This is our privacy information for people whose business has an entry here. The same text is part of our privacy policy.
Entries and requests on plan-it-now.com
plan it now (plan-it-now.com) is a brand of SavePaperwork. Besides the booking pages of businesses that use our software, plan it now shows entries for other businesses, built from public data: for companies as well as for sole traders and partnerships. Anyone can report an entry, and a business can have its entry corrected or removed, or take it over. This section is our privacy information for the people these entries concern (Art. 14 GDPR). The same text appears on the page “Where the data comes from” on plan-it-now.com.
Entries currently come from these countries: Austria, Belgium, France, Germany, Italy, Netherlands, Poland, Spain, Switzerland, Türkiye, United Kingdom.
Controller: the operator of SavePaperwork. You will find the name and contact details in our imprint. For any question about these entries, including your rights, please write to the e-mail address given there with the subject “Data protection”.
Entries
An entry names a business, its trade and its address. Where one person or a partnership runs the business, these details relate to people and are personal data; the same applies where a company name contains the name of a person. This information therefore covers every entry, whatever the legal form of the business.
Source: the Places data of the Overture Maps Foundation (overturemaps.org), a publicly accessible dataset under open licences that passes on data from providers such as Meta, Microsoft, Foursquare and AllThePlaces. Each entry names its provider and the date that provider gives for its details. Categories of data: name of the business, trade, address with map position, provider and its date. For a company whose name carries a legal form in which no person is personally liable, the entry also shows a phone number from the source. From sole traders and partnerships we take over no phone number; their entry shows one only if the owner has entered it or expressly confirmed it. Internally we also keep the identifiers of the entry in the source, the legal form we read from the name and keys derived from name and postcode.
Some entries do not come from Overture but from the business's own website: from the legal notice that a business has to publish by law, or from the business and contact details it publishes there. From those pages we take the business name, the legal form where the name carries one, the trade and the address, and for a business with a legal form in which no person is personally liable also a phone number, mobile numbers included. We retrieve those pages once a month. For a sole trader the business name can be the person's own name. Other names of people on the page, for example of owners, managing directors or those responsible for the content, and e-mail addresses are discarded while the page is read; we do not store them, unless a name is part of the business name itself. The source of these details is the business's own website, a publicly accessible source (Art. 14 para. 2 lit. f GDPR). To find a business's website, we also use public directories and map services. We work out the map position from the address with OpenStreetMap data.
Purposes: people should be able to find and reach a business, and we run plan it now as an overview of local businesses. Legal basis: Art. 6 para. 1 lit. f GDPR. Our legitimate interests are these: we want as many people as possible to find plan it now, and we want businesses to get to know our booking software through their entry, which offers them to take it over free of charge; a business that uses our software gets a booking page. People looking for a business have an interest in finding its address, and a business has an interest in being found where its details are public anyway. We have weighed these interests against yours and limit an entry to what is needed: no phone number of a sole trader or partnership without the owner's own consent, no e-mail address, no website, no photos, no reviews and no list or search on this site that contains the entry.
Recipients: anyone who opens an entry, including search engines, to which our sitemap announces entries; our hosting and e-mail provider in Germany, which processes the data on our behalf; and, for entries taken from a business's own website, komoot's geocoding service Photon. It receives only the address, without a name, so that we can work out the map position. If someone plans a route from an entry, their browser passes the name and address of the business to the map service. We do not sell the data and pass it on to no one else. We do not transfer it to countries outside the EU or the EEA.
We do not write to each business individually. The entries concern several hundred thousand businesses in several countries, the source changes every month and some of its details are years old, so many letters would reach businesses that no longer exist. That effort would be out of proportion to the effect of an entry: it shows only details that are public anyway, and any business can have it removed at any time. We therefore publish this information instead and have documented our assessment (Art. 14 para. 5 lit. b GDPR).
Storage period: an entry stays online only as long as the source lists the business. If we have not been able to update our data for 45 days, it goes offline by itself. If a business has its entry removed or objects to it, we delete the entry. We then keep only keys derived from its identifiers in the source and from its name with postcode, so that a later release of the source does not bring it back, and we keep these keys for as long as the removal stands. We cannot change the public source data itself. We skip every entry whose key is blocked when we build our monthly working copy and again when we import it; working copies made before the removal are replaced within the next two monthly updates. Copies in our backups and in those of our hosting provider are no longer used and are overwritten as the backups are regularly rotated.
Your rights: you can ask us whether and which data about you we process (Art. 15 GDPR), have incorrect data corrected (Art. 16 GDPR), and have data erased (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR). On an entry, use “Is this your business?”; for anything else, write to the e-mail address in our imprint. We usually handle a request within 7 days and always within one month. You can also complain to a data protection supervisory authority, in particular in the EU member state where you live or work or where you consider the infringement to have taken place (Art. 77 GDPR).
The supervisory authority responsible for us is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). In the EU countries from which our entries come, you can also turn to these supervisory authorities:
Right to object
You can object at any time to the entry about your business (Art. 21 GDPR). You do not have to give reasons: we remove the entry, usually within 7 days, and keep it from coming back. Use “Is this your business?” on the entry and choose “Remove”, or write to the e-mail address in our imprint with the link to the entry.
We assign each entry to one of our trades automatically and read its legal form from the name; the legal form only decides whether an entry shows a phone number from the source. We take no decision based solely on automated processing that has legal effects on you or similarly significantly affects you (Art. 22 GDPR), and we do not build profiles.
Reporting an entry
When you report an entry, we process the reason you choose, your optional text and, if you give one, the link to another entry. We do not ask for your name or e-mail address and store no IP address with the report; our server uses your IP address only briefly, to limit repeated reports. Legal basis: Art. 6 para. 1 lit. f GDPR, our interest in correct entries. We delete the report 90 days after we have handled it. Copies in our backups and in those of our hosting provider are no longer used and are overwritten as the backups are regularly rotated.
Requests from a business (“Is this your business?”)
When you send a request, we process your e-mail address, the entry concerned, what you ask for, the changes you propose and your statement that the business is yours or that you act for it. We send a confirmation link to the address, look at the confirmed request and send you the result at the same address. Legal basis: Art. 6 para. 1 lit. f GDPR, our interest in changing an entry only at the request of the business; where you exercise a right under the GDPR, Art. 6 para. 1 lit. c GDPR in conjunction with Art. 12 GDPR. If the business is run by one person or a partnership, its entry shows a phone number only if the owner enters it or expressly confirms it. We store that consent with its date and time (Art. 6 para. 1 lit. a GDPR). It can be withdrawn at any time; the entry then shows no phone number. After a withdrawal we delete the number at once. As proof of the consent we keep, on the basis of Art. 6 para. 1 lit. c GDPR in conjunction with Art. 7 para. 1 GDPR, only a record of when it was given and when it was withdrawn. We delete that record 3 years after the end of the year in which the consent was withdrawn. An unconfirmed request is deleted 72 hours after it was sent. We delete your e-mail address 30 days, and the rest of the request 90 days, after we have handled it. If you take an entry over, we keep two things for as long as you maintain the entry, so that we recognise a later request from you: a key derived from your e-mail address, and the domain of that address. The domain also shows whether your address matched the business's website when you took the entry over. We do not keep the address itself. Copies in our backups and in those of our hosting provider are no longer used and are overwritten as the backups are regularly rotated.
We protect both forms with ALTCHA, a method against automated submissions that runs in your browser and on our server without any third-party service. The notice that a new report or request has arrived reaches us without any personal data.
If you are in the United Kingdom: the UK GDPR and the Data Protection Act 2018 apply as well, with the same articles and the same rights as described above. If you want to complain about how we handle data about you, please write to us first at the e-mail address in our imprint; we acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office (ico.org.uk).