1. Data Controller Roles
Bokko is an online appointment request and booking management platform for personal service providers. The system handles two distinct data processing scenarios:
- Service Provider Accounts and Platform Operation: Bokko is an independent data controller regarding provider account data, access credentials, technical and security logs.
- Guest Bookings: The primary business purpose of the booking data provided by guests is to enable the selected service provider to manage the request. Regarding guest booking data, the service provider is the data controller, and Bokko acts as a data processor. The exceptions are the platform security, abuse prevention and legal compliance processing operations marked in Section 3 as independent controller processing (for example rate limiting, bot filtering and handling content reports) — for these, Bokko acts as an independent data controller.
- Platform-level Processing: Bokko processes, as an independent data controller, the data of the provider subscription and the billing relationship, and the data needed for the purposes marked as such in Section 3 (for example the trial identity index, product usage milestones and logging of admin access). From guest booking data Bokko derives for its own purposes only aggregated counts per provider (for example the number of notifications sent) to measure fees, costs and capacity; it does not use individual guest data for its own development or statistical purposes.
The allocation of roles between Bokko and the service providers is recorded in a Data Processing Agreement (DPA) under Article 28 of the GDPR, which forms part of Bokko's Service Agreement. The subject of the agreement is the processing of guest booking data, its duration lasts for the term of the contractual relationship, the data categories and data subjects are listed in Section 2 of this policy, and the right to issue instructions belongs to the service provider. Bokko does not make business decisions regarding the specific terms and content of the service provided; however, it independently performs the technical processing operations necessary for the platform's operation. Therefore, regarding guest booking data, the service provider is the data controller.
Operator and controller. The Bokko platform is operated by Bokko Technologies Kft. (limited liability company). Its details under Section 4 of Act CVIII of 2001 (Ektv.):
Company name: Bokko Technologies Kft.
Registered seat: Fürdőház utca 1, 7100 Szekszárd, Hungary
Company registration number: [AFTER REGISTRATION] (registry court: Company Registry Court of the Szekszárd Regional Court (Szekszárdi Törvényszék Cégbírósága))
Tax number: [AFTER REGISTRATION]
Representative: Dávid Mácsik, managing director
Electronic contact: support@bokko.app
Hosting provider details are on the
Imprint & Contact page.
1a. Data Processing Principles (GDPR Article 5)
When processing personal data, Bokko applies the following principles set out in Article 5 of the GDPR:
- Lawfulness, fairness and transparency — every processing activity is based on a legal basis (typically GDPR Art. 6(1)(a), (b), (c) or (f); see Section 3), and is transparently documented for the data subject.
- Purpose limitation — personal data is collected only for specified, explicit and legitimate purposes, and is not further processed in a manner incompatible with those purposes.
- Data minimisation — the scope of processed data is limited to what is necessary for the processing purpose; that is why the minimum mandatory booking data (name, email address) and the optionality of every additional data field are explicitly indicated in Section 2.
- Accuracy — inaccurate data is rectified or erased without delay upon request (see Section 6, data subject rights).
- Storage limitation — data is stored only for as long as necessary for the processing purpose. Detailed per-data-category retention periods are set out in Section 5 and in the Retention and Deletion Policy.
- Integrity and confidentiality — the security of personal data is protected by appropriate technical and organisational measures (see Section 8).
- Accountability — every processing activity is documented; compliance can be demonstrated (processor records, sub-processor list, retention-jobs audit, consent log).
2. Processed Data
Bokko processes the following data. With respect to guest booking data, the controller is the service provider (see Section 1).
| Data subjects | Data category | Note |
|---|---|---|
| Guests | Name, email address, optional phone number, optional note | Provided on the booking form. Mandatory: name and email address (the booking confirmation is sent by email). Optional: phone number (for SMS reminders) and note. |
| Guests | Requested service, preferred or confirmed date and time, booking status, staff member | Needed to record, manage and confirm the booking request. |
| Guests | Address of the service location and a note on the address | Only for on-site services (provided at an address given by the guest), if the guest provides it. |
| Guests | Booking source: campaign parameters (UTM), referral source, landing page | If the guest arrived at the booking page via a link containing such parameters. Advertising click identifiers are not stored. |
| Guests | Number of no-shows, status, time, expiry and log of the restriction of online requests | No-shows recorded by the provider and data of the automatic restriction enabled by the provider (see Section 3d). |
| Guests | Guest block recorded manually by the provider: the fact and time of the block, its reason category (for example no-show, abusive behaviour, payment issue, other) and an optional text note | Based on the provider's individual decision; at that provider the block closes online appointment requests, group session sign-ups and the waitlist. It does not expire automatically: it lasts until the provider lifts it, at most for the retention period of the guest profile (see Section 3d). Special categories of data may not be recorded in the note. |
| Guests | Discounts: discount code used, individual discount granted by the provider (reason, amount, expiry) | If the provider uses discount codes or guest-level discounts. Code usage is recorded with a pseudonymised guest identifier. |
| Guests | Notification and event log data | SMS and email sending times, delivery status, status changes, responses. |
| Guests | Data related to token-based response, cancellation and payment links | For accepting or declining a reschedule proposal, cancellation and payment. |
| Guests | Transaction metadata related to deposits, card guarantees, no-show fees, on-site online payment and refunds, and a snapshot of the fee terms accepted by the guest | Only if the provider enables such a payment function. Bokko does not store card data. |
| Guests | Billing data | Name, company name, tax number, address and billing email, if the guest requests an invoice. |
| Guests | Data stored in the browser | Language and appearance preference, and offering the name, email and newsletter first name previously entered on the booking form (see the Cookie Policy). |
| Providers | Email address, user identifier, provider data | For sign-in and use of the dashboard. |
| Providers | Legal acceptance and declaration of business or professional use | Version and effective date of the accepted documents, time of acceptance, identifier of the accepting user, and the declaration that the provider features are used for business or professional activity, not as a consumer. |
| Providers | Subscription and billing data | Plan, trial and subscription status, payment events, billing data; card data is handled by Stripe. |
| Providers | Trial identity index | A keyed, pseudonymised hash derived from the user identifier and email address, to determine whether the trial has already been used for the same account or address. |
| Providers | Product usage milestones | Time of registration, setup completion, publishing the booking page and the first booking, in Bokko's own database. |
| Providers | Two-factor authentication (TOTP/MFA) metadata | If two-factor sign-in is active: the TOTP secret and recovery codes in encrypted or hashed form, timestamps of successful and failed authentication. |
| Providers | Provider name, slug, phone number, address, opening hours, notification email, uploaded images | To operate the public booking page and notifications. Header and gallery images of the booking page are checked automatically on upload (see Section 3e). |
| Staff | Staff profile (name, introduction, professional details, profile photo, email), working hours, invitation and access data | Profile data is controlled by the provider and stored by Bokko as processor. The staff member's sign-in data (user identifier, email, session) is processed by Bokko as independent controller. Ending a staff member's access does not anonymise; anonymising the staff profile is a separate, irreversible action, and both actions are recorded in the sensitive action audit log for 7 years. Rules for staff are set out in the Staff Access and Data Processing Terms. |
| Guests / Providers / Staff | Google Calendar and Microsoft Outlook event data (guest name, service name, time) |
With optional calendar synchronisation, event data needed to manage the booking is written to the connected calendar. Bokko uses calendar integrations solely to: (a) create, update and delete booking events it created itself; (b) list calendars for the sync settings; (c) read busy intervals for conflict checks. Bokko does not read the content of other calendar entries.
Two-way sync (deletion detection): If a staff member deletes the Bokko booking event from their own calendar, Bokko by default only notifies the provider. If the staff member has expressly opted in, Bokko also cancels the booking. Calendar subscription (ICS feed): The staff member — or the owner or manager entitled to manage calendar integrations — can enable a secret, non-guessable link that the staff member can add to any calendar application (for example Google Calendar, Apple Calendar, Outlook). The link exposes the staff member's confirmed bookings between 14 days in the past and 365 days in the future: the guest's first name and the initial of their last name, the service name, the time, the booking status and the location address. The calendar application's provider fetches the link from its own systems, so this data also reaches it. The link can be revoked at any time in the dashboard, and it is revoked automatically when the staff member is removed, deactivated or unlinked, or when the staff profile is anonymised; after revocation the link returns no data. |
| Guests | Register of requests submitted in the central data portal and the guest email index | Request identifier, receipt, deadline, targeted providers and execution status; the index links a keyed hash of the guest's email address to the provider guest profiles that can be resolved in the portal (see Section 6a). |
| Status page subscribers | Email address, time of subscription | Address voluntarily provided on status.bokko.io, to send incident notifications (see Section 3). |
| Providers | Referral programme: identifiers of the referring and the referred provider account, the referral code, the fact of activation of the referred account and the credit status | If a provider invites another provider with a referral code, to determine the credit. |
| Content reporters | Reason for the report, comment, optional email address, user identifier for signed-in users | To handle reports made with the "Report a problem" button on business pages (see Section 3e). |
| Platform administrators | User identifier, email, operations performed, IP address and browser identifier | In the platform admin audit log, for security and accountability purposes. |
| Everyone | Error monitoring and diagnostic data | Events related to runtime errors, exceptions and technical diagnostics for stable operation. |
3. Purposes and Legal Bases
| Purpose | Data concerned | Typical legal basis |
|---|---|---|
| Recording and managing booking requests (as the provider's processor) | Guest name, email, optionally phone, service, time, note, on-site address, booking source | According to the provider's legal basis as controller, typically Art. 6(1)(b) GDPR |
| Sending SMS or email notifications about booking status (as the provider's processor) | Phone, email, status data | According to the provider's legal basis as controller, typically Art. 6(1)(b) GDPR, where applicable (f) |
| Executing the automatic no-show restriction (on the provider's instruction, see Section 3d) | Number of recorded no-shows, status and log of the restriction | The provider's legitimate interest (Art. 6(1)(f) GDPR); Bokko acts as processor |
| Storing and enforcing a guest block recorded manually by the provider (as the provider's processor) | Fact, time, reason category and note of the block | According to the provider's legal basis as controller, typically Art. 6(1)(f) GDPR |
| Google Calendar and Microsoft Outlook calendar synchronisation when connected by the provider or the staff member (as the provider's processor) | Booking time, guest name, service name; free/busy status of the staff member's calendar | According to the provider's legal basis as controller, typically Art. 6(1)(f) GDPR. The OAuth permission for the calendar account is a technical grant of access, not a legal basis; Bokko processes the access token of the account connection as an independent controller to provide the requested function (Art. 6(1)(b) GDPR), until disconnection |
| Serving the staff calendar subscription (ICS feed) when enabled by the staff member or the provider (as the provider's processor) | Guest's first name and last-name initial, service, time, booking status, location address | According to the provider's legal basis as controller, typically Art. 6(1)(f) GDPR |
| Delivering booking events to the webhook endpoint specified by the provider (as the provider's processor) | Guest name, service, staff member, time, note, location and on-site address, booking status (without email address and phone number) | According to the provider's legal basis as controller; the provider is responsible for the receiving system |
| Dashboard access and permission management | Provider and staff email, identifier | Art. 6(1)(b) GDPR |
| Proving acceptance of legal documents and the declaration of business or professional use | Accepted versions, time, user identifier | Art. 6(1)(b) and (f) GDPR |
| Subscription, trial, fee payment and invoicing; notices about payment failure, pausing booking and the end of the trial | Subscription and payment data, billing data, email address | Art. 6(1)(b) GDPR; for accounting retention Art. 6(1)(c) GDPR |
| Online payment, deposit handling, card guarantee (as the provider's processor) | Payment metadata, billing data, payment states linked to bookings | According to the provider's legal basis, typically Art. 6(1)(b) GDPR; where required by law, (c) |
| Abuse prevention, rate limiting, bot filtering, system security | Keyed hash derived with a secret key from the email address, the normalised phone number or the IP address (the rate limit record contains no raw email address, phone number or IP address), technical events, logs | Art. 6(1)(f) GDPR – legitimate interest in system security, abuse prevention and service stability, based on a balancing test |
| Preventing abuse of the trial | Trial identity index (pseudonymised hash) | Art. 6(1)(f) GDPR – legitimate interest |
| Error monitoring and operational diagnostics | Technical error reports, exception and performance data | Art. 6(1)(f) GDPR – legitimate interest in service stability and security |
| Handling content reports and image moderation (see Section 3e) | Report data; uploaded images | Receiving and deciding on notices and giving reasons for restricting content: Art. 6(1)(c) GDPR – obligations of Bokko as a hosting service under Articles 16 and 17 of Regulation (EU) 2022/2065; automated image moderation and handling abusive notices: Art. 6(1)(f) GDPR – legitimate interest in protecting the platform and guests |
| Logging platform administrator access | Admin identifier, operation, affected record, IP address, browser identifier | Art. 6(1)(f) GDPR – accountability, incident investigation |
| Recording product usage milestones to operate and improve the service | One-time timestamps of registration, setup completion, first publication and first booking request; Bokko's internal reporting only shows aggregated counts that do not identify anyone | Art. 6(1)(f) GDPR – legitimate interest (aggregated measurement of how the service works and of account activation), based on a balancing of interests. The data stays in Bokko's own EU-hosted database, is not passed to any third-party analytics provider, and is deleted together with the account. |
| Sending incident notifications to subscribers on status.bokko.io (Bokko as independent controller) | Email address, time of subscription; recipient: Mailjet (email delivery) | Art. 6(1)(a) GDPR – consent (subscription is voluntary and can be withdrawn at any time at support@bokko.app). The email address is deleted after the first incident notification is sent, and no later than 6 months after subscription; no email address is written to the delivery error log |
| Keeping the register of requests submitted in the central data portal and maintaining the guest email index (Section 6a) | Request register (identifier, receipt, deadline, targeted providers, execution status); keyed hash of the email address and the links to provider guest profiles | Executing the requests under the providers' prior instruction (Bokko as processor); evidencing their fulfilment: Art. 6(1)(c) and (f) GDPR |
| Referral programme: determining the credit due to the referring provider (Bokko as independent controller) | Identifiers of the referring and the referred account, referral code, the fact of activation of the referred account, credit status | Art. 6(1)(b) GDPR – performance of the referral programme terms |
| Visit measurement on getbokko.com | Aggregated, cookieless visit data (Cloudflare Web Analytics) | Art. 6(1)(a) GDPR – consent (the measurement script loads only after consent) |
| Compliance with legal obligations, establishment of claims | Relevant data related to the matter | Art. 6(1)(c) and Art. 6(1)(f) GDPR |
| Newsletter – marketing communication to guests (as the provider's processor) | Guest email address, name, consent status and legal basis log | Art. 6(1)(a) GDPR – consent of the data subject. Details: Section 3a. |
| Review request email after a completed service — optional, enabled by the provider | Guest name, email address, service name, completion time, provider contact details | Art. 6(1)(f) GDPR – the provider's legitimate interest. Details: Section 3b. |
| Provider onboarding information and subscription lifecycle notices (introductory emails, trial reminders, payment and subscription notices) | Provider email address, name, registration, trial and subscription dates, plan | Art. 6(1)(b) GDPR – transactional communication needed to perform the contract. Not marketing. |
| Delivering push notifications to dashboard users | Push token (pseudonymous device identifier), event type, service name, appointment time, where relevant the staff member's name, internal identifiers and the user's language — without the guest's name, contact details or notes; details are only visible in the dashboard after signing in | Art. 6(1)(b) GDPR; the browser notification permission is the user's choice |
3a. Marketing Communication – Newsletter
Bokko enables service providers (Subscribers) to send newsletters to their guests who have previously provided voluntary consent.
Legal Basis
The legal basis for processing is exclusively the data subject's voluntary, specific, and withdrawable consent (GDPR Art. 6(1)(a), Art. 7). Providing consent is not a condition for completing a booking and can be withdrawn at any time.
Double Opt-in Process
Consent is collected through a two-step (double opt-in) process:
- The guest indicates their intent by checking an optional checkbox during the booking process.
- The system sends a confirmation email to the guest with a one-time, time-limited link.
- Consent is only set to granted status after the link is activated.
Guests will not receive newsletters until they activate the confirmation link.
Methods of Unsubscribing
- One-click unsubscribe link: Included in every newsletter email, with an RFC 8058 compliant
List-Unsubscribeheader and a text-based link. - Direct email request: Guests can request to be unsubscribed via email to the provider or Bokko.
- Request to the provider: Guests can also ask the provider (in person, by phone or by email) to unsubscribe them; the provider records this in the dashboard.
Suppression List
The system automatically excludes guests whose consent has been withdrawn, expired, or whose email address resulted in a hard bounce event. This applies immediately upon withdrawal.
Open and Click Measurement (Engagement Measurement)
Newsletters sent through Bokko use measurement technology provided by our email service partner (Mailjet): the HTML body of the email contains an invisible measurement image (tracking pixel), and links in the email lead to the target URL through a redirect address. Based on this, the system records whether the recipient opened the newsletter and whether they clicked a link in it (the fact and time of the event, and the technical identifier of the message).
- The purpose of the measurement is to gauge the effectiveness of newsletter campaigns for the Provider; the Provider's interface shows campaign-level, aggregated numbers (how many recipients opened the email, how many recipients clicked).
- Only the first open and the first click per recipient count toward the aggregate; no click heatmap, individual browsing history, or profiling is created, and measurement data is not used for third-party marketing purposes.
- If the recipient's email client blocks image loading, opens cannot be measured — the measurement is therefore not exhaustive.
- Measurement events are stored according to the retention period of the "Newsletter event log" below.
This processing takes place within the scope of the newsletter consent; withdrawing consent (unsubscribing) ends further sending and, with it, further measurement.
Open and click measurement takes place only in newsletters. In transactional emails (for example booking confirmations, reminders, deposit and payment notices, gift vouchers, staff invitations, account-related notices) and in the review request email, Bokko explicitly disables measurement at the delivery provider for every send: the delivery provider inserts no measurement image and no click-tracking redirect into these emails.
Retention Periods
- Consent log (audit): 5 years from the date consent was granted or withdrawn, for legal and accountability purposes.
- Newsletter event log (delivery status, opens, clicks): 24 months.
Right to Withdraw
Guests may withdraw their consent at any time without justification. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. After withdrawal, the system immediately adds the email address to the suppression list.
3b. Post-Booking Review Request Email
Bokko enables Providers to send a single transactional review request email to the guest after an appointment has been marked completed. This feature is optional, off by default, and active only with the Provider's explicit opt-in. It is not marketing communication: the email contains no promotional content, no coupon, no rebooking call-to-action, no star rating, and no newsletter signup. The guest receives only a single service-experience question and the Provider's contact details.
Legal Basis
The legal basis is the Provider's legitimate interest in maintaining the customer relationship and obtaining service-quality feedback (GDPR Art. 6(1)(f)). Balancing test outcome: guests reasonably expect a single follow-up check after a service; the processing has low privacy intrusion (no profiling, no marketing content, the email contains no open- or click-tracking, and every email carries a one-click unsubscribe link).
Frequency Cap
The same guest receives at most one review request email within 90 days from the same Provider (frequent-guest protection). This cap is enforced system-wide and cannot be overridden by the Provider.
Unsubscribing from Review Request Emails
Every review request email contains a clickable unsubscribe link. After the guest confirms the unsubscribe (two-step flow: open link → confirm button), no further review request emails will be sent from this Provider to this guest (per-Provider, per-guest unsubscribe). After unsubscribing, the guest receives no further review request emails from this Provider; to change this, the guest can contact the Provider.
Right to Object
Under GDPR Art. 21(1), the guest may object to processing for this purpose at any time. Upon objection, the Provider is required to cease further review request emails without undue delay.
Retention Periods
- Review request email audit (task) log: 3 months from creation. Operational audit and debugging purpose.
- Guest-level last-sent timestamp (used for the frequency cap): retained per the guest record retention period (see Retention and Deletion Policy).
3c. Registration Notification List
While provider registration is not open, Bokko offers interested individuals the option to sign up for a notification list and receive an email notification when registration opens. This signup is not a newsletter and is entirely separate from the Subscriber newsletter consent (Section 3a) — the data subjects here are not guests or Subscribers, but prospective users interested in the platform.
Purpose and Legal Basis
The sole purpose of this processing is to send one confirmation email and then — when registration opens — at most one launch-notification email. The legal basis is the data subject's voluntary, specific, informed, and revocable consent (Article 6(1)(a) and Article 7 GDPR). Giving consent is not a condition of using any service and may be withdrawn at any time.
Double opt-in process
- The interested party provides their email address and name and explicitly consents to notification via a separate checkbox.
- The system sends a confirmation email with a single-use, time-limited link.
- The signup only becomes confirmed after the link is activated; until then, no further email is sent.
Every confirmation email also contains an "I didn't request this / unsubscribe" link, allowing the signup to be withdrawn at any time in a single step — so even a confirmed subscriber can opt out without a second email.
Processed data
- Mandatory: email address and name (to deliver the confirmation and notification emails), plus the fact, timestamp, and text version of the consent statement (provability).
- Technical, abuse-prevention data: a pseudonymized (hashed) value derived from the signup request's IP address and browser identifier, retained only for the short period until confirmation, to filter mass automated abuse. Upon confirmation, these values are removed from the signup record.
Retention periods
- Unconfirmed signup: expires and becomes inactive after 72 hours.
- Confirmed signup: until registration opens, but no longer than 24 months; expires thereafter.
- After notification is sent or after unsubscribe: up to 30 days.
- Consent log (audit): for consent provability, in pseudonymized form (without direct identifiers — name, raw email, IP) for up to 5 years, on a separate legal basis (the demonstrability of consent).
- Abuse-investigation log: the pseudonymized technical data for up to 30 days.
After the periods above elapse, the record becomes inactive and is no longer used; physical deletion is then carried out by an automated process (Firestore TTL). This deletion is not second-precise, but expired data is no longer processed for any purpose.
Right of withdrawal
The signup may be withdrawn at any time, without justification, via the unsubscribe link in the confirmation email. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
3d. Automatic no-show restriction
If the provider expressly enables this function, Bokko, on the provider's instruction, automatically restricts online appointment requests of a guest whose number of no-shows recorded by the provider's staff reaches the threshold set by the provider (between 1 and 20; default: 3). The decision is based solely on the number of no-shows recorded at that provider; data recorded at other providers is not counted, and the restriction does not apply at other providers.
As a consequence, the guest cannot request appointments online with that provider (including group sessions, the waitlist and bookings via partner integrations); the guest can still arrange an appointment with the provider directly. The booking page then shows a neutral message and the provider's contact details. An automatic restriction ends by itself after 12 months, and the provider can lift it immediately at any time; after lifting, counting starts again. The system keeps a log of the restriction, its lifting and expiry, and of online attempts from restricted contact details (as a daily aggregate, without IP or device data).
The provider, as controller, decides whether to enable the function, the threshold and lifting the restriction; Bokko executes it as processor. The guest can contact the provider for human review of the restriction and express their point of view; if a platform error is suspected, the guest can also contact Bokko at the contact details in Section 9. The guest receives no separate notification about the restriction.
Manual guest block. Independently of the automatic restriction, the provider may also, by an individual decision, block a guest's online requests (appointment requests, group sessions, the waitlist and bookings via partner integrations) at that provider. For the block the provider may record a reason category (no-show, abusive behaviour, payment issue, other) and a note of up to 500 characters; special categories of data may not be written in the note. A manual block does not expire automatically: it lasts until the provider lifts it, at most for the retention period of the guest profile. A manual booking for a blocked guest can only be recorded by a staff member with a separate permission. The provider, as controller, is responsible for the decision; the guest can ask the provider to review it.
3e. Content reporting and image moderation
Reporting. Anyone can report unlawful or prohibited content with the "Report a problem" button on a business page. Bokko stores the reason for the report, the comment, the address of the reported page, the language, and, if you provide it, your email address, and for signed-in users the user identifier; no IP address is stored with the report (abuse-preventing rate limiting uses a hash derived from the IP address with a secret key, which is deleted no later than 48 hours after the rate limit window ends). Bokko decides reports by human review and uses the email address to confirm and inform you about the report. Report data is kept for 12 months. The process is described in Section 16 of the Terms of Service.
Image moderation. Bokko automatically checks booking page header and gallery images on upload with Google Cloud Vision SafeSearch at an EU processing endpoint; images likely to depict explicit nudity or violence are not displayed, the provider is notified on the dashboard, and the measure is logged for 12 months. The flagged image is kept in non-public quarantine for 30 days and is then deleted automatically. No facial recognition or identification takes place. Details: AI and automated decision-making.
4. Recipients, processors and infrastructure providers
Data may reach the following providers; some take part only if an optional function is enabled. The complete, current list of providers — with processing location and transfer safeguard — is the list of sub-processors, which is the authoritative listing.
- Google Cloud / Firebase — database (Firestore), server-side functions, file storage (Cloud Storage: uploaded images, import and export files), sign-in, app attestation, web hosting, system logs.
- Google Cloud Vision — automated content check of booking page header and gallery images (Section 3e).
- Google reCAPTCHA Enterprise — bot and abuse filtering (Section 4a).
- Google Maps Platform (Places, Geocoding, embedded map) — address autocomplete in dashboard address fields, server-side conversion of the provider's business address into coordinates, and the map loaded when the guest clicks (Section 4a). For these services Google is not Bokko's processor but an independent controller recipient that processes the data passed to it (the typed address and search text, the provider's business address, technical browser data) under its own terms; no guest data is passed for address autocomplete or coordinate conversion.
- Firebase Cloud Messaging — delivering push notifications; notifications contain no guest name or contact details.
- Mailjet — sending transactional emails, reminders, newsletters and status page incident notifications.
- BulkGate (Spoje.net, s.r.o.) — SMS reminders; EU-based, the delivery chain may involve third countries.
- Sentry — client-side error logging of the dashboard and admin interface in the EU; email addresses, phone numbers and authentication tokens are filtered before sending.
- Google Calendar API and Microsoft Graph / Outlook — optional calendar synchronisation when expressly connected.
- Stripe — collecting Bokko's subscription fees; and guest payments through the provider's own Stripe Connect account.
- Barion — guest payments through the provider's own Barion account, if the provider connects it.
- The payment providers (Stripe, Barion) act as processors in carrying out the payment, but are independent controllers for their own purposes — in particular fraud prevention, risk management, anti-money-laundering customer due diligence and compliance with the legal obligations applying to them; for these their own notices apply: Stripe Privacy Policy, Barion Privacy Policy.
- Billingo, Számlázz.hu — optional invoicing integrations.
- Cloudflare — name server service, proxying traffic of the getbokko.com marketing site, and consent-based, cookieless visit measurement on getbokko.com.
Bokko's database, server-side processing, file storage and database backups operate in the EU (europe-west1, Belgium); web hosting, the sign-in service and system logs run on Google's global infrastructure (details: DPA Section 9). For some providers data may be transferred outside the European Economic Area; such transfers are based on the standard contractual clauses under European Commission Decision 2021/914/EU (SCC) or — where the provider is certified — the adequacy decision under the EU–US Data Privacy Framework.
Bokko notifies providers of changes to sub-processors by email and in the dashboard at least 14 days before they take effect.
4a. External services (Google Maps, reCAPTCHA, Microsoft)
Below we give more detailed information about the following external services. When the Google Maps map loads, and during address autocomplete and coordinate conversion, Google processes the data passed to it as an independent controller under its own terms; the role and transfer safeguard of reCAPTCHA Enterprise and the Microsoft calendar integration are set out in the list of sub-processors.
Google Maps
On booking pages, a Google Maps map may be displayed to show the provider's address, provided that the provider selected their address via the Google Places search and the map section is enabled. The map NEVER loads automatically. On every page load you see Bokko's own stylised location preview, and your browser connects to Google services only when you click the "Show map" button. We do NOT store your choice — neither in a cookie nor in your browser's local storage. You can remove a loaded map with a single click on "Hide map", and after reloading the page — or opening any other Bokko booking page — the preview appears again. When the map loads, your browser may connect to Google services. Google may process technical data such as your IP address, browser and device information, time of access, referrer information, and data based on your existing Google cookies or sign-in state.
The use of Google Maps may also be subject to Google's Privacy Policy and Google's Terms of Service.
Because the consent applies to a single page view, no separate withdrawal interface is needed: withdrawing is exactly as easy as giving consent — one click on "Hide map", or simply reloading the page. Hiding the map does not undo the connection already made to Google; what it does do is stop any further map traffic on that page.
Google reCAPTCHA Enterprise
On public booking, registration and other surfaces sensitive to automated abuse, Bokko uses Google reCAPTCHA Enterprise bot- and abuse-filtering. The purpose of the protection is to prevent mass automated booking or registration attempts and to protect SMS- and email-delivery resources. The filter runs in the background; the user does not need to solve a puzzle and no click interaction is required — Google computes a risk score based on data coming from the browser and only the highest-risk traffic is rejected.
When using reCAPTCHA Enterprise, Google processes technical data automatically
passed by your browser — such as IP address, browser and device signals,
interaction and risk-analysis data — and creates necessary storage items in the
browser (_GRECAPTCHA, and the Firebase App Check firebase-app-check-database
and firebase-heartbeat-database IndexedDB stores; see the
Cookie & Tracking Policy). On the booking page the
protection starts when the page loads. The legal basis for processing is Bokko's legitimate interest in
securely operating the service (GDPR Art. 6(1)(f)). Provider: Google Cloud EMEA
Limited (Ireland; parent company: Google LLC, USA). Further information:
Google's Privacy Policy,
reCAPTCHA Enterprise documentation.
Microsoft Outlook / Microsoft 365 calendar synchronization
Staff members may optionally connect their own Microsoft 365 / Outlook account to Bokko for staff-level calendar synchronization (as an alternative to Google Calendar). The connection is established exclusively through the staff member's explicit OAuth consent.
The synchronization can run in two directions: (1) Bokko reads the staff member's Outlook calendar free/busy state to prevent scheduling conflicts; and (2) Bokko may optionally write confirmed booking times and descriptions to the staff member's Outlook calendar, if the staff member individually enables this. The staff member may disconnect the integration at any time from the dashboard; Bokko then deletes the stored access token and transmits no further data to Microsoft.
For the booking data written to and read from the calendar, Bokko acts as the provider's processor, under the provider's legal basis as controller (typically GDPR Art. 6(1)(f)); in this respect Microsoft is Bokko's sub-processor. The staff member's OAuth permission is a technical grant of access to their calendar, not the legal basis for processing; Bokko processes the access token of the account connection as an independent controller to provide the function requested by the staff member (GDPR Art. 6(1)(b)), until disconnection. Sub-processor: Microsoft Ireland Operations Ltd. (EU); parent: Microsoft Corporation (USA). Transfer safeguards: Microsoft EU Data Boundary + SCC (2021/914/EU) + EU–US Data Privacy Framework. Further information: Microsoft Privacy Statement.
5. Retention Periods
Retention periods are enforced by automated processes. Retention of the main data categories:
| Data category | Retention |
|---|---|
| Provider account data and data belonging to the account | During the contract; after termination until the account is deleted. The deletion procedure starts at the provider's request or 90 days after access ends, is revocable for 30 days, and deletion then takes place automatically. |
| Bookings (in any status: requested, confirmed, awaiting a reschedule response and closed) | 60 months from the date of the appointment, except bookings under a legal hold. |
| Guest profile | 60 months from the last visit. |
| Automatic no-show restriction | At most 12 months; the log of restrictions and their lifting is deleted together with the guest profile. |
| Manual guest block (reason category, note) | Until the provider lifts it, at most for the retention period of the guest profile; deleted together with the guest profile. |
| Guest deletion request in the portal | Immediate access restriction, 7-day recovery window, then final erasure. |
| Register of requests submitted in the portal | 5 years from the closure of the request, as evidence of fulfilment. |
| Guest email index (keyed hash and provider profile links) | A link is deleted when the referenced guest profile or the provider account is deleted; the index entry is deleted when no link remains for it. |
| Email sending log / delivery events | Sending log: 90 days; raw delivery provider event 30 days, processed event 180 days; permanent delivery failure: 12 months. |
| Outbound webhook delivery log (towards the provider's webhook endpoint) | 365 days from delivery; the sent payload is removed from the log when delivery is closed. |
| Rate limit records (with keyed hash) | At most 48 hours after the rate limit window ends. |
| System and lifecycle event log | 6 months. Google Cloud system logs 30 days, audit logs 400 days. |
| Content reports, image moderation log | 12 months. |
| Image flagged by image moderation (non-public quarantine) | 30 days, then automatic deletion. |
| Record of a provider account deletion request | Kept after the deletion is completed or the request is withdrawn, for 7 years from the date of the request, as evidence of the deletion; the owner's email address is removed from the record once the notice of the completed deletion has been sent, or, for a withdrawn request, at the time of withdrawal. |
| Billing and accounting records | 8 years (under a legal hold, until the hold is released) — Hungarian Accounting Act, Section 169; this applies even after the provider's guest data is deleted. |
| Platform admin and sensitive action audit log | 7 years. |
| Internal admin notes on provider profiles | 7 years. |
| Trial identity index | 5 years from the first trial. |
| Status page subscription (email address) | Until the first incident notification is sent, at most 6 months from subscription. |
| Referral programme data | Deleted together with the referring provider's account. |
| Staff invitations | The invitation link is valid for 7 days; the invitation record is kept for 30 days from expiry (for an invitation not accepted) or acceptance. |
The complete retention schedule per data category is available in the Retention Policy.
6. Data Subject Rights
Data subjects are entitled to the following rights under applicable law:
- Right of access,
- Right to rectification,
- Right to erasure (right to be forgotten),
- Right to restriction of processing,
- Right to data portability,
- Right to object to processing based on legitimate interests;
- Rights related to solely automated decision-making (GDPR Art. 22) — a guest affected by the automatic no-show restriction that a provider can enable may request human review from the provider (see Section 3d and AI and automated decision-making).
If a request is related to a booking at a specific provider, the provider can handle the request effectively, as they are the data controller for guest booking data. Bokko, as a processor, supports the fulfillment of these requests without undue delay.
Requests regarding Bokko's independent data processing (e.g., provider account data) can be submitted directly to support@bokko.app.
6a. Central Data Management Portal ("My Data")
Bokko provides a central, cross-provider, self-service data-management portal named "My Data", available at booking.bokko.app/hu/adataim. The portal allows a guest, from a single place and based on their email address, to find those providers using Bokko where a profile was created as a result of their bookings, and to request anonymisation of their erasable data at all of those providers with a single request — without separate customer-support correspondence. The conventional channels (via the service provider, or at support@bokko.app, see Sections 6 and 9) remain available.
Authentication (magic link)
The portal does not require a password. The guest enters their email address, to which the system sends a one-time, short-lived authentication link ("magic link"). Requests can only be initiated from the authenticated session created by opening the link. If no data is associated with the email address provided, the system returns the same generic response — so the portal does not reveal whether a given email address exists in the system (enumeration protection).
What the guest can request
- Withdrawal of marketing consent — per provider, using the unsubscribe link in the newsletter; an anonymisation request also withdraws newsletter consent. Withdrawal takes effect immediately (see Section 3a, suppression list).
- Anonymisation of erasable data — the guest may request removal of their identifying data (name, email, phone number, free-text notes, on-site address, booking source) at all providers where this is not prohibited by law. Erasure covers operational data not subject to statutory retention.
How Bokko executes it
Regarding guest booking data, the service provider is the data controller and Bokko acts as a processor (see Section 1). Bokko performs the anonymisation on the basis of the controller's (provider's) advance, contractually documented general instruction, under objective, automatic conditions (guards) — that is, it does not make an individual discretionary decision on the guest's behalf. The process has two stages:
- 1. Access restriction (immediate): once the request is accepted, the guest's operational identifying data is locked, and the system stops any further personalised processing of it (notifications, marketing).
- 2. Final erasure (after a 7-day recovery window): following a 7-day, encrypted, isolated recovery period, the operational personal data is permanently erased. Only a non-personal, technical lifecycle marker remains from the guest profile (to preserve references to past bookings), which no longer contains any personal data.
What recovery means — and what it does not
The short recovery window serves solely to allow the operational identity (name, email, phone number, contact fields of active/future bookings) to be restored in the event of an erroneous request, or one not initiated by the guest. Recovery does not mean a full historical restoration: the deleted notes of already-closed, past bookings are not brought back. Marketing withdrawal is not automatically revived during recovery either — for a new newsletter, the guest must give explicit consent again.
Honest outcome — what is deleted and what remains
The portal displays the outcome of the request honestly, per provider. We never claim that "all data has been deleted from all systems". The possible outcomes are:
- Completed — the operational personal data has been anonymised at the given provider.
- Retained under law — certain records (in particular issued invoices and their associated billing data) remain, segregated, for the mandatory retention period under the Hungarian Accounting Act and VAT Act. These records are access-restricted and cannot be used to rebuild the guest profile. In the case of an open financial matter (a payment, refund, or final invoice in progress), the data of the affected booking is retained until the financial matter is closed, after which the system automatically re-evaluates erasability.
- Awaiting controller decision — in certain cases the request is decided by the controlling provider (not by Bokko).
The durable evidence of the marketing withdrawal (the fact and timestamp of the withdrawal) is retained for legal and demonstrability purposes; however, it stores no unnecessary data in a form traceable to the data subject (see Retention and Deletion Policy).
8. Data Security
Among others, Bokko applies the following technical safeguards:
- permission-based database access rules,
- prohibition of direct client-side booking writes (bookings can only be created through a controlled server-side flow),
- phone number normalisation, abuse-preventing rate limiting and bot filtering,
- time-limited, token-based guest links,
- multi-layer automatic backups (Point-in-Time Recovery for 7 days, daily backup with 14-day and weekly backup with 84-day retention) — details in DPA Section 14.
Platform administrator access. Bokko's platform administrators may access providers' and guests' data only for strictly limited, documented reasons. Administrator access requires two-factor authentication; for high-risk, sensitive data-changing operations an active, server-side two-factor session confirmation is required. Admin access displaying personal data and admin operations are recorded in the platform admin audit log (timestamp, admin identifier, type of operation, affected provider and record identifier). Bokko keeps the audit log for 7 years and processes it solely for security, legal compliance and incident handling purposes.
Complete security on the internet cannot be achieved. In the event of a personal data breach, Bokko acts in accordance with the law: as controller, where necessary it notifies the supervisory authority without undue delay and, where feasible, within 72 hours, and the data subjects in case of high risk; as processor, it reports the breach to the provider concerned without undue delay.
Bokko processes only necessary and proportionate data; data minimisation is applied at the level of feature design and implementation.
9. Complaints and Contact
Data Protection Officer (DPO): Under GDPR Article 37, Bokko is not required to designate a DPO, because (a) it is not a public authority or body performing a public task, (b) its core activities do not require processing operations which by their nature, scope and/or purposes require regular and systematic monitoring of data subjects on a large scale, and (c) it does not process on a large scale special categories of data or criminal-conviction data. Data-protection questions can be directed to support@bokko.app.
For privacy-related questions or requests, write to: support@bokko.app. Bokko responds without undue delay, and at the latest within the applicable legal deadlines.
In Hungary, complaints can also be filed with the National Authority for Data Protection
and Freedom of Information (NAIH):
NAIH
H-1055 Budapest, Falk Miksa utca 9-11, Hungary
Phone: +36 (1) 391-1400
Email: ugyfelszolgalat@naih.hu
https://www.naih.hu/
10. Versioning
Bokko reserves the right to update this policy. In case of significant changes, the effective date of the new version will be indicated on this page, and separate notifications may be sent to service providers.
Review: Bokko reviews this policy annually, and whenever EU or Hungarian legislation changes, and reflects the identified changes in a new version. Previous effective versions are accessible from the bottom of the Legal Documents page.