality is used.

Information may also be disclosed to professional advisers, insurers, auditors, regulators, courts, law-enforcement bodies or other parties where reasonably necessary to establish or defend legal rights, comply with law, protect users or investigate suspected misuse. If Slota or relevant assets are reorganised, sold or transferred, information may be disclosed as part of that transaction subject to appropriate safeguards.

We do not sell personal data to advertisers.

Some service providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we will rely on an applicable adequacy regulation or appropriate contractual or other safeguards. Further information about safeguards relevant to a particular request can be obtained through our contact page.

We keep personal data only for as long as reasonably necessary for the purpose for which it is held, including providing the service, maintaining security and audit records, resolving disputes, enforcing agreements and meeting legal, tax or accounting requirements. Different records therefore have different retention periods.

Businesses control retention decisions for much of the customer and staff information they place in Slota. Account closure or deletion does not necessarily require immediate deletion of every record where continued retention is legally required, necessary to establish or defend claims, needed for security/fraud prevention, or contained temporarily in protected backups.

We use technical and organisational measures intended to protect personal data, including authenticated access, access controls and security measures provided by our cloud and payment infrastructure. No internet service can guarantee absolute security. Account holders must keep credentials secure, use access only for authorised purposes and promptly tell us about suspected unauthorised access.

Depending on the circumstances and lawful basis, UK data-protection law may give you rights to access personal data, correct inaccurate data, request deletion, restrict processing, object to processing, receive certain data in a portable form, and withdraw consent where consent is relied upon. Some rights are subject to legal conditions and exemptions.

If your request concerns information held by a business about one of its customers or staff members, you should normally contact that business first because it is generally the controller. Slota will assist businesses with valid requests where required.

Please contact us first if you have a privacy concern so we can investigate it. You also have the right to complain to the UK Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can find current complaint information at the ICO's official website.

Slota is a business-management and appointment-booking platform and is not directed at children as account holders. Businesses are responsible for ensuring that any information they collect about children in connection with their services is collected and used lawfully, including obtaining any required parent or guardian involvement.

Slota does not currently use personal data to make solely automated decisions about individuals that produce legal or similarly significant effects. If that changes, this notice will be updated and any additional legal requirements will be followed.

Slota uses browser storage and similar technologies for functions such as authentication, security, preferences and booking workflows. Where a visitor chooses to accept optional analytics, Slota also uses Google Analytics 4 to measure matters such as visits, page views, acquisition, device/browser categories, approximate location, new and returning users, engagement and configured Slota events. We use that information to understand use of the service, improve Slota and evaluate marketing performance.

Google Analytics is not loaded for normal browsing unless the visitor has chosen to accept analytics. Advertising storage and ad personalisation are not enabled by this Slota analytics choice. See our Cookie Information for more detail and information about the analytics consent cookie.

We may update this notice when Slota, our providers or applicable law changes. The current version and its effective date will be published here. Where a change materially affects how we use personal data, we will provide additional notice where appropriate.