Privacy Policy

1. Introduction and scope

This Privacy Policy explains how DOKUMENT.PL sp. z o.o. handles personal information when you use Meeti Me, available at meeti.me and through our mobile applications (together, the "Platform").

Meeti Me has two sides:

• a business subscription used by salons, barbershops, spas and similar businesses to manage their calendar, their clients and their online booking page; and
• a public marketplace used by consumers to find a salon and book an appointment.

This policy applies to both. It is written for individuals in Canada and reflects the *Personal Information Protection and Electronic Documents Act* (PIPEDA), substantially similar provincial privacy legislation, and, for residents of Quebec, the *Act respecting the protection of personal information in the private sector* as amended by Law 25.

An important point about our role. For bookings made through the marketplace, we are an intermediary. The beauty, wellness or grooming service you book is provided by the salon, not by us. We never become a party to the service contract between you and the salon. The salon is an independent business and, in respect of the information it records about you in its own client file (for example, treatment notes, colour formulas, allergies you disclose, no-show history), the salon determines its own purposes and is responsible for its own privacy compliance. We handle that information on the salon's behalf and under its instructions.

For your account, the marketplace itself, our billing relationship with salons, our security and our analytics, DOKUMENT.PL sp. z o.o. decides why and how information is handled and is accountable to you under this policy.

This policy does not apply to a salon's own website, to a salon's own newsletter, or to any third party service you reach by following a link from the Platform.

Effective date: 2026-09-08. Version: 2026-09-08.

2. Who we are and how to reach our privacy officer

Meeti Me is operated by DOKUMENT.PL sp. z o.o., a limited liability company incorporated in Poland, with its registered office at Aleja Stanow Zjednoczonych 51 lok. 222, 04-028 Warszawa, Poland. We are a foreign operator: we are established in the European Union and we serve customers in Canada from there. Section 7 explains what this means for your personal information.

Under PIPEDA and under Law 25 we must designate a person who is accountable for our compliance. We have done so.

| | | | --- | --- | | Privacy officer (person in charge of the protection of personal information) | meetime.company@gmail.com | | General privacy enquiries and rights requests | meetime.company@gmail.com | | Product and account support | meetime.company@gmail.com | | Postal address | DOKUMENT.PL sp. z o.o., Aleja Stanow Zjednoczonych 51 lok. 222, 04-028 Warszawa, Poland | | Representative for the region, where one is designated | the privacy officer reachable at the address below |

You may write to our privacy officer in English or in French. We answer in the language you used.

If you are a salon and you are trying to reach us about information in your own client file, please note that we will normally redirect an individual's request to you, because that file is yours. Section 9 explains how this works.

3. Personal information we collect

We collect only what we need to run the Platform. The categories are:

Account and identity information. Your name, email address, mobile telephone number, the language you have chosen, your password in hashed form, and, for salons, the business name, business address, opening hours, staff list and the services and prices you publish.

Booking information. The appointments you make, request, modify or cancel; the salon, staff member, service and time; your booking history; cancellations and no-shows; and any note or preference you add yourself when booking (for example "please use fragrance free products").

Salon notes about clients. Salons can record notes in their own client file. Depending on the salon these may include technical notes about a treatment, product preferences, allergies or sensitivities you have disclosed, and internal comments. Some of this can be sensitive information about your health. We do not read these notes, we do not use them for our own purposes and we do not use them to build any profile of you. We store them for the salon and protect them.

Payment information. Salon subscriptions are billed in Canadian dollars through Stripe. We receive from Stripe the fact that a payment succeeded or failed, the amount, the currency, the country, the brand of card and the last four digits, and the invoice history. We never receive or store your full card number, expiry date or security code. Those go directly to Stripe.

Communications. Messages you send us, support tickets, and the record of the transactional and, where you consented, commercial messages we sent you and whether they were delivered.

Marketing consent records. Where you gave express consent to receive commercial electronic messages, we keep the record of that consent: what you consented to, when, and by which method. We are required to be able to prove it.

Technical and usage information. Your IP address, browser and device type, operating system, approximate region derived from the IP address, referring page, the pages and features you used, and the timestamps. This includes security logs of sign in attempts.

Cookies and similar technologies. Described in our separate Cookie Policy.

We do not collect your social insurance number, we do not perform credit checks on consumers, and we do not buy personal information about you from data brokers.

4. Why we collect it and the consent we rely on

Canadian law requires us to identify the purposes for which we collect personal information and to obtain your consent, unless an exception applies. Consent may be express (you actively opt in) or implied (reasonably inferred from your action and the circumstances), and the sensitivity of the information determines which is appropriate.

| Purpose | Information used | Form of consent | | --- | --- | --- | | Create and maintain your account | Account and identity information | Express, when you register | | Take, confirm, modify and cancel bookings, and pass them to the salon | Account, booking information | Express, and necessary to perform the booking you asked for | | Send transactional messages: confirmations, reminders, changes, cancellations, receipts, security notices | Name, email, phone, booking details | Implied and necessary; these are not marketing, and CASL exempts most of them | | Bill salon subscriptions and issue invoices | Account, payment information | Necessary to perform our contract with the salon | | Keep the Platform secure, prevent fraud, abuse and unauthorised access, and investigate incidents | Technical and usage information | Legitimate business purpose; a reasonable person would consider it appropriate | | Warn a salon that the phone number booking with it has been independently blocked by several other salons | Phone number, blocks placed by salons | Legitimate business purpose of preventing bad faith bookings; a reasonable person would consider it appropriate | | Provide support and answer your enquiries | Account, communications | Implied when you contact us | | Understand how the Platform is used and improve it | Usage information, analytics events | Implied, with the clear opt out described in the Cookie Policy | | Send you marketing about Meeti Me | Name, email, phone | Express consent, revocable at any time | | Comply with legal obligations and establish or defend legal claims | As necessary | Statutory exception; consent is not required |

Where information is sensitive, and in particular for health related information a salon records in a client note, we rely on express consent given to the salon at the time you disclose it.

We do not use your personal information to make any decision about you by fully automated means that produces a legal effect or a similarly significant effect, and we do not profile you for advertising.

The bad faith booking warning deserves a separate explanation. A salon may add a phone number to its own block list, and that entry applies to that salon alone. Where the same number has been independently blocked by several salons, other salons see a warning marker at the time of booking. The marker neither cancels nor blocks the booking: the decision to accept the client is always the salon's, made by a person. We do not disclose to other salons the reasons for the block, the names of the salons that placed it, or those salons' internal notes, and only blocks placed within the last 12 months are counted. Booking can be restricted across the whole Platform only by an administrator of DOKUMENT.PL sp. z o.o. after reviewing the individual case, never automatically. You may ask us to review a marker at any time by writing to meetime.company@gmail.com, and we will remove it if it proves unjustified.

5. Commercial electronic messages and CASL

Canada's Anti-Spam Legislation (CASL) governs commercial electronic messages sent to an electronic address in Canada. We take it seriously.

Express consent. We send you commercial electronic messages by email or SMS only if you gave us express consent, through an unchecked box or an equivalent clear affirmative action. Consent is never bundled into acceptance of our terms and is never a condition of creating an account or making a booking.

Identification. Every commercial message we send identifies DOKUMENT.PL sp. z o.o. as the sender, states our mailing address Aleja Stanow Zjednoczonych 51 lok. 222, 04-028 Warszawa, Poland and gives an email address and a web address at which we can readily be contacted, and states that we are the sender on behalf of ourselves.

Unsubscribe. Every commercial message contains a clearly and prominently set out unsubscribe mechanism that works for at least 60 days after the message is sent and that is no more difficult to use than the message itself. We give effect to an unsubscribe request without delay and in any event within 10 business days, and we do not require you to log in, pay anything or give a reason.

Transactional messages are different. Booking confirmations, reminders, changes, cancellations, receipts, password resets and security alerts are sent because you asked for a service or because we owe you a legal or safety notice. They are not commercial electronic messages within the meaning of CASL and you cannot unsubscribe from them while you hold an active account or an upcoming booking. You can of course close your account.

Messages sent by salons. A salon that uses Meeti Me to send its own newsletter or promotion to its own clients is the sender of that message and is responsible for holding valid CASL consent for it. We provide the tool and require by contract that the salon comply with CASL. If you receive an unwanted commercial message from a salon, unsubscribe using the link in that message and, if the problem persists, tell us at meetime.company@gmail.com and we will act.

Installation of computer programs. Where CASL requires consent to install a computer program, such as our mobile application, we obtain it before installation and we describe the function and purpose of the program.

6. Service providers and disclosure

We use a small number of service providers. Each is bound by a written contract that limits them to our instructions, imposes confidentiality, requires security measures comparable to our own, and prohibits them from using your personal information for their own purposes.

| Service provider | What it does for us | Information involved | Where it processes | | --- | --- | --- | --- | | Stripe | Processes salon subscription payments in CAD, stores card credentials, issues receipts, detects payment fraud | Billing contact, payment result and card metadata; the full card number goes to Stripe and never to us | European Union, with transfers to the United States under Stripe's own framework | | Amazon Web Services (S3) | Hosts our infrastructure and stores files such as salon photographs, logos and documents | All hosted data, encrypted at rest | European Union (EU/EEA region) | | Amazon SES | Delivers our transactional and, where consented, commercial email | Recipient email address, subject, message content, delivery result | European Union (EU/EEA region) | | PostHog | Product analytics: which features are used and where users get stuck | Pseudonymous identifier, events, page views, coarse device and region data | European Union (EU hosted instance) | | SMS provider | Delivers appointment reminders and, where consented, promotional SMS | Mobile number and message content | European Union, with international routing through carriers to reach Canadian numbers | | Telegram | Optional. Only if you choose to link a Telegram account for notifications | Your Telegram identifier and the notification content | Telegram's own infrastructure, outside Canada |

This is the complete list of processors that receive personal information. We do not use Google Analytics, Google Ads, Meta or Facebook Pixel, or any other advertising or cross site tracking technology. We have not installed any advertising pixel on the Platform.

We also disclose personal information in these situations, and no others:

• To the salon you booked with, so that it can prepare for and provide the service. This is the whole point of the booking.
• To you, on request.
• To professional advisers such as our accountants and lawyers, bound by professional secrecy.
• To a public authority, where we are legally required to disclose, or where disclosure is permitted by law to investigate a breach of an agreement or a contravention of law, or to prevent an imminent danger to a person's life, health or security. Unless we are prohibited from doing so, we will tell you.
• In a business transaction. If our business is sold, merged or reorganised, personal information may be disclosed to the other party. We will only disclose what is necessary to evaluate and complete the transaction, under a confidentiality agreement restricting use to that transaction. If the transaction closes, we will notify you within a reasonable delay, as Law 25 requires.

We do not sell your personal information. We never have and we will not.

7. Storage and processing outside Canada

Your personal information is stored and processed outside Canada. We want to be completely clear about this, because both PIPEDA and Law 25 require it.

Where. Our servers and our principal service providers are located in the European Union and the European Economic Area (EU/EEA). Our company is established in Poland. Some providers named in section 6 may route data through, or provide support from, other countries, including the United States for Stripe and international carrier networks for SMS delivery.

What this means for you. While your personal information is in the EU/EEA, or in any other country where a service provider operates, it is subject to the laws of that jurisdiction. This means that the courts, law enforcement agencies, regulatory authorities and national security authorities of that country may be able to obtain access to your personal information under the laws of that country, including through lawful access requests that may not require your consent or your notification, and Canadian privacy law does not displace those foreign laws.

What we do about it. Before transferring personal information outside Quebec, Law 25 requires us to assess whether it would receive adequate protection, in particular in light of generally recognised principles regarding the protection of personal information. We have carried out that assessment. The EU/EEA has a comprehensive data protection framework, the General Data Protection Regulation, which our assessment concludes affords protection equivalent to that afforded under Quebec law. The transfer is governed by a written agreement with each provider. For onward transfers to the United States, our providers rely on the European Commission's standard contractual clauses together with supplementary technical measures including encryption in transit and at rest. We keep this assessment under review and we will update it if the circumstances change.

Your remedies do not change. Wherever your personal information is held, we remain accountable for it under Canadian law, this policy continues to apply, and you keep every right described in section 9 and every avenue of complaint described in section 13.

If you would prefer that your personal information not be processed outside Canada, we regret that we cannot offer the Platform on that basis, and you should not create an account.

8. Retention

We keep personal information only as long as necessary for the purposes we identified, or as long as the law requires. When a retention period ends we destroy the information securely or, where destruction is not immediately possible, we anonymise it irreversibly so that it can no longer be linked to you.

| Information | Retention period | | --- | --- | | Consumer account and profile | For as long as the account is open, then 24 months after your last sign in or last booking, whichever is later, after which the account is deleted or anonymised. We use the delay so you can return without losing your history | | Salon account and published business page | For the life of the subscription, then 12 months after termination, so the salon can reactivate or export | | Booking history | 36 months from the date of the appointment, to resolve disputes about services rendered and no-show charges | | Salon notes about clients | Controlled by the salon and deleted on the salon's instruction; in any event deleted within 90 days of the salon closing its account, unless the salon has exported them first | | Invoices, payment records and accounting documents | 6 years from the end of the relevant taxation year, as Canadian and Polish tax and accounting law require. We cannot delete these on request | | Records of express consent to commercial electronic messages, and of withdrawal of that consent | 3 years after the consent is withdrawn or expires, so that we can demonstrate compliance with CASL | | Marketing suppression list (people who unsubscribed) | Indefinitely, in minimal form. We keep a hash of the address for the sole purpose of never contacting you again. Deleting it would defeat its purpose | | Risk marker based on blocks placed by salons | Only blocks placed within the last 12 months count towards the warning. A block placed by an individual salon stays on that salon's own list until the salon removes it | | Security and access logs | 12 months | | Analytics events (PostHog) | 12 months, then aggregated | | Support correspondence | 24 months from the closure of the ticket | | Records relating to an actual or anticipated legal claim, complaint or investigation | Until the matter and any limitation or appeal period has ended, whatever the periods above say |

If you ask us to delete your information and we must retain part of it for one of the legal reasons above, we will tell you which part and why, and we will restrict its use to that reason alone.

9. Your rights

You have the following rights. Exercise any of them by writing to meetime.company@gmail.com or to our privacy officer at meetime.company@gmail.com.

Access. You may ask whether we hold personal information about you, and to be given access to it. We will also tell you how it has been used and to whom it has been disclosed, including the categories of person within our organisation who have access to it.

Correction. You may require us to correct information that is inaccurate, incomplete or ambiguous, or to delete information collected without authority. If we have disclosed the information to a third party in the last twelve months, we will notify that third party of the correction, and we will tell you to whom we sent the notice.

Withdrawal of consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent to marketing costs you nothing. Withdrawing consent to the processing needed to run your account means we can no longer provide the account, and we will explain the consequences before we act.

Deletion. You may ask us to delete your account and the personal information associated with it, subject to the retention obligations in section 8.

Portability (Quebec). If you are a resident of Quebec, you may require that the computerised personal information you provided to us be communicated to you, or to any person or body you designate, in a structured, commonly used technological format. We provide a machine readable export of your profile and booking history. This right does not extend to information we created or inferred about you.

De-indexing and cessation of dissemination (Quebec). If you are a resident of Quebec, you may require us to cease disseminating your personal information, or to de-index any hyperlink attached to your name that provides access to that information by a technological means, where the dissemination contravenes the law or a court order, or where the following conditions are met: the dissemination causes you serious injury in relation to your right to respect for your reputation or privacy, that injury is clearly greater than the interest of the public in knowing the information or the interest of any person in expressing themselves freely, and the cessation or de-indexing does not exceed what is necessary to prevent the injury. This matters in practice for a public review or a salon page that names you. Tell us the exact URL and describe the injury, and we will assess it.

Right to be informed and to human review of automated decisions (Quebec). We do not currently make decisions about you based exclusively on automated processing. If we ever do, we will inform you at the time of the decision, and on request we will tell you the personal information used, the principal factors and parameters that led to the decision, and your right to have the information corrected. You will be able to present your observations to a member of our staff who is able to review the decision.

How we handle your request. We respond within 30 days of receiving your request, as PIPEDA and Law 25 both require. Our response and any information we provide are free of charge, unless the request is manifestly unfounded or excessive, in which case we will tell you the charge in advance and you may withdraw your request. We may ask you for information reasonably needed to confirm your identity, and we use that information for no other purpose. If we refuse your request, in whole or in part, we will tell you in writing, give the reasons and the legal provision we rely on, and explain how to seek a review and the time limit for doing so.

Requests about a salon's client file. If your request concerns notes or records a salon holds about you, address it to the salon: the salon decides what goes in its file. Send it to us anyway if you cannot reach the salon or do not know how, and we will forward it and help you follow up.

10. Safeguards

We protect personal information with security safeguards appropriate to its sensitivity, using a combination of physical, organisational and technological measures.

• All traffic between you and the Platform is encrypted in transit with TLS. Data is encrypted at rest.
• Passwords are stored only as salted hashes. Nobody at DOKUMENT.PL sp. z o.o. can read your password.
• Access to production systems follows the principle of least privilege, requires multi factor authentication, and is logged and reviewed.
• Staff and contractors are bound by written confidentiality obligations and are trained on the protection of personal information. Access to salon client notes is restricted to the narrow case where it is strictly necessary to resolve a technical incident, and it is logged.
• We keep backups, we test that they restore, and we hold them under the same protections as production data.
• We assess privacy risk before launching a new feature or engaging a new provider, and we conduct a privacy impact assessment where the law requires one.
• Our software dependencies are monitored for vulnerabilities and patched.

Confidentiality by default. The privacy settings of our functions are set, by default, to the highest level of confidentiality, without any intervention by you.

In the event of a breach. If a confidentiality incident occurs and it presents a risk of serious injury, we will promptly notify the Office of the Privacy Commissioner of Canada, and the Commission d'accès à l'information du Québec where Quebec residents are affected, and we will notify the individuals concerned. We keep a register of confidentiality incidents.

No system can be guaranteed perfectly secure. If you believe your account has been compromised, contact meetime.company@gmail.com immediately and change your password.

11. Children

The Platform is not directed to children. You must be at least 16 years old to create an account on Meeti Me.

A parent or guardian may book an appointment for a child. In that case the adult provides the child's first name and, if the salon needs it, the child's age, and no more. That information is used only to prepare and provide that appointment. We do not create an account for the child, we do not send marketing to the child and we do not build any profile of the child.

We do not knowingly collect personal information from a child under 16 who has created an account on their own. If we learn we have, we delete it promptly. If you believe a child has given us personal information, write to meetime.company@gmail.com and we will act.

12. Changes to this policy

We may update this policy to reflect changes to the Platform, to our service providers or to the law.

When we make a change, we update the version and effective date at the top of this page and keep the previous versions available. If the change is significant, in particular a new purpose, a new category of information, a new service provider or a new transfer outside Canada, we will give you notice at least 30 days in advance, by email to the address on your account and by a notice inside the Platform.

Where a change requires your consent under Canadian law, we will ask for that consent before the change applies to you. We will not apply a new purpose to information we already hold without a fresh consent where consent is required.

Continuing to use the Platform after a change takes effect means you accept the updated policy, except where the law requires your express consent.

13. How to complain

Come to us first. We would rather fix a problem than have you fight for it. Write to our privacy officer at meetime.company@gmail.com, or to meetime.company@gmail.com, or by post to DOKUMENT.PL sp. z o.o., Aleja Stanow Zjednoczonych 51 lok. 222, 04-028 Warszawa, Poland. Tell us what happened and what you would like us to do. We acknowledge every complaint, we investigate it, and we give you a written answer with reasons within 30 days. If we uphold your complaint we will correct our practice, and we will tell you what we changed.

If you are not satisfied, escalate.

Everyone in Canada may file a complaint with the Office of the Privacy Commissioner of Canada:

• Office of the Privacy Commissioner of Canada
• 30 Victoria Street, Gatineau, Quebec K1A 1H3
• Telephone: 1-800-282-1376
• www.priv.gc.ca

Residents of Quebec may instead, or in addition, apply to the Commission d'accès à l'information du Québec for a review of our decision or to file a complaint. An application for review must generally be made within 30 days of our answer or of the expiry of the time we had to answer:

• Commission d'accès à l'information du Québec
• 525, boulevard René-Lévesque Est, bureau 2.36, Québec (Québec), G1R 5S9
• 2045, rue Stanley, bureau 900, Montréal (Québec), H3A 2V4
• Telephone: 1-888-528-7741
• www.cai.gouv.qc.ca

Residents of Alberta, British Columbia may also contact their provincial Information and Privacy Commissioner, whose legislation has been declared substantially similar to PIPEDA.

Where a supervisory authority is designated for your region, its details are: Office of the Privacy Commissioner of Canada; for Quebec residents, the Commission d acces a l information du Quebec, 30 Victoria Street, Gatineau QC K1A 1H3, priv.gc.ca.

Using any of these routes costs you nothing, and it does not affect any other legal remedy available to you.

---

This Privacy Policy exists in English and in French. The English and French versions are equally authoritative, and neither version prevails over the other.