Bookbaar
Back to home

Privacy Policy

Last updated: 7 October 2026

Introduction

Bookbaar respects your privacy and is committed to protecting your personal data. This privacy policy informs you about how we handle your personal data when you visit our website and tells you about your privacy rights.

What data we collect

We collect and process the following data:

For studio owners

  • Account data (email, password)
  • Business data (name, address, phone number, and your country's business numbers: KVK and VAT number in the Netherlands; Partita IVA, codice fiscale and REA number in Italy)
  • Payment data (via Mollie)
  • Service data (services, prices, availability)
  • Authentication factors (encrypted TOTP secret, hashed backup codes, WebAuthn public keys) — used only to verify it's you when you sign in

For customers

  • Contact data (name, email, phone number)
  • Booking history
  • Payment data (processed by Mollie)
  • Reviews and ratings
  • Authentication factors when you enable two-factor (encrypted TOTP secret, hashed backup codes, WebAuthn public keys) — used only to verify it's you when you sign in

For professionals

  • Account data (email, password)
  • Business data (address, and your country's business numbers: KVK and VAT number in the Netherlands; Partita IVA, codice fiscale and REA number in Italy)
  • Professional profile (skills, certifications, portfolio, languages)
  • Contract terms with studios (pay type, rates, effective dates)
  • Time entries (clock-in/out, breaks) and edit history (who changed what, when)
  • Invoice records (generated by you, stored on behalf of the studio)
  • Authentication factors when you enable two-factor (encrypted TOTP secret, hashed backup codes, WebAuthn public keys) — used only to verify it's you when you sign in

How we use your data

  • Processing and managing bookings
  • Sending booking confirmations and reminders
  • Processing payments
  • Improving our services
  • Complying with legal obligations

Data sharing

We only share your data with the following parties:

  • Mollie: Mollie B.V. (Amsterdam, payments processor, PCI-DSS compliant)
  • Sinch: Sinch (Sweden, EU — delivery of SMS such as booking reminders; your phone number + message content are processed in the EU)
  • Scaleway: Scaleway (France/Netherlands, EU — hosts the application, database, file storage, transactional email and the rate-limiting store; all account and booking data stays within the EU)
  • MapTiler: MapTiler (Switzerland — GDPR-adequate country; converts studio addresses to map coordinates)
  • Google Maps: Google Maps (US — the optional map embed on a studio's public page; loads only on pages where the studio shows a map)
  • Google FCM: Google LLC (US, Firebase Cloud Messaging — Android push delivery; we use only the FCM HTTP API, not the broader Firebase suite)
  • Apple APNs: Apple Inc. (US, APNs — iOS push delivery via the FCM bridge; unavoidable platform-level channel for native iOS notifications)

We never sell your personal data to third parties.

Studios processing customer data through Bookbaar can request our Data Processing Agreement (DPA), including the current sub-processor list, at privacy@bookbaar.nl.

Data retention

We retain your data as long as your account is active or as needed to provide you services. If you delete your account, we will delete your personal data within 30 days, with the following exceptions:

  • Invoice records (including your name, KVK, and amounts) are retained for 7 years after the invoice date, as required by Dutch fiscal law. The studio is the data controller for these records.
  • Contract terms between you and a studio are retained for 7 years, as they justify the invoice amounts for tax audits.
  • These retained records are frozen snapshots — your profile, avatar, and account data are deleted, but the invoice and contract records remain for the studio's legal obligations.
  • Invoices Bookbaar sends your studio, carrying your studio's name, address and KVK and VAT numbers, are kept for 7 years after the invoice date, also after you delete your account, as Dutch tax law requires. Bookbaar is the controller for these invoices.

Your rights

Under GDPR, you have the following rights:

  • Right of access: You can request a copy of your personal data
  • Right to rectification: You can have incorrect data corrected
  • Right to erasure: You can request deletion of your data
  • Right to data portability: You can receive your data in a structured format
  • Right to object: You can object to certain processing

To exercise your rights, contact us at privacy@bookbaar.nl

Cookies

We use cookies to make our website function and improve your experience. Read more in our cookie policy.

Read our cookie policy

Security

We take appropriate technical and organizational measures to protect your data, including encryption, access controls, and regular security audits.

Contact

If you have questions about this privacy policy or your data, please contact us:

Email: privacy@bookbaar.nl

Changes

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on our website.