1. Who we are
Schedivo is operated by BPS Designs Limited, a company registered in England and Wales with company number 05360014. Our registered office is 2A Swordfish Business Park, Swordfish Close, Higgins Lane, Burscough, Lancashire, United Kingdom, L40 8JW.
For privacy enquiries, email [email protected], telephone 01695 302040, or write to our registered office. Please mention Schedivo.
We are the data controller for information used to run our own business, including account administration, billing, security and enquiries. UK data protection law, including the UK GDPR and Data Protection Act 2018 as amended, applies to this processing.
When an organisation uses Schedivo to manage its appointments, calendars and meetings, it generally decides why that customer information is used and acts as its controller. We process that information on its instructions as a processor. Its own privacy notice explains its purposes, lawful bases and retention choices. Contact the organiser first about a booking or recording; you can also contact us for help identifying the appropriate organisation.
2. Information we handle and why
Information comes from you, your workspace administrators, people arranging or joining appointments, connected calendar providers and the devices used to access the service.
- Accounts and workspaces: names, email addresses, password authentication information, verification and security settings, company details, membership and roles. We use these to create accounts, authenticate users and administer access.
- Bookings: booker and guest names and email addresses, appointment times and time zones, meeting types, assigned hosts, answers to booking questions, and cancellation or rescheduling activity. This supports availability, appointments, invitations and reminders on the organiser’s instructions.
- Calendars: connected account identifiers, calendar names and identifiers, authorisation credentials, busy periods, and event details needed to create or manage appointments.
- Meetings: participant names and identifiers, admission and connection state, meeting chat, audio, video, shared screens and recording notices when those features are used.
- Billing, where enabled: billing contact details, customer and subscription identifiers, payment status and invoices. Payment card entry is handled by Stripe’s hosted payment service, rather than a Schedivo card form.
- Service operation and enquiries: IP addresses, browser and device information, authentication and access records, usage and error information, and messages you send us. We use these to deliver and protect the service, investigate faults, answer enquiries and manage our business.
Our lawful bases
For processing where we are the controller, we rely on performing our contract with you or taking steps you request before a contract; our legitimate interests in running a secure, reliable service, supporting business customers and handling enquiries or disputes; and legal obligations such as accounting and responding to lawful requests. Where an account belongs to your employer, administering that relationship normally relies on our legitimate interests rather than a contract with you personally.
Where we rely on consent for an optional activity, we explain that choice at the time and you can withdraw it. Granting a calendar or device permission controls technical access; it does not by itself determine the lawful basis for every use of the information.
Account identification is needed to provide an account, and the required booking fields are needed to arrange an appointment. Without them, we may be unable to provide that feature. Avoid putting health information, payment card details or other sensitive information into booking answers or chat unless the organiser has explicitly arranged appropriate safeguards and told you why it is needed.
Schedivo uses scheduling rules to find availability and assign hosts. We do not use these rules to make decisions about you with legal or similarly significant effects.
3. Connected calendars
Connecting Google Calendar, Microsoft Outlook or a supported CalDAV service lets Schedivo identify the connected account, list available calendars, check the calendars you select for busy times, and create, update or remove Schedivo appointments in your selected destination calendar. Provider permissions may allow access to more events than a particular booking needs.
Connection credentials are encrypted in storage. We use calendar access to provide the scheduling features you request, not for advertising or to sell calendar information. Other visitors see bookable availability, not the titles or contents of your existing private appointments.
You can disconnect a calendar in Schedivo and revoke authorisation with the provider. Disconnecting removes the stored connection credential and stops further access through that connection. It does not automatically delete events already written to your calendar, cancel appointments or erase the provider’s own records.
Your calendar provider also processes information under its own privacy terms. Workspace membership and sharing settings determine which authorised staff can manage appointments.
Google Workspace data
Our access to, use of and sharing of Google Workspace data follow the Google Workspace API User Data and Developer Policy, including its Limited Use requirements. We use this data to provide the calendar and scheduling features you choose. We do not use it for advertising or to train general-purpose artificial intelligence or machine-learning models.
4. Video meetings, chat and local recordings
When enabled, meeting audio, video and shared screens pass through Cloudflare’s real-time communications infrastructure to connect participants. Camera, microphone and screen sharing depend on your browser permissions and controls. Media transport encryption does not mean a call is end-to-end encrypted against every service provider.
Admitted participants can see the meeting’s available chat history, including messages sent before they joined. Meeting chat is held for the active meeting and cleared when that meeting session ends or is invalidated. Meeting identifiers, usage and security records are separate from chat content.
Schedivo’s local recording feature requires the host to choose a file or folder on their device. Recording files are saved there and are not uploaded to Schedivo by this feature. Other participants are shown a recording notice. The host controls the resulting files and is responsible for explaining the recording’s purpose, lawful basis, sharing and retention, and obtaining consent where required. A recording notice alone does not establish consent.
We cannot control recordings made using other software or devices. Ask the organiser about its recording arrangements before sharing confidential information.
6. Security and how long information is kept
We use controls including authentication, access restrictions and encryption of stored calendar credentials to protect information. Access depends on a person’s role and the feature being used. No internet service or recording device can guarantee complete security.
Retention depends on the information and its purpose. Account and workspace information is needed while the account or relationship is active; appointment records support ongoing bookings, changes and enquiries; and billing, security or dispute records may need to be retained after the relationship ends to meet legal obligations or establish, exercise or defend legal claims. We assess retention against those needs rather than applying one period to every record.
For information processed on an organiser’s behalf, its instructions and applicable data processing terms determine retention. Removing a user, disconnecting a calendar or cancelling a subscription does not automatically erase every related record. Contact us or the organiser to request deletion or discuss return of information. Legal requirements, rights of others and backup retention may affect what can be removed and when.
Local recording files remain under the host’s control until the host deletes them. Calendar providers and email recipients retain their own copies under their own arrangements.
8. Your choices, rights and complaints
Depending on the circumstances, you can ask to access or correct your personal information, erase it, restrict its use, or receive a portable copy. You can withdraw consent where it is the basis for processing, without affecting earlier lawful use.
Your right to object
You can object to processing based on legitimate interests on grounds relating to your situation. You can object to direct marketing at any time.
Send requests to [email protected]. We may need proportionate information to verify your identity. Requests are normally free and answered within one month; the law permits extensions or exceptions in some circumstances, which we will explain. Where an organiser controls the information, we help direct the request to it and assist as appropriate.
If you are unhappy with our handling of personal information, contact us so we can investigate. You can also complain to the UK Information Commissioner’s Office through ico.org.uk/make-a-complaint. You do not have to contact us before approaching the ICO.
If laws outside the UK apply to your circumstances, they may give you additional rights. Nothing in this notice removes those rights.
9. Changes to this notice
We update this page when our practices or legal requirements change and show the latest revision date above. Where required, we will draw material changes to your attention before using your information for a new purpose.
Read our Terms of service for the rules on using Schedivo.