pubtime – Privacy Policy (UK GDPR)

Last updated: November 17, 2025

This Privacy Policy explains how we handle personal data when you use our website and scheduling service.

1. Who we are

Controller: pubtime ("we", "us", or "our"), operating pubtime from the United Kingdom.
Contact: contact@pubtime.pro

2. What this policy covers

This policy explains what personal data we collect when you use pubtime, how we use it, and the rights you have. The Service helps groups find suitable times to meet and – if enabled – prompts someone in the group after a pause to arrange a next event.

3. Personal data we collect

We only collect what we need to run the Service:

• Account & participant details: name or display name; email address; time zone or locale.
• Scheduling data: event titles, descriptions, proposed times/availability, poll responses, organiser and participant identifiers.
• Operational data: functional cookies (see Cookies below), server logs (e.g. IP address, device/browser metadata), security events.
• Support communications: messages you send us and related metadata.

We do not use analytics or advertising cookies and do not profile users for marketing.

4. Purposes and lawful bases

We process personal data to:

• Provide and improve the Service – creating polls, sharing invitations, collating responses, confirming times, and sending essential notifications.
  Lawful basis: Legitimate interests (to provide a scheduling service requested by you or another participant) and/or performance of a contract where you have an account.
• Arrange future events if enabled – contacting one or more participants after a specified pause to propose times for a follow-up event.
  Lawful basis: Legitimate interests of the group to coordinate future meetings, with opt-out controls in product messages.
• Security and fraud prevention – preventing abuse, ensuring system integrity, and diagnosing issues.
  Lawful basis: Legitimate interests and compliance with legal obligations.
• Customer support – responding to queries and requests.
  Lawful basis: Legitimate interests and/or performance of a contract.
• Marketing (optional) – we will only send marketing communications if you explicitly opt-in and you can withdraw consent at any time.
  Lawful basis: Consent.

Where we rely on legitimate interests, we balance those interests against your rights and expectations – for example, invitations and reminders are context-appropriate service messages that you can manage.

Summary of lawful bases

5. Where data comes from

• You – when you create an account, respond to a poll, or contact support.
• Other users – an organiser may enter your name/email to invite you to an event.
• Your device – through essential cookies and server logs to keep the Service working securely.

6. Sharing your data

We do not sell your data. We share it only with:

• Processors who help us run the Service (for example: cloud hosting, email delivery, content cache/CDN). These processors act on our instructions under data processing agreements.
• Other participants in your events to the extent needed to schedule and confirm a time.
• Authorities if required by law or to protect rights, safety, and security.

Current processors:

7. International transfers

Your data may be processed outside the UK. Where that happens, we rely on UK adequacy regulations or appropriate safeguards (such as the International Data Transfer Agreement or Standard Contractual Clauses) to protect your data.

For transfers to the United States (for example, Rollbar), your data is protected under the UK–US Data Bridge adequacy decision. You can request further details via contact@pubtime.pro.

8. Cookies

We use strictly necessary (functional) cookies only. These are required for the Service to work and do not require consent under UK PECR. You can block them in your browser, but the Service may not function correctly.

9. Retention

We keep personal data only as long as necessary for the purposes set out above:

• Events and polls: retained until the event date plus 12 months, or until the organiser deletes them, whichever is sooner.
• Accounts: retained while the account is active and deleted within 30 days after closure.
• Support records and logs: retained for up to 12 months unless needed for security or legal reasons.

You can ask us to delete your data sooner – see Your rights below.

10. Your rights

Under UK GDPR you have rights to access, rectify, erase, restrict or object to processing, and to data portability. Where we rely on consent you may withdraw it at any time. To exercise your rights, contact contact@pubtime.pro.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). See ico.org.uk or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, UK.

11. Children

The Service is not directed to children under 13. If you believe a child under 13 has provided personal data, please contact us and we will delete it.

12. Security

We use appropriate technical and organisational measures to protect personal data – including encryption in transit, access controls, and regular backups.

13. Automated decision-making

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

14. Changes to this policy

If we make material changes, we will update this page and, where appropriate, notify you by email or by displaying an in-app banner. The latest version replaces previous versions.

---