Client privacy notice (template)

Last updated: 2026-09-17

For businesses using DEK. You are the controller of your clients' data, so you must provide your clients with your own privacy notice and make sure it is easy to find (clauses 11.4 and 11.5 of the Terms of Service). The whole notice does not fit in your booking page description, and links do not work there, so publish the notice, for example, on your website, and say in your booking page description where to find it. When you copy the notice, keep the web addresses in it visible. This is a template you are free to adapt: replace the fields in square brackets [...] with your details, keep the option that fits where several are given, and delete the bracketed sentences that do not apply to your business (for example, if you do not send SMS messages or email campaigns). The DEK functions are described as they work on the date shown above; if you change your DEK settings (for example, switch off sharing of reliability score numbers), change the notice accordingly. DEK analytics may be used on your booking page only once the owner of your DEK account has personally accepted version 2.1 or a later version of the Terms of Service, at signup or in your DEK account (a notice of the new version is not enough); add the information about it to your notice as clause 11.4 of the Terms of Service requires. DEK does not delete client cards, visits or SMS conversations automatically, and you cannot delete visits or SMS messages in DEK yourself; where this is needed to fulfil a client's request, Majevski, MB deletes specific visits, SMS messages or contacts in your asms.lt account at your request, where technically possible (clause 8.3 of the DEK Data Processing Agreement). When you delete a client card, the card no longer appears in the client list, search or exports, and its data (first name, last name, phone number, email address, card notes and custom fields) is no longer shown to your staff where DEK shows visits: the calendar, the visit window, today's visit list on the dashboard, the calendars your specialists subscribe to (where the data is refreshed as often as those calendar services refresh it), digests and new booking alerts. The client's visits do remain: they are shown under the label "Deleted client" with their time, services, specialist, status, price, the notes of your staff and those recorded with the visit (including the note the client left when booking), visit custom fields, meeting link and the message history of the last 12 months; the visits remain until they are erased together with your other data after your contract with Majevski, MB ends, and the client's personal visit link keeps working for the client. The SMS conversation with the client's phone number also remains and is shown under that number, and reports count that client's visits without the client's details. If you send email campaigns, a deleted client's email address, first name and last name also remain on the lists of earlier campaigns in the 1e.lt system until they are erased together with your other data, even if the data of the client card is removed earlier. At your written request, Majevski, MB removes the data of a deleted client card earlier, within 30 days of receiving the request (clause 30.9 of the Terms of Service): it erases the card's first name, last name, contact details, date of birth, gender, notes, custom fields, consent flags and link to a DEK Identity, the client's email click and delivery failure events and the recipient address in message records, and makes sure the client's email address is no longer on your list in the 1e.lt system. An empty card record remains in the database (its identifier, dates including the date of the last visit, the source of the record, the language, visit counts and the asms.lt contact identifier, where such a contact was linked or found), so that the visits keep showing as "Deleted client". Visits, rules for recurring visits, SMS messages and contacts in your asms.lt account then remain and are deleted only if you name them (clauses 8.3 and 12.7 of the DEK Data Processing Agreement). So state only a retention period that you can actually keep. On the client card DEK keeps only a flag showing whether the client agreed to receive news, without the date or wording of the consent; if you need evidence of consent, keep it yourself. The template is only an aid: Majevski, MB does not guarantee that it is sufficient for your business, and you are responsible for the final notice and for providing it to clients. We recommend having it checked by a lawyer.

[Business name] privacy notice

Who processes your data. The controller of your personal data is [Business name], [legal entity or business certificate code], address [address], email [email], phone [phone number]. [Our data protection officer: [name, email].] We use the DEK platform to take bookings, manage our calendar and send messages. Its operator, Majevski, MB, processes your data on our behalf and on our instructions, as our processor. In certain cases, described under "When the DEK operator is an independent controller", Majevski, MB processes your data for its own purposes and is itself responsible for that.

What data we process.

Where we get the data. You give us most of the data yourself: when you book online, by phone or in person, and when you reply to our messages. Our staff record visit statuses and notes. If you have created a DEK Identity, your email address and phone number in our records are updated from it. [We transferred your contact details from [our previous booking system / a contact list].]

Purposes and legal bases. The Articles referred to below are Articles of the General Data Protection Regulation (EU) 2016/679 (GDPR).

Whether you must provide data. To book online you must fill in the "Your name" field and give your [phone number / email address]. [If you give a landline number, an email address is also needed, because we do not send SMS messages to landlines.] Without this data we cannot accept the booking or tell you about the visit. The note and consent to receive news are optional. [You do not have to give health information, but without it we may not be able to provide some services safely.]

How we send messages.

Reliability score. DEK automatically calculates what share of the sum of your attended visits, no-shows and late changes is made up of attended visits. A late change is a cancellation or rescheduling of a visit that you make yourself (for example through the visit link or by replying to an SMS) less than 24 hours before the visit starts, and a cancellation that our staff marked as caused by you. Other cancellations and reschedulings made by us or by the system do not count. If we have not changed the status of a visit, it may be marked as attended automatically once the visit time has passed. The score is supporting information only: it does not itself refuse or change bookings, decisions are made by our staff, and we do not refuse to serve you solely because of the score.

Automated actions and decisions. Some actions happen automatically: an SMS reply whose first word is a confirmation or cancellation word, and an action through the visit link, change the visit status straight away (see "How we send messages"); the reliability score is calculated automatically; if an email server reports that your email address does not exist, emails to you may stop automatically, and such a report may also come from another business's email sent through DEK; protective measures may automatically refuse a booking or the sending of a one-time code if your IP address or email address is marked as a source of abuse in a threat database, and they also limit the number of requests in a short time. If a booking is refused, you will see the message "Too many attempts"; if the sending of a one-time code is refused, you will not receive the code. If you think you were blocked without good reason, contact us at [email / phone number] or write to the DEK operator at pagalba@majevski.com. [We make no other decisions based solely on automated processing that produce legal or similarly significant effects for you.]

When the DEK operator is an independent controller. In the cases below, Majevski, MB processes your data for its own purposes and under its own responsibility, as described in the DEK Privacy Policy (https://dek.lt/privacy). You can contact it about this data directly at pagalba@majevski.com.

Who receives the data. We do not sell data. The data is received by:

Transfers outside the European Economic Area (EEA). [Calendar service providers may also process the data outside the EEA under their own terms.] [If another of our service providers transfers data outside the EEA, we rely on [a European Commission adequacy decision / standard contractual clauses]; you can obtain a copy by writing to [email].] Our clients' data in the DEK platform is stored in the European Union. Service providers used by the sub-processors of Majevski, MB may also be located outside the EEA[, and requests passing through the content delivery network of the 1e.lt email campaign system may be handled in other countries]; such transfers are permitted only with the safeguards provided for in Chapter V of the GDPR (DEK Data Processing Agreement, https://dek.lt/dpa). How Majevski, MB transfers data outside the EEA for its own purposes (for example when using Google Analytics) is described in the DEK Privacy Policy (https://dek.lt/privacy).

How long we keep data.

Your rights. You have the right to access your data and obtain a copy, to have inaccurate data corrected, to have your data erased or its processing restricted, to receive the data you provided in a structured, commonly used and machine-readable format and have it transmitted to another controller (where processing is based on consent or a contract), and to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Right to object. You have the right to object at any time to processing of your data based on our legitimate interest (for example, the record of no-shows or the transfer of numbers for the combined reliability score), and you always have the right to object to processing for direct marketing.

How to exercise your rights. Write to [email] or contact us at [address]. We will reply within one month of receiving your request; if the request is complex or there are many requests, we may extend this by two further months, telling you so within the first month. You can do some things yourself: opt out of emails with the link in the email; confirm, cancel or reschedule a visit and change the language of messages through the visit link; and, if you have created a DEK Identity, see your visits in it, change your first name, last name and photo, or delete the identity (https://dek.lt/my). You cannot change the email address or phone number of a DEK Identity yourself: write to pagalba@majevski.com for that. Send requests about data that the DEK operator processes as an independent controller to pagalba@majevski.com.

Complaints. You have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, vdai.lrv.lt) or with the data protection supervisory authority of the European Union Member State where you live, work or where you believe your rights were infringed.

Changes to this notice. [We may update this notice; the current version is always published [where, for example on our website]. Last updated: [date].]

This notice was prepared using the DEK template. [Business name] is responsible for its content.