Privacy policy
Privacy statement regarding the use of the Lime Booking website and app.
1. Introductory provisions
We protect your personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Personal Data Protection Act (ZVOP-2) and other applicable data protection legislation. This part of the privacy statement applies to individuals who act as business users at Lime Booking — namely owners, directors, employees and contact persons of salons and other business entities that use the Lime Booking platform.
Lime Booking acts in two clearly separated roles in relation to you. As controller processes your personal data for the purpose of providing and managing Lime Booking services — This statement governs this relationship.. As a processor PA processes your customers' personal data according to your instructions and on your behalf — this relationship is governed by Standard Contractual Clauses for data processing (SPD), which is an integral part of the platform use agreement.
2. Company information
The controller of personal data is Adanta d.o.o. (hereinafter: Lime Booking), Seliškarjeva ulica 16, 2250 Ptuj, registration number 8919160000, VAT ID SI 85728403.
For any questions regarding the processing of your personal data, please contact us at privacy@lime-booking.com or write to the above address. We shall respond to requests within 30 days.
3. What data do we process
When you register and use the Lime Booking app, we process the following categories of your personal data.
Identification and business data include your first and last name, username, password (stored exclusively in a hashed format), official company name, and VAT ID if you are acting as a legal entity or sole trader.
Contact details include an email address, telephone number, registered office or business address, delivery and billing address, and, where applicable, social media profiles that you provide to us yourself.
Account details they include all the information you enter upon registration and during use: location data, services, price list, staff, opening hours, and all other settings within the platform.
Data on salon clients – processing role: For your customers' personal data (name, email, phone number, booking details) entered via the booking form, Lime Booking acts as a processor on your behalf. We process this data exclusively on your instructions based on SPD. For these relationships you act as the controller and are responsible for appropriately notifying your customers.
Data on browsing habits and platform usage include information about the services you are looking for, the functionalities you use, the content you click on, the way you search and navigate the platform, and information about the devices you access – IP address, location at the city level, device ID, operating system, browser, and cookie data.
Data on behaviour when reading messages These include the time the message was opened and basic technical details about the device used to open it.
Analytical and derived data: Based on your use of the platform, we create aggregated analytical insights for the purpose of improving the platform – for example, grouping by service category, frequency of use, and geographical location. We perform profiling for the purposes of personalized offers solely based on your consent.
4. Why we process your data
Account management and service provision
We process this data to manage access to your account, ensure the operation of the platform and its associated services for appointment booking, customer management and messaging.
The legal basis is the performance of a contract under Article 6(1)(b) of the GDPR. We retain the data for the entire duration of the contract and delete it within 30 days of termination.
Billing, invoicing and tax liabilities
We process data relating to payments, invoices issued and transactions for the purposes of calculating subscription fees, issuing invoices and fulfilling tax and accounting obligations.
The legal basis is a combination of the performance of a contract (Article 6(1)(b)) and a legal obligation (Article 6(1)(c)). Financial records are kept for 10 years in accordance with the Tax Procedure Act (ZDavP-2).
Party support
We retain communication data from support enquiries in order to ensure continuous, high-quality support, to resolve technical issues and to provide evidence in the event of a dispute.
The legal basis is legitimate interest (Article 6(1)(f)) — the interest in providing a high-quality service does not override your rights, as the data is not disclosed to third parties and is accessible only to the support team. We retain the data for 3 years after the conclusion of each individual case.
Platform security and fraud prevention
Technical access data (IP address, behavioural patterns, access times) is processed to detect unauthorised access, prevent fraud and ensure the secure operation of the platform.
The legal basis is legitimate interest (Art. 6(1)(f)) — security measures also directly benefit you as a user. IP addresses are pseudonymised after 30 days, and full security logs are deleted after 12 months.
Analytics and Service Development
We process aggregated and anonymised platform usage data for the purposes of developing new features, troubleshooting and improving the user experience.
The legal basis is legitimate interest (Art. 6(1)(f)). Anonymised data does not allow for your identification and is stored permanently; personal data for analytical purposes is kept for up to 24 months.
Service notifications and direct marketing
We occasionally inform existing business customers about platform updates, new functionalities and relevant offers.
The legal basis is legitimate interests (Article 6(1)(f)) — as an active user, you would reasonably expect to receive notifications directly related to the service you are using.
You always have the right to object under Article 21 GDPR, which we will respect immediately and unconditionally. We process the data for this purpose until you unsubscribe.
Profiling for the personalisation of offers
If you specifically agree to this, we will create a profile of your preferences for the purpose of tailored functionality recommendations and offers suited to your type of business.
The legal basis is your consent (Article 6(1)(a)). You may withdraw your consent at any time by sending an email to privacy@lime-booking.com.
Enforcing legal claims
In the event of legal disputes or regulatory proceedings, we retain relevant data for the purpose of establishing or defending legal claims.
The legal basis is legitimate interest (Art. 6(1)(f)). We retain the data until the end of the procedure and for 5 years thereafter.
Statistical analysis
We carry out anonymised statistical processing for the purposes of market analysis and reporting. As the data is anonymised, it does not allow you to be identified and is not regarded as personal data.
5. Who processes your data
Your personal data is accessible only to a limited circle of people. Employees at Lime Booking have access only to those who need the data to perform their duties – for example, the support team, the development team, and the billing team. All employees are bound by confidentiality.
For certain services we use external processors, with whom we have concluded data processing agreements under Article 28 of the GDPR. The processors may process data exclusively in accordance with our instructions. Our key processors are: Amazon Web Services EMEA SARL infrastructure hosting, EU, Functional Software Inc. – Sentry (error monitoring, EU-Frankfurt), PostHog Inc (analytics, EU-Frankfurt), Infobip Limited (SMS and email, EU-Frankfurt), Google Ireland Limited (cloud services and analytics, EU and hybrid), Facebook Ireland Limited (advertising exclusively with your consent, EU-Ireland and worldwide), Stripe Payments Europe Limited (payment processing, EU-Ireland) and E-RAČUNI d.o.o. (accounting, Slovenia).
We disclose your data to government authorities when required by law – for example, the Financial Administration of the Republic of Slovenia or the Information Commissioner of the RS in the context of supervisory procedures.
In the event of legal disputes, we may also disclose them to lawyers and courts to the extent necessary for the protection of legal interests.
In certain cases, we may obtain your company's data from publicly available registers, such as AJPES, GVIN and Google Business Profile. We do this exclusively for the purpose of identifying and updating business data during registration or profile management.
6. Transfer of personal data to third countries
Your personal data is in certain cases transferred outside the European Union or the European Economic Area. Lime Booking ensures that all such transfers comply with GDPR requirements and are carried out with appropriate safeguards.
Transfers take place to the following providers based or with infrastructure in third countries: Axiom Inc. (USA — log management), Google LLC (USA and globally — cloud services), Meta Platforms (USA and globally — advertising, strictly subject to your consent) and Stripe Inc. (USA — payment processing).
For all listed transfers, we provide the European Commission's Standard Contractual Clauses pursuant to Implementing Decision 2021/914.
You have the right to request information about the countries to which your data is transferred and a copy of the applicable safeguards. Please address your request to privacy@lime-booking.com.
7. Data security
We protect your data with technical and organisational measures, which include data encryption in transit (TLS 1.2 or higher) and at rest (AES-256), two-factor authentication for account access, role-based access control following the principle of least privilege, regular security reviews and penetration testing, and procedures for detecting and managing security incidents.
In the event of a security incident that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 of the GDPR.
8. Your rights
As a data subject, you have the following rights. We respond to all requests within 30 days; for complex requests, we reserve the right to extend this period by a maximum of 2 months, of which we will notify you in advance.
Right of access (Article 15): You are requesting a copy of the personal data we process concerning you, as well as information about the nature, purpose, and scope of this processing.
Right to rectification (Article 16): You are requesting the correction of inaccurate personal data or the completion of incomplete personal data.
Right to erasure (Art. 17): You request the erasure of your personal data when there is no longer a legal basis for its processing. The right to erasure is subject to restrictions arising from statutory retention obligations.
Right to restriction of processing (Article 18): You are requesting that we temporarily restrict the processing of your data until we have resolved any substantive disagreements.
Right to object (Article 21): You object to the processing of your data on the basis of legitimate interest. An objection to processing for direct marketing purposes is absolute and unconditional — we will comply with it immediately, without balancing interests.
Right to data portability (Article 20): You request that we provide you with your personal data in a structured, commonly used and machine-readable format, or that we transmit it directly to another controller.
Right to withdraw consent (Art. 7): You may withdraw your consent, given for any processing based on it, at any time and without consequence. The withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.
Please send requests for the exercise of rights to privacy@lime-booking.com. You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.
9. Cookies and similar technologies
Lime Booking uses cookies and similar technologies to ensure the operation of the platform, analytics and personalised advertising. Essential cookies are required for basic operation and cannot be switched off. We obtain your consent for all other types of cookies via the cookie manager upon your first visit.
A detailed explanation of all types of cookies, their purpose and instructions on how to manage settings is available in the Cookie Policy at: lime-booking.si/piskotki
10. Changes to this statement
This statement is regularly reviewed and updated. We will notify you of any material changes at least 30 days before they take effect via an email to your registered address or through an in-app notification. The date of the last update is stated at the bottom of this document. An archive of previous versions is available upon request from privacy@lime-booking.com.
Updated on 21 April 2026
1. Introductory provisions
Adanta d.o.o., Seliškarjeva ulica 16, 2250 Ptuj, parent number 8919160000, VAT ID SI 85728403 (hereinafter: Lime Booking, we or us) is the controller of your personal data in all cases described in this statement.
| Type of contact | Contact details |
|---|---|
| General matters and support | app@lime-booking.com |
| Privacy and data protection | privacy@lime-booking.com |
| Postal address | Vojkova cesta 63, 1000 Ljubljana |
| Website | lime-booking.si |
We will respond to questions regarding the processing of your personal data no later than 30 days after receiving the request. If the request is complex or there is a large number of requests, we may extend this period by up to two months, in which case we will notify you.
2. To whom this statement applies
This privacy statement applies to you personally when you perform one of the following roles:
- you are a registered user of the Lime Booking app (iOS or Android),
- you are looking for salons or ordering appointments through the lime-booking.com online platform,
- You have given your consent for Lime Booking marketing messages via the booking form on the salon website.
Two roles of Lime Booking
When you book an appointment through the booking form built into the salon website, the salon acts as the independent controller of your booking data. Lime Booking acts as a processor on behalf of the salon.
Exception: When you specifically and voluntarily consent to Lime Booking’s marketing communications on the same form, we become a separate controller solely for this purpose. Details are provided in section 12.
3. What data do we collect
3.1 Data you provide to us directly
When you create an account or book an appointment, you provide us with information such as: name and surname, email address, phone number, and information about the chosen service, provider, and appointment. If you contact us, we will also process the content of your message.
3.2 Data that we collect automatically
When using the platform, we automatically collect technical data, such as device information, IP address, log data, and cookie data (see Chapter 12).
3.3 Data from other sources
To determine whether you are a new or existing customer with the selected provider, we receive only hashed values from the provider – but never readable personal data about its customers (see Chapter 5).
3.4 Special categories of data
When you enter health information, data about allergies, pregnancy, or other health status during the booking process or in the salon consultation form, this constitutes a special category of data under Article 9 of the GDPR. We process such data exclusively based on your explicit consent, which you give specifically and can withdraw at any time. This data is visible only to the salon for which it is intended. Lime Booking never uses this data for profiling or marketing purposes.
4. Purpose of processing, legal basis and retention periods
We process your data exclusively for certain, clearly defined purposes. For each processing, we have the appropriate legal basis in accordance with Article 6 of the GDPR. Below, the legal basis and the retention period for each purpose are listed:
Managing a user account
The legal basis is the contract (Article 6(1)(b)). We store the data until the account is deleted and for another 30 days thereafter (the duration of the contractual relationship).
Reservations and booking history
The legal basis is the contract (Article 6(1)(b)). We store them for 5 years after the last activity, which corresponds to the general statute of limitations under Article 346 of the Obligations Code.
Accounts and financial records
The legal basis is a legal obligation (Article 6(1)(c)). We store them for 10 years in accordance with tax and accounting legislation.
Transactional messages (confirmations and reminders)
The legal basis is the contract (Article 6(1)(b)). We process them for the duration of the reservation, as they are necessary for the execution of the service.
Determining whether you are a new or existing customer of the provider (matching)
The legal basis is our legitimate interest (Article 6(1)(f)), for which we conducted a documented weighing test. We process the data only for the duration of the comparison.
Recommendations and improving the service within the platform
The legal basis is our legitimate interest (Article 6(1)(f)) based on a documented weighing of interests. We process the data for the time when your account is active.
Direct marketing and promotional messages
The legal basis is your consent (Article 6(1)(a)). We process the data until you revoke your consent.
Customized advertising and campaign measurement (Google, Meta)
The legal basis is your consent (Article 6(1)(a)). We process the data until you revoke your consent.
Analytics through analytical cookies
The legal basis is your consent (Article 6(1)(a)), as cookies require consent under the Personal Data Protection Act (ZEKom-2). We process the data until you revoke your consent.
Customer support
The legal basis is our legitimate interest (Article 6(1)(f)) with documented weighing of the evidence. We store the data for 3 years after the case has been closed.
Platform security and the prevention of abuse
The legal basis is our legitimate interest (Article 6(1)(f)) based on a documented weighing of the interests. We store the data for 12 months.
Anonymized statistics
After anonymization, the personal data is no longer personal data, so we do not limit the retention period for it.
Special categories of data (for example, health data) if we process them
The legal basis is your explicit consent (Article 9(2)(a)). We process the data until the consent is revoked.
Legitimate interest
Documented balancing tests: For each purpose based on legitimate interest, we prepared a written balancing test before starting the processing in accordance with the WP217 methodology (documents BI-01, BI-02, BI-03). At a written request on privacy@lime-booking.com We provide you with a summary of each test.
5. Matching with the provider's customer base
So that the provider knows whether you are a new customer, we compare your data with its customer database in a way that protects your privacy: the provider only sends us condensed (hashed) values, and we never receive a readable database of its customers. We perform this processing based on a legitimate interest; before doing so, we conducted a weighing test and determined that our interest does not override your rights and interests.
In this processing, Lime Booking and the provider act as joint controllers. The details of the agreement between them (division of tasks and responsibilities) are available upon request. You may object to this processing at any time. privacy@lime-booking.com.
6. To whom do we pass your data
We do not sell your personal data. We only share it with trusted processors who help us operate the platform and process the data exclusively in accordance with our instructions:
- Hosting and cloud infrastructure — Amazon Web Services;
- SMS and email sending — Infobip;
- online analytics — PostHog, Google;
- error monitoring — Sentry;
- advertising and measuring campaigns — Google, Meta;
- Payment processing (since the introduction of online payments) — Stripe.
When data is transferred outside the European Economic Area, we ensure an adequate level of protection through standard contractual clauses of the European Commission.
7. Your rights
Regarding your personal data, you have the right to access, correct, delete, restrict processing, portability, objection, and withdraw consent. You can exercise these rights by: privacy@lime-booking.com.
Before fulfilling the request, we may verify your identity; if we cannot reliably identify you based on the information provided, we may request additional information. We will respond to your request within one month at the latest.
If you believe that we have violated the protection of your personal data, you may file a complaint with the Information Commissioner (Dunajska cesta 22, 1000 Ljubljana gp.ip@ip-rs.si, ip-rs.si).
8. Automated decision-making and profiling
We do not make decisions about you that are based solely on automated processing and that have legal or similar significant effects. When you consent to this, we use data about your use of the platform for personalized advertising (see Chapter 11).
9. Age limit for using the platform
The platform is intended for people aged at least 15 years. A younger person may only use it with the consent or approval of a parent or guardian. If we find that we are processing the data of a minor without appropriate consent, we will delete it without delay.
10. Security and notification of violations
We protect your data with appropriate technical and organizational measures. If, nevertheless, a security breach occurs that would likely pose a significant risk to your rights and freedoms, we will inform you without undue delay.
11. Marketing messages and advertising
We only carry out direct marketing (for example, informing about new features by email) when you consent to it. When you also consent to advertising, we use data about your use of the platform and cookie identifiers for personalized advertising and measuring advertising campaigns through third-party platforms (Google, Meta). For this purpose, we act as a separate controller.
You can withdraw your consent at any time — via the opt-out link in each message, in the cookie manager, or on privacy@lime-booking.com. The cancellation does not affect the legality of the processing before the cancellation.
12. Cookies
We use cookies and similar technologies to operate and improve the platform. We obtain your consent for non-essential cookies. Details about the types of cookies, their purpose, and how to manage consent are in the Cookie Policy at lime-booking.com/piskotki.
13. Changes to this statement
We may update this statement from time to time. The current version is always published on the platform, and the date of entry into force is listed at the bottom of the document.
Updated on 3 August 2026
