Data Processing Agreement (DPA)

1. Parties and definitions

Controller: the subscriber as defined in Section 1 of the Service Agreement (the "Subscriber"), who processes the personal data of its customers (guests) and staff through the platform for its own booking and customer management purposes.

Processor: the operator of the Bokko platform, Bokko Technologies Kft. (registered seat: Fürdőház utca 1, 7100 Szekszárd, Hungary, company registration number: [AFTER REGISTRATION], support@bokko.app; "Bokko"), which processes data on behalf of and on the instructions of the Subscriber, for the purposes set by the Subscriber.

Personal data, processing, data subject: as defined in Article 4 GDPR.

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

2. Subject and duration

The subject of this agreement is the processing performed by the Bokko platform on behalf of the Subscriber within the platform service defined in the Service Agreement.

This agreement enters into force together with the Service Agreement and lasts for the duration of the contractual relationship and thereafter until the deletion under Section 14 has been carried out.

3. Nature and purpose of processing

On behalf of the Subscriber, Bokko performs the following processing operations:

• receiving, storing and managing guest booking requests, including group sessions;
• managing and updating booking statuses, including rescheduling and cancellation flows;
• sending transactional email notifications and optional SMS and email reminders according to the Subscriber's notification settings;
• storing guest profiles, booking history and related event logs for the Subscriber;
• technical handling of optional online payment, deposit, refund, card guarantee and invoicing flows; for a booking with a card guarantee, the Subscriber recording a no-show is an instruction to charge the fee under the card guarantee, and Bokko initiates the charge with the payment provider automatically after the recording, without a separate confirmation;
• managing discount codes and guest-level discounts where the Subscriber uses them;
• executing the automatic no-show restriction enabled by the Subscriber (counting recorded no-shows, applying, expiring and logging the restriction);
• storing and enforcing a guest block recorded by the Subscriber by individual decision, without expiry (reason category and note), for online appointment requests, group session sign-ups, the waitlist and bookings through the Public API, until the block is lifted;
• optional Google Calendar and Microsoft Outlook calendar synchronisation;
• optional staff calendar subscription (ICS feed): a calendar feed reachable through a secret, non-guessable link, enabled by the staff member or by a user entitled to manage calendar integrations (owner, manager), which exposes the staff member's confirmed bookings between 14 days in the past and 365 days in the future — the guest's first name and the initial of their last name, the service name, the time, the booking status and the location address. Any external calendar service to which the staff member adds the link can fetch it; the link can be revoked in the dashboard and is revoked automatically when the staff member is removed, deactivated, unlinked or their staff profile is anonymised;
• optional outbound webhook delivery: if the Subscriber enables the Public API webhook function, Bokko sends booking event data to the endpoint specified by the Subscriber, authenticated with an HMAC-SHA256 signature (with the data set described in Section 4);
• processing waitlist data where the Subscriber has enabled the function;
• storing and displaying staff profiles and managing staff invitations;
• executing guests' data subject requests under Section 5a.

Bokko processes the data solely on the documented instructions of the Subscriber, this agreement and the Service Agreement — unless mandatory law requires otherwise, in which case Bokko informs the Subscriber (to the extent permitted by law).

4. Data categories and data subjects

Special categories of data. The platform neither requests nor requires special categories of personal data (Article 9 GDPR — in particular data concerning health, racial origin, religion or sexual orientation). As controller, the Subscriber is responsible for recording such data on the platform (for example in note fields) only where and to the extent that a condition under Article 9 GDPR and an appropriate legal basis exist, and for generally not using the platform for that purpose. If Bokko becomes aware that such data has been recorded, it informs the Subscriber and handles the data according to the Subscriber's instructions. By accepting this agreement, the Subscriber gives a prior, standing instruction that, where unlawful processing is reasonably suspected, Bokko temporarily restricts or disables access to the data concerned and informs the Subscriber without delay; further handling of the data (lifting the restriction, rectification or erasure) is decided by the Subscriber's instructions. In the case of serious or repeated infringement, Bokko may terminate the Service Agreement with immediate effect.

5. Right to instruct and documentation

The Subscriber is the controller; the right to instruct belongs exclusively to the Subscriber. Bokko processes data solely on the Subscriber's documented instructions, this agreement and the Service Agreement.

If, in Bokko's opinion, an instruction would infringe the GDPR or other applicable data protection law, Bokko informs the Subscriber without delay and may suspend execution until the Subscriber changes or confirms the instruction.

Subscriber settings given through the platform's configuration — such as notification settings, enabling payment integrations, the waitlist function, or the automatic no-show restriction and its threshold — constitute documented instructions.

5a. Advance documented general instruction — guest data-management portal and legal hold

Bokko provides a central, cross-provider guest data-management portal ("My Data", booking.bokko.app/hu/adataim), authenticated with a one-time link sent by email. In the portal the guest can see at which businesses a profile linked to them exists and, with a single request, ask for the anonymisation of their erasable personal data at all businesses concerned. Marketing consent is withdrawn per business, using the unsubscribe link in the newsletter. By accepting this agreement, the Subscriber instructs Bokko in advance, on a general basis, to execute such data subject requests automatically, without individual controller discretion, under the following objective conditions:

• Bokko anonymises only operational personal data not subject to statutory retention (in particular record retention under the Hungarian Accounting Act and VAT Act); records that must be retained by law remain, segregated;
• in the case of an open financial or legal matter (a payment, refund, final invoice or legal dispute in progress) or a legal hold, the affected data is retained until the matter is closed or the hold is lifted, after which the system automatically re-evaluates erasability;
• execution is two-stage: immediate access restriction, followed by final erasure after a 7-day encrypted, isolated recovery period;
• Bokko logs the execution of every data subject request and attributes the legal basis to the controlling Subscriber.

Legal hold. If further retention of a guest's data is necessary to comply with a legal obligation, for official proceedings, or for the establishment, exercise or defence of legal claims, the Subscriber may request a hold at support@bokko.app, identifying the booking or guest concerned, the reason and the expected duration. Bokko records the request, does not delete or anonymise the affected records while the hold is in place, and lifts the hold at the Subscriber's request or when the stated duration expires. The hold is purpose-bound, time-limited and documented. If, in Bokko's assessment, the automatic execution of a request would breach the law, Bokko suspends execution and forwards the request to the controlling Subscriber for decision.

6. Confidentiality

Bokko ensures that persons involved in processing are bound by appropriate confidentiality obligations — statutory or contractual — and that access to data is limited to what is necessary (need-to-know).

The confidentiality obligation survives the termination of the relationship.

7. Technical and organisational measures (Article 32 GDPR)

Taking into account the nature, likelihood and severity of risks, Bokko applies appropriate technical and organisational measures to ensure the security of personal data, in particular:

• Access management: role-based access control according to need-to-know and least privilege;
• Application-level protection: prevention of unauthorised direct data writes, all data changes through controlled, authenticated channels;
• Encryption in transit: TLS on all relevant data transmission channels;
• Guest action authentication: time-limited, cryptographically random tokens for guest-initiated actions;
• Rate limiting: mechanisms and bot filtering on public endpoints to prevent automated abuse;
• Encryption at rest: personal data stored encrypted in the cloud infrastructure;
• Key management: secure, versioned handling of credentials and API keys, separated from source code and user data;
• Access logging: logging of administrator access and sensitive operations;
• Multi-factor authentication: mandatory for platform administrator access, available and recommended for Subscribers.

This DPA sets out the objectives and level of the TOMs; the specific implementation is detailed in Bokko's security summary (available on request under a confidentiality agreement). Architectural changes do not require amending this DPA as long as the level of security remains at least equivalent.

8. Sub-processors (Article 28(2) GDPR)

Bokko may engage sub-processors on the basis of the Subscriber's general prior authorisation. By accepting this agreement, the Subscriber consents to the sub-processors currently engaged.

The list of sub-processors currently engaged constitutes an annex to this agreement and is available at getbokko.com/legal/sub-processors. For each sub-processor, the list contains the legal entity name, the purpose of processing and the data categories processed, the processing location, the safeguard applied for transfers to third countries (Chapter V GDPR), and the effective date of the list.

If Bokko intends to engage a new sub-processor or replace an existing one, it notifies the Subscriber at least 14 days before the change takes effect, by a notice sent to the Subscriber's registered email address and in the dashboard notification area. The notice identifies the sub-processor, the purpose and location of processing, and the effective date.

Within 14 days of receiving the notice, but no later than the working day before the change takes effect, the Subscriber may raise a reasoned data protection objection in writing (by email to support@bokko.app), for example where:

• the sub-processor does not provide adequate transfer safeguards under Chapter V GDPR;
• engaging the sub-processor results in a transfer outside the EU/EEA without adequate safeguards;
• the use of the sub-processor is excluded by a legal or official prohibition.

If the Subscriber does not object within the deadline, approval is deemed given. In the case of a well-founded objection, Bokko abandons the planned change or — if the change is technically unavoidable — the Subscriber may terminate the Service Agreement with immediate effect and free of charge; in that case Bokko refunds the pro-rata part of the prepaid subscription fee attributable to the period after the termination takes effect.

Bokko imposes on sub-processors data protection obligations at least equivalent to this agreement and remains liable to the Subscriber for the performance of the sub-processors' obligations in accordance with Article 28(4) GDPR.

9. Processing location and transfers to third countries (Chapter V GDPR)

The platform's database (Firestore), server-side processing (Cloud Functions), file storage (Cloud Storage) and database backups operate in the European Union, in the Google Cloud europe-west1 (Belgium) region. Some services are not regional: web hosting (Firebase Hosting) serves pages through Google's global content delivery network; the sign-in service (Firebase Authentication) runs on Google's global infrastructure; system logs are stored in Google Cloud's global log storage for up to 30 days (audit logs 400 days); and the application's secrets (which contain no personal data) are stored with automatic replication chosen by Google. Client-side error logging (Sentry) takes place in the EU (Germany).

For each sub-processor, the processing location, any transfer outside the EU/EEA and the safeguard applied (the standard contractual clauses under European Commission Decision 2021/914/EU, or the adequacy decision under the EU–US Data Privacy Framework) are set out in the list of sub-processors; that list is the single authoritative listing of transfers. Copies of the safeguards applied are available to the Subscriber on request.

10. Supporting data subject rights (Article 28(3)(e) GDPR)

Within its technical and organisational capabilities, Bokko assists the Subscriber in fulfilling data subject requests under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection and other rights) on time. The controller's (Subscriber's) response deadline is generally 1 month from receipt, extendable by up to 2 further months for complex or numerous requests (Article 12(3) GDPR).

If a data subject contacts Bokko directly with a request concerning guest booking data, Bokko forwards the request to the Subscriber without undue delay and provides technical assistance where needed.

In the dashboard, the Subscriber can also fulfil data subject requests directly by exporting, rectifying and deleting guest data, and by lifting the automatic no-show restriction.

In the central guest data-management portal (Section 5a), the data subject can also request anonymisation of their erasable data in a self-service manner; Bokko processes such requests on the basis of the general instruction under Section 5a.

11. Personal data breaches (Articles 33–34 GDPR)

If Bokko becomes aware of a personal data breach affecting personal data covered by this agreement, it notifies the Subscriber without undue delay and provides the available information in phases, without further undue delay.

The notification contains (to the extent available):

• a description of the nature of the breach, including the data categories and approximate number of data subjects concerned;
• the name and contact details of the contact person;
• a description of the likely consequences;
• the measures taken or proposed by Bokko to address the breach and mitigate damage.

The Subscriber is responsible for notifying NAIH within 72 hours under Article 33 GDPR where the breach is notifiable. Bokko provides reasonable assistance by supplying the notification and documentation.

Channel for breach notifications: support@bokko.app (subject: "PERSONAL DATA BREACH — [Subscriber name]").

12. Data protection impact assessment (DPIA, Article 35 GDPR)

If the Subscriber is required to carry out a DPIA, Bokko provides reasonable assistance:

• by describing the processing operations and technical measures;
• with documentation of the security measures and sub-processor safeguards applied by Bokko;
• by cooperating in identifying risk-mitigating measures.

Where prior consultation (Article 36 GDPR) is needed, Bokko likewise cooperates with the Subscriber in compiling the necessary documentation.

13. Audit and compliance cooperation

At the Subscriber's request, Bokko makes available the information necessary to demonstrate compliance under Article 28 GDPR, including documentation of the performance of the obligations in this agreement.

The Subscriber may carry out an audit (or engage an auditor), provided that:

• the Subscriber notifies Bokko at least 30 days in advance;
• the audit does not place a disproportionate burden on Bokko's operations (scheduling to be agreed);
• the auditor undertakes appropriate confidentiality obligations to protect Bokko's confidential business information;
• audits may be carried out at most once a year, unless a personal data breach makes it necessary.

Bokko may make an annual security summary available to Subscribers. This summary does not replace or limit the Subscriber's right under Article 28(3)(h) GDPR to initiate inspections and audits.

14. Deletion and return at the end of the relationship (Article 28(3)(g) GDPR)

Return (export). The Subscriber can export its data with the dashboard export function during the relationship and, after the Service Agreement ends — while the account is read-only — until deletion is carried out. The self-service export contains, in a single ZIP package, all transferable data under Section 10 of the Service Agreement and the uploaded files, in the structure published at docs.bokko.io/en/data-export (JSON; images and files in their original format); some partial exports are also available in CSV. The same package can also be requested individually until deletion is carried out, at support@bokko.app.

The Subscriber's choice. The Subscriber exercises its choice under Article 28(3)(g) GDPR in that it can export its data (return) during the relationship and after it ends, until deletion is carried out, and can itself request deletion at any time. If, after access ends, the Subscriber does not decide otherwise within the periods below — in particular does not request the return of its data by individual export —, the deletion procedure below follows on the basis of this agreement, as the Subscriber's prior instruction.

Deletion. The Subscriber may request deletion of the account and the data at any time in the dashboard (Settings → Account). If the Subscriber does not request deletion, Bokko's system automatically starts a deletion procedure 90 days after access has ended. In both cases:

• Bokko notifies the Subscriber by email when the procedure starts and sends reminders 7 and 1 days before the final deletion;
• the deletion can be revoked for 30 days from the start, and the data can be exported during this time;
• after the revocation period, Bokko carries out the deletion automatically: before execution it verifies that the full deletion scope can be carried out, first closes access to the account (from then on the request cannot be revoked), then deletes step by step in a way that can be resumed if interrupted, and considers the deletion complete only once a check confirms that no data to be deleted remains;
• if the conditions for execution are not met or an affected data store cannot be verified, Bokko does not start the deletion and re-checks the conditions regularly; if an error occurs after execution has started, Bokko retries the missing steps and completes the deletion, and no partial deletion remains;
• external calendar connections are stopped before deletion, and the customer object held at the payment provider (Stripe) is deleted;
• deletion covers guest and booking data, staff profiles, uploaded images and files, integration connections and tokens, and the user accounts belonging to the account, insofar as they are not linked to another Subscriber.

Exempt from deletion are data for which Union or Member State law requires retention (in particular accounting and tax records incumbent on Bokko as invoice issuer) and records under a legal hold under Section 5a, until the hold is lifted. At the Subscriber's request, Bokko issues written confirmation of the deletion.

The record of an account deletion request is kept after the deletion is completed or the request is withdrawn, for 7 years from the date of the request, as evidence that the deletion took place. The record contains only the data needed to handle the request (account and owner identifiers, the business name, the source, stated reason, dates and status of the request); Bokko removes the owner's email address from the record once the notice of the completed deletion has been sent, or, for a withdrawn request, at the time of withdrawal. An image flagged by image moderation is kept by Bokko in non-public quarantine for 30 days and is then deleted automatically.

Backups: For the Firestore database, Bokko operates the following backups exclusively for disaster recovery and continuity:

• Point-in-Time Recovery (PITR): the database can be restored to any point within the last 7 days.
• Daily automatic backup: with 14-day retention.
• Weekly automatic backup: every Monday, with 84-day (12-week) retention.

Deleted data may remain in backups until the backup's retention period expires; backups serve only system-level recovery, and individual guest records are not restored unless required to fulfil a legal obligation or for official proceedings. Backups are stored in the EU (europe-west1), encrypted at rest, under the same access controls as the live database.

15. Liability and indemnity

As controller, the Subscriber is responsible for:

• providing guests with appropriate information under Article 13 GDPR during the booking flow;
• recording only lawfully processed data on the platform;
• applying platform settings (in particular the automatic no-show restriction) lawfully and proportionately;
• fulfilling guests' data subject requests on time;
• meeting its notification obligation towards NAIH in the event of a personal data breach.

As processor, Bokko is responsible for performing the obligations undertaken in this agreement. As between the parties, Bokko is not liable for damage resulting from executing the Subscriber's lawful instructions or from the unlawfulness of data recorded by the Subscriber on the platform, unless Bokko has breached obligations of the GDPR specifically directed to processors or has acted outside or contrary to the Subscriber's lawful instructions (Article 82(2) GDPR). This provision does not affect liability towards data subjects under Article 82(4) GDPR or the claim for recovery under Article 82(5).

Each party must notify the other without delay upon becoming aware of any circumstance that may jeopardise the performance of this agreement.

Data protection liability (Article 82 GDPR): For data protection damage resulting from a breach of processor obligations, liability is governed by Article 82 GDPR. The general limitations of liability in the Service Agreement do not apply to such damage.

16. Governing law and dispute resolution

This agreement is governed by Hungarian law and the GDPR. The competent supervisory authority is the authority of the Member State where the controller carries out its activity; for Hungarian controllers, the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (naih.hu).

The parties first seek to settle disputes through negotiation. If this fails, the court stipulated in Section 11 of the Service Agreement has jurisdiction.

17. Amendments and versioning

Bokko may amend this agreement where justified by legislative change, official recommendations, or a material change in the technology used or in the platform's functions. Subscribers are notified by email and in the dashboard at least 30 days before the amendment takes effect; the amendment constitutes an amendment of the Service Agreement and is accepted by the Subscriber in the dashboard. Changes to the list of sub-processors are governed by Section 8.

If the amendment represents a material adverse change for the Subscriber (in particular a narrowing of the Subscriber's rights or a reduction of Bokko's data protection obligations), the Subscriber may object in writing within 30 days of the notice. If the parties cannot agree, the Subscriber may terminate the Service Agreement by extraordinary termination free of charge until the amendment takes effect.

The current version is available on this page; previous versions are available at the bottom of the Legal Documents page.

Document hierarchy: In the event of a conflict between the Service Agreement and this Data Processing Agreement regarding data protection obligations, the provisions of this DPA prevail.

Current version: v1-r6-en — in effect from November 1, 2026.