Data security
Your data in Zencal.
Clear terms, simple steps.
Learn how we protect data, who is responsible for it and how to secure your account.
Data protection
How we protect your data.
Our commitments are set out in the data processing agreement, which forms part of the terms.
Access and confidentiality
The Zencal team cannot access your data without your consent, such as when you request technical support. Every Zencal employee has signed a confidentiality agreement.
Safeguards
We use technical and organisational measures appropriate to the risk, conduct penetration tests, and Cloudflare protects the service against DDoS attacks.
Payments
Payments are handled by providers including Stripe, PayU, Autopay, Przelewy24, PayPal and Tpay. We cannot access card details used to pay for subscriptions.
Breach notification
We notify you by email without undue delay of a security breach involving entrusted data, no later than 24 hours after the breach occurs.
Data and GDPR
Who is responsible for the data?
Responsibilities depend on whose data you use and in what role.
If you run a business
You are the controller of client and team data you enter into Zencal. You decide the purpose and duration of processing. Zencal processes this data on your behalf under a data processing agreement.
If you book an appointment
The professional or business with whom you book is your data controller. Contact them with requests to correct or delete your data.
If you have a Zencal account
Zencal sp. z o.o. is the controller of your account, billing and contact data. Our privacy policy describes the details and your rights.
When the service ends
At your choice, we delete or return entrusted data unless law requires retention. You may also conduct an audit under the terms set out in the agreement.
Two-factor authentication
Add a second sign-in factor.
In addition to your password, use a code from an app or a security key. A password alone is then not enough to sign in.
Authenticator app
An app on your phone generates a short-lived code. It also works without an internet connection.
- Install an authenticator app, such as Google Authenticator or Microsoft Authenticator.
- In your Zencal account settings, enable two-factor authentication and select the app.
- Scan the QR code and enter the app's code to confirm setup.
Security key
Connect a FIDO2/WebAuthn key to your computer or tap it against your phone. When signing in, confirm access by touching the key. It is bound to the website address, helping protect against phishing.
Choose a connector for your devices: USB-A, USB-C or NFC. Make sure you have a backup sign-in method.
Good practices
How to secure your account.
A few habits help reduce the risk of losing access and data.
Use a unique password
Choose a long password you don't use elsewhere. A password manager can help.
Enable 2FA and prepare a backup
Add an app or security key. Keep a backup sign-in method separately.
Manage team access
Everyone should use their own account and have only the permissions they need. Remove access when someone leaves.
Watch for suspicious messages
Check the website address before signing in and never share passwords or codes. Update devices and sign out on shared equipment.
Protect exports and integrations
Store client data files securely and delete them when no longer needed. Connect only integrations you use.
When something goes wrong
Suspect unauthorised access?
Act as quickly as possible and contact us.
- Change your Zencal and associated email passwords. If you sign in through an external account, secure that too.
- Enable two-factor authentication if you haven't already.
- Check team members and connected integrations. Remove any you don't recognise.
- Write to hello@zencal.io and describe what happened and when.
- If client data may have been breached, assess as controller whether notification to the President of the Polish Data Protection Office is required. The GDPR provides for notification without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
FAQ
Frequently asked questions.
Where can I read Zencal's personal data protection terms?
In three public documents: the Privacy Policy, the Terms and Conditions, whose first appendix is the data processing agreement, and the DPA page with the list of subprocessors. Links are also in every page footer.
Where can I find the data processing terms?
The data processing agreement and privacy policy describe processing. The list of subprocessors is public.
Can the Zencal team access my clients' data?
The Zencal team cannot access your data without your consent, for example when you ask us to investigate a support request. Everyone with access to entrusted data is bound to confidentiality.
Do I have to sign a separate data processing agreement?
No. The data processing agreement compliant with Article 28 of the GDPR is the first appendix to the Terms and Conditions. You enter it by accepting the Terms and Conditions.
Do you conduct security tests?
Yes. We conduct penetration tests of the Zencal application. If you find a vulnerability, email hello@zencal.io before disclosing it.
How do I enable two-factor authentication?
In your Zencal app account settings. Choose an authenticator app or physical key and follow the on-screen instructions.
Which security key should I choose?
A FIDO2/WebAuthn-compatible key, such as a YubiKey, with a connector for your devices: USB-A, USB-C or NFC for a phone. Consider a backup sign-in method too.
What if I lose my phone or key?
That's why a backup sign-in method is useful. If you lose account access, email hello@zencal.io from the address associated with your account.
I received a suspicious message that looks like it's from Zencal. What should I do?
Don't click links or share passwords or codes. Type the app address into your browser yourself and forward the suspicious message to hello@zencal.io.
Contact
Have a data question?
Write to us about data protection, the processing agreement or account security.
hello@zencal.io