Privacy Policy

1. Data controller

Anastasia Soldatova (trade name: TNF Service), sole trader (autónoma), NIF Z4634226-F, Av. La Arenita, 11, Bl. G, Piso 1º, Pta. 12, Comp. Paraíso Palm-Mar II, 38632 Palm-Mar, Arona, Santa Cruz de Tenerife, Spain.

Email: tnfbotservice@gmail.com · Phone: +34 655 073 206.

2. Scope

This Policy explains how we process the personal data of:

• visitors to the website www.tnfservice.eu;
• professionals and businesses that register for or subscribe to the TNF Service ("Customers");
• people interested in our partner program;
• end clients who book appointments with a Customer through their booking page, Telegram bot or Mini App (section 9).

3. What data we process and why

3.1. Website visitors

• Technical browsing data (IP address, browser and device type, pages visited, referral source), for the operation and security of the website and, with your consent, for statistics and advertising measurement, in accordance with the Cookie Policy.
• Data you give us when you contact us (name, line of work, question and contact method). The form on the website opens the app you choose (WhatsApp, Telegram or email), and the message reaches us only if you send it. We use this data to answer your question.

3.2. Customers (professionals)

• Account data: name, email, Telegram ID and, if provided, website.
• Settings entered by the Customer: services, prices, opening hours, address, contact details (phone, email, WhatsApp, Instagram, Facebook, map), cover and gallery photos, "About" text, Google Calendar ID and time zone, and Telegram bot token.
• Subscription and billing data: subscription status, dates, amounts and invoices. Card details are processed directly by Paddle; TNF Service has no access to them.
• A record of acceptance of the Terms and Conditions (date and version).
• Communications with support.
• Technical data: one-time login codes (valid for a maximum of 15 minutes), a technical session cookie in the customer account and on booking pages (up to 30 days), and server error and system logs.

Purposes: creating and managing the account, providing the Service, handling payments and invoicing, providing support, sending Service-related notices (end of trial, changes, invoices), ensuring security and improving the Service. Texts that the Customer enters in their settings (services, "About") may be translated automatically with Google Translate; end-client data is not sent.

3.3. Partners

Name, contact details, country and languages and, if a partnership is agreed, the data needed to calculate and pay commissions (tax and bank details). Purpose: managing the partnership.

4. Legal basis

• Performance of a contract or pre-contractual steps (Art. 6.1.b GDPR): account management, provision of the Service, payments, support and partnership.
• Compliance with legal obligations (Art. 6.1.c GDPR): invoicing, accounting and tax obligations.
• Legitimate interest (Art. 6.1.f GDPR): Service security, fraud prevention, technical logs, backups, answering enquiries and informational notices about the Service sent to Customers.
• Consent (Art. 6.1.a GDPR): analytics, marketing and third-party cookies. You can withdraw it at any time.

5. Retention periods

• Enquiries: the time needed to reply and up to 12 months afterwards, unless they lead to a contract.
• Customer account data and settings: while the subscription is active. They are deleted automatically 30 days after it ends, or immediately at the Customer's request, in accordance with the Cancellation and Refund Policy.
• Billing data: for the periods required by law (generally six years under the Spanish Commercial Code and the limitation periods of tax law).
• Server error logs: about two months. Server system logs: 30 days.
• Encrypted backups: full server snapshots, 7 days; daily backups, 30 days; monthly backups, 90 days. After deletion, data may remain in these encrypted backups for a maximum of 90 days and is erased as they rotate. Until then, it is used only to restore the Service in the event of an incident.
• Cookies: in accordance with the Cookie Policy.

6. Recipients and data processors

We do not sell personal data. We share data with third parties only when required by law (for example, with tax authorities) or with providers that offer us services as data processors, with the safeguards required by Article 28 GDPR:

Some of these providers process certain data as independent controllers under their own policies; for example, Paddle for fraud prevention and its legal obligations, and Telegram for the use of its platform.

7. International transfers

The Service servers are located in the European Union (Finland). Where a provider processes data outside the European Economic Area, the transfer is based on a European Commission adequacy decision (including the EU-US Data Privacy Framework for participating companies) or on standard contractual clauses approved by the European Commission. Backups stored on Google Drive are encrypted before they are sent, so Google cannot access their content.

Telegram processes data on its own servers, which may be located outside the European Economic Area, including in countries without an adequacy decision. This transfer happens only when Telegram is used (TNF Calendar or Mini App) and is necessary to provide the service requested through that channel (Article 49.1.b GDPR). Anyone who prefers not to use Telegram can book through the web page.

8. Security

We apply appropriate technical and organizational measures, including: encrypted connections (HTTPS); server access restricted to authorized technical staff using SSH keys, without password login; two-step authentication for administration consoles; a firewall and protection against unauthorized access attempts; encrypted backups (AES-256); and account login with one-time codes.

9. End clients: people who book appointments

9.1. Controller. When you book an appointment with a professional through a booking page, Telegram bot or Mini App powered by TNF Service, the controller of your data is that professional, whose name is shown on the booking page or in the Telegram bot. TNF Service acts as a data processor on behalf of the professional. As controller, the professional authorizes TNF Service to use the sub-processors listed in section 6, in accordance with section 10.2 of the Terms and Conditions.

9.2. Data processed: an identifier (your Telegram ID if you book through the TNF Calendar or Mini App, or your email if you book through the website), name, phone, Telegram username, language, chosen services, and the date and time of the appointment.

9.3. Where the data is stored. TNF Service does not keep its own database of end clients: each booking is saved as an event in the professional's Google Calendar. In addition, TNF Service systems only process:

• the rules for recurring appointments, while the series is active;
• your push notification subscription, if you have enabled it;
• a technical session cookie in your browser, for a maximum of 30 days;
• data that appears incidentally in error logs (about two months) and system logs (30 days);
• the sending logs of the email service;
• encrypted backups, within the periods set out in section 5.

9.4. What it is used for: to manage your booking; to send you a confirmation (by email, with a calendar file) and reminders (by email, Telegram or push notification); and to show you your bookings and let you reschedule or cancel them. So that you don't have to enter your phone number again, the system may take it from your bookings with the same professional in the last 90 days; the professional can change or turn off this feature.

9.5. Retention. Bookings remain in the professional's calendar until the professional deletes them. The professional decides how long they are kept.

9.6. Your rights. To exercise your rights, contact the professional you booked with. You can also write to us at tnfbotservice@gmail.com: we will forward your request to the professional and help them respond.

9.7. Telegram. If you use the TNF Calendar or the Mini App, your use of Telegram is also governed by Telegram's privacy policy, and your data may be processed outside the European Economic Area (see section 7). If you prefer, you can book through the web page.

10. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and withdraw any consent you have given, by writing to tnfbotservice@gmail.com. If necessary, we will ask you to verify your identity. We will reply within one month.

If you believe that your data is not being processed lawfully, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

11. Minors

The Service is intended exclusively for professionals of legal age. The website is not intended for children under 14, and we do not knowingly process their data.

12. Changes to this Policy

We may update this Policy to reflect changes in the Service, our providers or the law. The date of the last update is shown at the top of this page. We will inform Customers of significant changes by email.

13. Contact

For any questions about this Policy or the processing of your data, you can write to tnfbotservice@gmail.com.