Privacy notice for online booking

The German version is authoritative; this translation is provided for your understanding.

Version of 13 November 2026 · under the Swiss FADP (DSG) and, where applicable, the GDPR

This notice applies to the web app at buchen.sessionplaner.app and the booking service behind it. For the website and the Session Planer app, the privacy policy on sessionplaner.app applies.

Who is responsible

Your provider is responsible for your data, that is, the person or business with whom you book. Your provider decides whether you can book online and enables you for it. You can see your provider’s name in the web app.

NEXUS ID, Anthony C. Biasio, Weidmattstrasse 49, 4415 Lausen BL, Switzerland, operates the booking service on behalf of your provider (Art. 9 Swiss FADP (DSG), Art. 28 GDPR) and uses your data for nothing else. Contact: [email protected].

What is stored on the service

From you: first name, email address and the balance of your credit (number of units on a subscription, package or card).
Your booked and cancelled appointments: time and offer.
Outgoing emails to you: sign-in link, confirmation, cancellation, reminder.
Which version of this notice and of the terms of use you confirmed, and when.
Sign-in codes and sessions only as a hash, never in plain text.
From the provider: name, email address, their offers and rules, and busy times without title, names or location.

Your IP address is only counted briefly in working memory to limit misuse, and is not stored.

What never goes to the service

Surname, date of birth, notes, session records, health information and payments. This information stays, if at all, with the provider on their device.

What for

Only so that you can book, view and cancel appointments, so that you receive confirmations and reminders, and so that your provider is informed. No advertising, no analytics, no profiles, no automated decisions. The legal basis is the performance of the agreement between you and your provider (Art. 6(1)(b) GDPR) and, for preventing misuse, the legitimate interest in a secure service (point (f)).

How long

Emails: 30 days. Emails that could not be sent for one week are discarded.
Completed bookings: 90 days after the appointment.
Expired sign-in codes and sessions: immediately.
A daily encrypted backup is kept for 14 days.

If your provider removes your enablement, you lose access immediately, and your bookings, emails, sessions and the record of your consent are deleted from the service. If the provider ends online booking entirely, everything belonging to them is deleted. It then remains in the backup for at most 14 more days.

Cookie

One technically necessary session cookie that scripts cannot read, for at most 60 days. Without it, signing in does not work; no consent is required for it. No tracking, no advertising, no analytics, no third-party scripts, no third-party fonts.

Where the data is processed

Server: Hetzner Online GmbH, Gunzenhausen, Germany; data centre Nürnberg.
Connection and protection: Cloudflare, Inc., San Francisco, USA. The connection to the booking service runs through a Cloudflare tunnel; the server cannot be reached directly from outside. Cloudflare technically decrypts the connection in the process and processes the data as a processor.
Email sending: Cloudflare Email Service; sender [email protected].
Backup: encrypted at Cloudflare (R2 storage).

Cloudflare is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework; for certified companies, the protection is considered adequate in the EU and in Switzerland. Alternatively, the standard contractual clauses of the European Commission apply.

Your rights

You can request access and have your data corrected, deleted or handed over, have the processing restricted and object to it (Art. 25 et seq. Swiss FADP (DSG), Art. 15 to 21 GDPR). The quickest way is through your provider, because your provider is responsible for your data. You can also contact [email protected]; we forward your request to your provider and help them implement it. You also have the right to lodge a complaint with a data protection supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC) (Feldeggweg 1, 3003 Bern), in the EU with the authority of your place of residence.

Changes

If the content of this notice changes, it receives a new date. Before your next booking, the web app shows you this and asks you again.