Privacy & Cookies Policy

Booksero booking system · Last updated: 2026-09-23

1. Introduction and controller details

We have not appointed a Data Protection Officer (not required in our case). For any data-related matter and to exercise your rights, write to helpdesk@booksero.com — this is our GDPR contact point.

Phone contact: +48 22 112 00 30 (service in Polish) and +353 1 263 3550 (service in English), Monday to Friday, 9:00–17:00 Polish time (8:00–16:00 Irish time). The controller of data relating to calls on both numbers, including the Irish number, is the Operator, VIVI ESTETIC sp. z o.o., established in Poland; our office at 20 Harcourt Street, Dublin 2, D02 H364, Ireland, is a correspondence address, not a separate legal entity. Call recording is described in §8b.

2. GDPR glossary

• Controller — the entity that decides the purposes and means of processing personal data.
• Processor — an entity processing data on behalf of and on the instructions of the Controller (e.g. an IT-tool provider).
• Personal Data — information about an identified or identifiable natural person (e.g. name, email, phone, IP address).
• Processing — any operation on data: collecting, storing, sharing, deleting, etc.
• Data-Processing Agreement — an agreement (Art. 28 GDPR) under which the Controller entrusts processing to a Processor.

3. Split of roles in the system

Booksero is a platform connecting service providers (Tenants — e.g. salons, studios) with their customers (Clients). Under the GDPR, the roles are split as follows:

• a) Operator as Controller. The Operator is the controller of the Client's data for creating and maintaining the account, handling the profile and ensuring the application's technical security.
• b) Sharing data with the Tenant. When a booking is made, the Client's data needed to perform the service (e.g. name, contact, time, scope of service) is shared with the chosen Tenant.
• c) Tenant as a separate Controller. The Tenant then becomes a separate, independent controller of the data for performing the service agreement (e.g. a treatment, a massage) and bears full responsibility for it — including fulfilling data-subject rights in that scope.
• d) Tenant marketing. If the Tenant runs its own marketing (e.g. promotional messages to its customers), it does so as an independent controller. The Operator only provides the system tools, acting in that scope as a Processor on the Tenant's instructions (under a data-processing agreement).
• e) Contact through the assistant on the booking page (Sero FrontDesk). If the Tenant uses the Sero FrontDesk module, a chat window with an automated assistant is available on the Tenant's public booking page and in the booking widget. The controller of the data of a person using that chat — including the content of the conversation and the first name, surname and phone number provided in it — is the Tenant, from the first message and regardless of whether the conversation ends in a booking. In that scope the Operator acts as a Processor, under a data-processing agreement. The rule in point b (data shared when a booking is made) does not apply here — the data is processed for the Tenant from the very start of the conversation.

4. System messages vs. marketing

Email, SMS or push notifications about confirming, changing or cancelling a booking are operational (transactional) messages — necessary to perform the agreement and to run the service properly. They are not marketing content and therefore do not require a separate marketing consent. Consent is only required for promotional content (e.g. a newsletter, offers).

5. Cookies and tracking technologies

Tracking technologies (cookies, pixels, SDKs in mobile apps) fall into categories:

• Necessary — ensure the platform works, plus security and login (session). No consent required.
• Functional — remember preferences, e.g. the chosen language. Consent required.
• Analytics — statistics (session time, clicks). Consent required.
• Marketing — ad targeting, including third-party tools (e.g. Google Ads, Meta). Consent required.

Current status (from 17 Sep 2026): the booksero.com marketing site and the sign-in / sign-up screen of the panel.booksero.com application use the Google Ads tag (Google Ireland Ltd.) solely to measure ad effectiveness, and the booksero.com site additionally uses a Google Tag Manager container (the same provider's tag-management tool, subject to the same consent settings) — whether a click on an ad ended in creating an account or entering the demo. These are marketing cookies and we set them only after your consent given in the banner; without consent the tag runs in cookieless mode (Google receives only anonymised aggregate signals, with no identifier of your browser). You can withdraw consent at any time with the button below or by clearing the site data in your browser. Beyond that we use the browser's local storage (localStorage) to remember the language and your cookie decision, and we process the IP address to protect the form against abuse and — without storing it — to determine the country you are visiting from so we can suggest a language version (a bar at the bottom of the page; we never redirect automatically). If you click that bar or the EN/PL switch, we set a functional cookie lang_choice with the chosen language for 365 days; no cookie is set before that. After signing in, the panel.booksero.com application uses necessary cookies only (to maintain the session and login).

Change cookie settings

6. Technical data collected

Some data is collected automatically for technical and security purposes, e.g.:

• IP address,
• mobile device model (unique device identifier),
• browser type and version,
• in-app interaction history,
• session time.

We process this data based on our legitimate interest (Art. 6(1)(f) GDPR): ensuring the security, proper operation and development of the service.

The main legal basis for the Operator's processing of your personal data (such as data provided when registering an account) is the necessity to perform the agreement for electronic services — i.e. the booksero Terms (Art. 6(1)(b) GDPR).

Call recording and the call log rely on our legitimate interest (Art. 6(1)(f) GDPR); calling you back at your request and handling your enquiry rely on the necessity to take steps at your request or to perform a contract (Art. 6(1)(b) GDPR). Details in §8b.

Providing personal data is voluntary but necessary to create an account in the booksero system and to make a booking. Without it, we cannot provide our services.

7. Your rights (GDPR)

In connection with the Operator's processing of your data, you have the right to:

• access your data,
• rectify your data,
• erase your data (the right to be forgotten),
• restrict processing,
• data portability,
• object to processing,
• withdraw consent at any time (e.g. for cookies — via your browser settings or the banner; without affecting the lawfulness of prior processing),
• obtain a copy of a recorded phone call and request its erasure — write to helpdesk@booksero.com stating the number you called from and the date and approximate time of the call (this is how we verify identity); we reply within 30 days (see §8b),
• lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO) in Poland; if you live in another EEA country you may also complain to the authority there (in Ireland, the Data Protection Commission).

To exercise your rights towards the Operator, write to helpdesk@booksero.com. For data processed by the Tenant (fulfilling the booking, Tenant marketing), you exercise your rights directly with that Tenant as a separate controller.

8. Recipients and processors

We entrust data to providers acting on our behalf under data-processing agreements. The processors we use, together with their role and place of processing:

• Neon (on Amazon Web Services infrastructure) — hosting of the system database; place of processing: United States (Oregon region).
• Replit — hosting of the application (the system’s runtime environment); place of processing: North America.
• Cloudflare (R2 storage) — storage of files uploaded to the system (photos, documents) and of database backups; storage location: Eastern Europe; provider established in the United States.
• Anthropic — the AI assistant in the panel and the assistant powering the chat on a location’s public booking page and in the booking widget (Sero FrontDesk); processes the content of conversations with the assistant and account context (e.g. plan, SMS balance, number of appointments and clients) and, for the chat on the booking page, also the content of conversations held by visitors to that page together with the first name, surname and phone number they provide; place of processing: United States. The provider retains the transmitted content for up to 30 days.
• Stripe — payments and subscriptions; transaction data and the payer’s email address; place of processing: the European Economic Area (Ireland) and the United States.
• Resend — sending emails; recipient addresses and message content; place of processing: United States.
• SerwerSMS — sending SMS messages; place of processing: Poland.
• Telegram — technical notifications for our team (company names and support ticket subjects). We do not send client phone numbers or contact details this way; place of processing: outside the European Economic Area.
• SuperVoIP.pl — the phone system for +48 22 112 00 30 and +353 1 263 3550: call recordings, voicemail messages, call logs and queue handling; place of processing: Poland (see §8b).

A separate recipient/controller of booking data is the Tenant (see §3). We do not sell personal data.

8a. The assistant on the online booking page (Sero FrontDesk)

Locations using the Sero FrontDesk module make a chat window with an automated assistant available on their public booking page. The controller of the data of people using that chat is the company operating the location, and booksero is the processor (see §3, point e).

Before the first message, the person chatting receives an information notice: that they are talking to a program, who the controller of their data is, that the content is passed to an AI service provider outside the European Economic Area (see §9), a link to that company’s privacy policy, and a request not to provide information about their health.

Scope of data: the content of the conversation and — if the person provides them when booking or logging in — their first name, surname and phone number.

Retention period: conversations and messages are deleted automatically after 90 days.

The IP address is not retained — we store only its irreversible hash, used to limit abuse. The chat sets no cookies.

The assistant does not collect health data (Article 9 GDPR): it does not ask for it, and if the person provides it on their own — it does not ask follow-up questions, does not repeat it, and hands the matter over to reception without health details.

Access to the content of conversations: in day-to-day work neither the location’s staff nor booksero’s support has it. The exception is the company’s administrator handling a request under Article 15 or 17 GDPR — every such access is recorded.

Requests concerning a conversation should be directed to the company operating the location, as the controller of that data.

8b. Phone calls and call recording

You can call us on +48 22 112 00 30 (service in Polish) and +353 1 263 3550 (service in English). Both are geographic numbers — a call costs the same as an ordinary call under your operator’s tariff; they are not premium-rate lines. The lines are open Monday to Friday, 9:00–17:00 Polish time (8:00–16:00 Irish time), excluding Polish public holidays for the Polish number and Irish public holidays for the Irish number. The controller of data processed in connection with calls on both numbers is the Operator.

Call recording. Calls on both numbers are recorded from the start of the call, including the voice menu. Purpose: quality assurance and keeping a record of what was agreed. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). We announce recording in the first message you hear; if you do not wish to be recorded, you may end the call and email us at helpdesk@booksero.com. Recordings are kept for 90 days and then deleted automatically.

Queue and callback. If our agent is busy you wait in a queue and hear your position. Pressing 0 takes you to voicemail; pressing 1 requests a callback: your number is then emailed to helpdesk@booksero.com and used solely to call you back (Art. 6(1)(b) GDPR). Callback emails are deleted once the matter is handled, at the latest after 30 days. In connection with the queue we process your phone number, the date and time of the call and the waiting time.

Voicemail. Outside opening hours, on public holidays, when nobody answers or after pressing 0 in the queue you can leave a message. The recording is emailed as an attachment to helpdesk@booksero.com. The phone-system operator keeps the message for 30 days; the copy in our mailbox is deleted 90 days after the matter is handled.

Caller ID and call log. When a call is forwarded to an agent’s phone, the agent sees your number so that they can call you back. The call log (number, date and time, duration, status) is kept by the phone-system operator for 12 months on the basis of our legitimate interest (customer service, settlements with the operator, security).

Phone-system operator. Our phone system is operated on our behalf by SuperVoIP.pl as a processor, under a data-processing agreement. Recordings, voicemail messages and call logs are processed on servers in Poland.

Your rights. You have the right to access a recording of your call and obtain a copy of it (Art. 15 GDPR) and the right to request its erasure (Art. 17 GDPR). Write to helpdesk@booksero.com stating the number you called from and the date and approximate time of the call — this is how we verify identity. We reply within 30 days. We answer voicemail messages and callback requests, or call you back, within one business day.

9. Transfers outside the EEA

Some of our providers process data outside the European Economic Area — this applies to the hosting of the database and the application (Neon, Replit), the AI assistant (Anthropic), sending emails (Resend), technical notifications (Telegram) and — as regards the provider’s place of establishment — file storage (Cloudflare); payments (Stripe) are handled in the EEA and in the United States. The full list, together with each provider’s role, is set out in §8. Such transfers rely on the safeguards required by the GDPR: Standard Contractual Clauses approved by the European Commission, or an adequacy decision (EU–U.S. Data Privacy Framework). A copy of the safeguards in place is available on request at helpdesk@booksero.com.

10. Retention

We keep data for as long as needed to provide the service and maintain the account, and afterwards for the period of limitation of any claims and as required by law (e.g. accounting). Technical data (e.g. the IP address used for form protection) is deleted or anonymised once its purpose ends.

Data relating to phone calls (§8b):

• call recordings — 90 days;
• voicemail messages — 30 days in the phone-system operator’s system and 90 days after the matter is handled in our mailbox;
• call log (number, date and time, duration, status) — 12 months;
• callback request emails — until the matter is handled, at most 30 days.

11. Security and automated decisions

We apply appropriate technical and organisational measures to protect data: encrypted transmission (HTTPS), restricted access to data, separation of individual Tenants’ data enforced also at the database level, backups of the whole database taken once a day and kept for 60 days with an independent provider, complemented by the ability to restore the database to any moment within the last 7 days, and abuse protection. We do not make decisions about you based solely on automated processing (including profiling) that would produce legal effects concerning you.

12. Changes

We may update this policy for valid reasons (e.g. changes in law or the scope of the service). The current version is always available on this page.