Privacy & Cookies Policy

booksero booking system · Last updated: 2026-07-13

1. Introduction and controller details

We have not appointed a Data Protection Officer (not required in our case). For any data-related matter and to exercise your rights, write to helpdesk@booksero.com — this is our GDPR contact point.

2. GDPR glossary

• Controller — the entity that decides the purposes and means of processing personal data.
• Processor — an entity processing data on behalf of and on the instructions of the Controller (e.g. an IT-tool provider).
• Personal Data — information about an identified or identifiable natural person (e.g. name, email, phone, IP address).
• Processing — any operation on data: collecting, storing, sharing, deleting, etc.
• Data-Processing Agreement — an agreement (Art. 28 GDPR) under which the Controller entrusts processing to a Processor.

3. Split of roles in the system

booksero is a platform connecting service providers (Tenants — e.g. salons, studios) with their customers (Clients). Under the GDPR, the roles are split as follows:

• a) Operator as Controller. The Operator is the controller of the Client's data for creating and maintaining the account, handling the profile and ensuring the application's technical security.
• b) Sharing data with the Tenant. When a booking is made, the Client's data needed to perform the service (e.g. name, contact, time, scope of service) is shared with the chosen Tenant.
• c) Tenant as a separate Controller. The Tenant then becomes a separate, independent controller of the data for performing the service agreement (e.g. a treatment, a massage) and bears full responsibility for it — including fulfilling data-subject rights in that scope.
• d) Tenant marketing. If the Tenant runs its own marketing (e.g. promotional messages to its customers), it does so as an independent controller. The Operator only provides the system tools, acting in that scope as a Processor on the Tenant's instructions (under a data-processing agreement).

4. System messages vs. marketing

Email, SMS or push notifications about confirming, changing or cancelling a booking are operational (transactional) messages — necessary to perform the agreement and to run the service properly. They are not marketing content and therefore do not require a separate marketing consent. Consent is only required for promotional content (e.g. a newsletter, offers).

5. Cookies and tracking technologies

Tracking technologies (cookies, pixels, SDKs in mobile apps) fall into categories:

• Necessary — ensure the platform works, plus security and login (session). No consent required.
• Functional — remember preferences, e.g. the chosen language. Consent required.
• Analytics — statistics (session time, clicks). Consent required.
• Marketing — ad targeting, including third-party tools (e.g. Google Ads, Meta). Consent required.

Current status: the booksero.com marketing site does not use tracking cookies, analytics or marketing tools — we only use the browser's local storage (localStorage) to remember the language and process the IP address to protect the form against abuse. The panel.booksero.com application uses necessary cookies (to maintain the session and login). If we introduce functional, analytics or marketing cookies in the future, we will ask for your consent via a banner, which you can withdraw at any time.

6. Technical data collected

Some data is collected automatically for technical and security purposes, e.g.:

• IP address,
• mobile device model (unique device identifier),
• browser type and version,
• in-app interaction history,
• session time.

We process this data based on our legitimate interest (Art. 6(1)(f) GDPR): ensuring the security, proper operation and development of the service.

The main legal basis for the Operator's processing of your personal data (such as data provided when registering an account) is the necessity to perform the agreement for electronic services — i.e. the booksero Terms (Art. 6(1)(b) GDPR).

Providing personal data is voluntary but necessary to create an account in the booksero system and to make a booking. Without it, we cannot provide our services.

7. Your rights (GDPR)

In connection with the Operator's processing of your data, you have the right to:

• access your data,
• rectify your data,
• erase your data (the right to be forgotten),
• restrict processing,
• data portability,
• object to processing,
• withdraw consent at any time (e.g. for cookies — via your browser settings or the banner; without affecting the lawfulness of prior processing),
• lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO).

To exercise your rights towards the Operator, write to helpdesk@booksero.com. For data processed by the Tenant (fulfilling the booking, Tenant marketing), you exercise your rights directly with that Tenant as a separate controller.

8. Recipients and processors

Data may be entrusted to trusted providers acting on our behalf under data-processing agreements (including hosting, email, SMS providers and — if the Tenant enables payments — payment operators). A separate recipient/controller of booking data is the Tenant (see §3). We do not sell personal data.

9. Transfers outside the EEA

Where our providers process data outside the European Economic Area, this is based on appropriate safeguards (e.g. Standard Contractual Clauses).

10. Retention

We keep data for as long as needed to provide the service and maintain the account, and afterwards for the period of limitation of any claims and as required by law (e.g. accounting). Technical data (e.g. the IP address used for form protection) is deleted or anonymised once its purpose ends.

11. Security and automated decisions

We apply appropriate technical and organisational measures to protect data: encrypted transmission (HTTPS), restricted access to data and abuse protection. We do not make decisions about you based solely on automated processing (including profiling) that would produce legal effects concerning you.

12. Changes

We may update this policy for valid reasons (e.g. changes in law or the scope of the service). The current version is always available on this page.