Legal Document

Retention & Deletion Policy

This document sets out the retention periods of the data categories processed by Bokko and how deletion is carried out. Effective as of: November 1, 2026 (v1-r4-en). Previous versions are available at the bottom of the Legal Documents page.

Explanation of terms

Short, plain-language explanations of the technical terms used in this document. The explanations are for readability only and do not change the provisions of the document.

Trial, Starter, Pro: Bokko's subscription plans (Starter, Pro) and the free, time-limited period during which the Pro plan features can be tried.
Public API: Programmatic access that lets a provider's own or contracted IT system manage its data in Bokko directly, without opening the dashboard.
Webhook, endpoint: An automatic message that Bokko sends after an event (for example a new booking) to an internet address (endpoint) set by the provider; the receiving and further processing system belongs to the provider.
Token, secret: A long, unguessable string that grants access to a link or programmatic access; whoever holds it can use it, so it must be kept confidential and regenerated (rotated) when needed.
Calendar subscription (ICS feed): A secret link through which an external calendar application (for example Google Calendar) regularly fetches and shows a staff member's bookings.
Rate limit, scraping: A rate limit sets how many requests someone may send within a period; scraping is the automated, mass downloading of website content.
Payment provider (for example Stripe, Barion): A licensed external company that processes card payments; card data is handled by the payment provider and is not stored by Bokko.
Deposit, card guarantee, no-show fee: Payment options a provider may request: a deposit is a partial amount paid when booking; with a card guarantee the guest's card is only saved, and with the guest's prior consent the provider may charge a fee without the guest being present (off-session) if the guest does not show up (no-show).
GDPR, controller, processor, sub-processor: The GDPR is the European Union's General Data Protection Regulation. The controller decides why and how personal data is processed; the processor processes data on the controller's behalf and instructions; a sub-processor is a further company the processor engages for this.
DPA (Data Processing Agreement): The contract between the provider (controller) and Bokko (processor) that sets out the terms for processing guest data.
Data subject, legal basis, legitimate interest: The data subject is the natural person the personal data relates to. The legal basis is the reason under the GDPR that makes processing lawful (for example performance of a contract, a legal obligation, consent); legitimate interest is a legal basis resting on a balancing of the controller's and the data subject's interests.
Pseudonymisation, anonymisation: Pseudonymisation transforms data (for example with a keyed fingerprint) so that it cannot be linked to a person without additional information; anonymisation permanently removes the link to the person, so the data is no longer personal data.
Export, import (CSV, JSON): Downloading data from Bokko (export) or uploading data into Bokko (import) in general file formats that other programs can also open (CSV, JSON).
Log, audit log: Entries automatically recorded by the system about actions (who did what and when), used for troubleshooting, security and later verification of actions.
Backup (PITR): A regularly made copy of the database from which the system can be restored after a failure or disaster; PITR is the ability to restore to an earlier point in time, and TTL is a setting for automatic expiry and deletion.
Personal data breach: A security event leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Image moderation, quarantine: Automatic checking of uploaded images (Google Cloud Vision SafeSearch) for likely explicit or violent content; a flagged image is moved to non-public storage (quarantine) and is not shown.
OAuth (account connection): A standard authorisation procedure by which the user, without sharing a password, allows Bokko limited access to an external account (for example a calendar) and can revoke it at any time.

Governing Language. This English translation is provided for convenience only. In the event of any discrepancy, the Hungarian version prevails.

Important: where the law requires longer retention, or a legal hold (open dispute, official request, establishment of claims) applies, deletion of the affected record is postponed until the hold is lifted. Scheduled deletion skips records under a legal hold.

1. Principles

Bokko retains personal data only as long as necessary for the specific purpose.
Retention rules follow the needs of service provision, security, legal obligations and the establishment of claims.
Every retention period in the schedule is enforced by an automated process. Method of enforcement: scheduled deletion (a deletion job running daily), database expiry (the record is deleted automatically after its expiry time, typically within 24 hours), anonymisation, or the account deletion procedure (deletion tied to the termination of the business account, Section 3).

2. Retention schedule

2.1 Bookings and guests

Data category	Retention	Starting point	Enforcement	Purpose / legal basis
Booking in any status (requested, confirmed, awaiting a reschedule response, completed, cancelled, declined, no-show) with its event log, payment records and delivery markers	60 months	the date of the appointment	scheduled deletion — bookings under a legal hold excepted	general Hungarian limitation period (5 years), legitimate interest
Completed work recorded without a booking (service, time, staff member, guest, price, discount, payment method, pass usage) with its event log and financial records — in both recorded and voided state	60 months	the date the work was performed	scheduled deletion — records under a legal hold excepted	general Hungarian limitation period (5 years), legitimate interest
Payment provider audit snapshot linked to a booking	60 months	recording	scheduled deletion, and together with the booking	establishment of claims, dispute resolution
Identifier (token hash) of the guest's cancellation, response and deposit payment link	30 days	the date of the appointment (on bookings in any status)	scheduled nulling	data minimisation
Booking-level notification and calendar sync markers	30 days	last write, if the booking is closed or no longer exists	scheduled deletion	operational purpose
Guest profile (with its block history, individual discount, phone and email index)	60 months	last visit — a closed booking or completed work recorded without a booking (without visits: creation)	scheduled deletion — profiles under a legal hold excepted	limitation period, legitimate interest
Automatic no-show restriction	12 months	start of the restriction	scheduled lifting (the restriction is ineffective from the moment of expiry); the lifting is logged in the guest profile's block history	the business's instruction, proportionality
Guest block recorded manually by the business (reason category, note)	until the business lifts it, at most for the retention period of the guest profile	recording of the block	does not expire automatically; the lifting is logged in the block history, and the block is deleted together with the guest profile	the business's instruction
Guest deleted by the business	immediately	the request	the profile, block history and individual discount are deleted; on bookings the name, phone number, email address, notes, booking source (UTM) and on-site service address, and on completed work recorded without a booking the name, phone number, email address and note are anonymised	Article 17 GDPR
Guest deletion request in the "My Data" portal	7-day recovery window, then final	execution of the request	anonymisation (booking and work-record data immediately); the profile becomes a marker without personal data; block history and individual discount are deleted at the end of the window	Article 17 GDPR
Encrypted recovery store (for portal requests)	7 days	completion of the first step of the request	scheduled deletion	data security, revocability
Register of requests submitted in the "My Data" portal (the request, its per-business projection and execution status)	5 years	closure of the request	scheduled deletion	accountability, evidence of fulfilment
Guest email index (keyed hash of the email address and links to business guest profiles)	a link until the referenced guest profile or business account is deleted; the index entry while a link belongs to it	creation of the link	the link is deleted when the guest profile or the account is deleted, and an entry left without links afterwards	fulfilling data subject requests
Data portal sign-in link	valid for 30 minutes; the record is deleted 1 day after expiry	issuance	scheduled deletion	data minimisation
Data portal email queue	7 days	creation	scheduled deletion	operational purpose
Waitlist entry (business waitlist)	90 days after closing	closing (expiry, cancellation, acceptance, removal); an entry expires and closes after 1–90 days according to the business's setting	scheduled deletion	legitimate interest (disputes)
Waitlist offer	30 days	expiry of the offer (closed offers only)	scheduled deletion, and together with the entry	operational purpose
Waitlist uniqueness marker (with email hash)	180 days	sign-up	scheduled deletion; closing deletes it immediately	operational purpose
Guest import file and import job	90 days	creation	scheduled deletion	operational purpose
Review request email job	3 months	creation	scheduled deletion	operational purpose

2.2 Marketing and newsletter

Data category	Retention	Starting point	Enforcement	Purpose / legal basis
Marketing consent record	5 years	last change	scheduled deletion; on a portal request, withdrawal and deletion of the email address	Article 7(1) GDPR demonstrability
Marketing withdrawal record (with a non-reversible hash instead of the email address)	5 years	recording	scheduled deletion	Article 7(1) GDPR, accountability
Consent confirmation email queue	30 days	creation	scheduled deletion	operational purpose
Newsletter event log (delivery, open, click, unsubscribe)	24 months	receipt of the event	scheduled deletion	legitimate interest, complaint handling
Newsletter campaign and recipient snapshot	2 years	creation of the campaign	scheduled deletion	legitimate interest, complaint handling

2.3 Notifications and delivery metadata

Data category	Retention	Starting point	Enforcement	Purpose / legal basis
Email sending log (business and system level)	90 days	sending	database expiry	proof of delivery
Raw delivery provider event	30 days	receipt	database expiry	proof of delivery
Processed delivery provider event	180 days	receipt	database expiry	proof of delivery
Permanent delivery failure	12 months	the failure	scheduled deletion	troubleshooting
Email sending attempt log	30 days	the attempt	scheduled deletion	troubleshooting
Business and staff notification feed	90 days	creation	scheduled deletion	operational purpose
Outbound webhook delivery log (the sent payload is removed when delivery is closed)	365 days	delivery	database expiry, supplemented by scheduled deletion	Terms of Service Section 15, complaint handling

2.4 Business account, staff, audit and security

Data category	Retention	Starting point	Enforcement	Purpose / legal basis
Business account data, profile, configuration, staff, services, uploaded images, and the guest and booking data belonging to the account	during the agreement; after termination until the account is deleted	deletion procedure: the business's request, or 90 days after access ends	account deletion procedure: revocable for 30 days, then automatic permanent deletion (Section 3)	performance of contract
Revoking a staff member's access	access ends immediately; the staff profile and booking history remain	the business's action	evidence of the staff member's acceptance of the notice remains in the business's acceptance log	performance of contract, demonstrability
Anonymisation of a staff profile	immediately, irreversibly	request of the business (owner)	anonymisation: name, email address, introduction, professional details, profile photo and calendar connection are deleted; on bookings, group sessions and notifications the staff member's name is replaced by a neutral label	Article 17 GDPR, data minimisation
Platform admin audit log (access, operations)	7 years	the entry	scheduled deletion	legitimate interest, incident investigation
Sensitive action audit log (e.g. staff removal and anonymisation, discounts, account deletion)	7 years	the entry	scheduled deletion	legitimate interest
API key and integration audit log	7 years	the entry	scheduled deletion	legitimate interest
Admin notification campaign approval record	7 years	creation (on closed campaigns)	scheduled deletion	legitimate interest, demonstrability
Internal admin note on a business profile	7 years	creation	scheduled deletion	legitimate interest
Archive of legal acceptance resets	7 years	archiving	scheduled deletion	demonstrability
Data export audit record	7 years	start of the export	scheduled deletion	accountability
Data export file (download link)	until the link expires	link expiry	scheduled deletion	data minimisation
Evidence export file	24 hours	the request	scheduled deletion	data minimisation
Rate limit record — its key is a hash derived with a secret key from the email address, phone number or IP address	at most 48 hours	end of the rate limit window	scheduled deletion	security
System and lifecycle event log	6 months	the event	scheduled deletion	operational and incident purposes
Content report (reporter email address, comment)	12 months	the report	scheduled deletion	Digital Services Act, legitimate interest
Image moderation log	12 months	the entry	scheduled deletion	legitimate interest
Image flagged by image moderation (non-public quarantine)	30 days	placement in quarantine	scheduled deletion	legitimate interest, data minimisation
Record of a business account deletion request (the owner's email address is removed once the notice of the completed deletion has been sent, or, for a withdrawn request, at withdrawal)	7 years	submission of the request (on completed or withdrawn requests)	scheduled deletion	accountability, evidence of deletion
Trial identity index (pseudonymised key)	5 years	the first trial	scheduled deletion	abuse prevention, legitimate interest
Product review (from a business)	24 months	submission	scheduled deletion	legitimate interest
Bug report (and attached image)	12 months	submission	scheduled deletion	operational purpose
Status page subscription (email address)	until the first incident notification is sent, at most 6 months	subscription	deletion after sending, and scheduled deletion	consent
Referral programme (referral code, credit record concerning the referred account)	while the referring business account exists	creation of the code or the invitation	deletion procedure of the referring account	performance of the referral programme terms
Staff invitation (the invitation link is valid for 7 days; the invitation record is kept afterwards)	30 days	expiry (for an invitation not accepted) or acceptance	scheduled deletion	data minimisation

2.5 Financial and accounting records

Data category	Retention	Starting point	Enforcement	Purpose / legal basis
Payment provider webhook events, payment and operation indexes, document jobs, delivery queue	8 years	receipt or creation	scheduled deletion	Hungarian Accounting Act, Section 169
Commercial change evidence (unused offer snapshot: 30 days)	8 years	creation	scheduled deletion — legal hold excepted	Accounting Act, Section 169
Platform billing snapshot and invoice job, document job, deposit settlement evidence, closure manifest and approval	8 years	creation or approval	scheduled deletion — records within their retention deadline excepted	Accounting Act, Section 169
Legal hold record (lifted)	8 years	creation	scheduled deletion — never while active	demonstrability
Closed (used, voided, expired) gift voucher and pass with its ledger, index and purchase record	8 years	last change	scheduled deletion — never while active	Accounting Act, Section 169
Voucher tax policy acceptance and professional approval	8 years	acceptance or approval	scheduled deletion	Accounting Act, Section 169
Inactive discount code, discount reversal marker, archived pass template	2 years	last change or reversal	scheduled deletion	legitimate interest
On-site payment result index	30 days	link expiry	scheduled deletion	operational purpose
Payment reconciliation event	24 months	first detection	scheduled deletion	dispute resolution
Stripe Connect disconnection event	12 months	the event	scheduled deletion	operational purpose

2.6 Technical and operational data

Data category	Retention	Starting point	Enforcement	Purpose / legal basis
Status page incident and maintenance	2 years	closing or cancellation	scheduled deletion	transparency
Status measurement snapshot	13 months	the measurement	scheduled deletion	availability reporting
Monthly availability summary	2 years	start of the month	scheduled deletion	availability reporting
Cost and usage summaries (platform, daily per business)	2 years	the day	scheduled deletion	operational purpose
Daily email usage summary	13 months	the day	scheduled deletion	operational purpose
Calendar subscription (ICS) token after revocation	60 days	revocation	scheduled deletion	security
Calendar notification channel	1 day	channel expiry	scheduled deletion	operational purpose
OAuth state token	at expiry (10 minutes)	issuance	scheduled deletion	security
Other short-lived locks, idempotency keys, slot holds, booking de-duplication markers	at expiry	expiry	database expiry	operational purpose

3. Deletion rules

Event logs and derived guest indexes linked to a booking must be deleted in coordination with the booking or guest profile.
Identifiers of guest-facing links must be nulled after use or after the booking is closed, as set out in the schedule.
Anonymisation initiated in the guest data-management portal is two-stage: immediate access restriction, followed by final erasure after the 7-day encrypted recovery window. The process covers only operational personal data not subject to statutory retention; records that must be retained by law remain, segregated.
Deletion of a business account. The deletion procedure starts at the business's request or — if the business does not request deletion — automatically 90 days after access has ended. The business receives an email, and reminders 7 and 1 days before the final deletion; the deletion can be revoked for 30 days, during which the data can be exported. After the revocation period the system carries out the deletion automatically: it first verifies that the full deletion scope can be carried out (if this cannot be confirmed, it does not start the deletion and re-checks the conditions regularly), closes access (from then on the request cannot be revoked), then deletes step by step in a way that can be resumed if interrupted, and completes only after a check confirms nothing remains. No partial deletion remains: once started, execution is completed by retrying the missing steps if an error occurs. Between termination and deletion the account is read-only. Accounting records (Section 2.5), records under a legal hold and audit logs held by Bokko as independent controller (Section 2.4) are kept for their own retention periods.

Backups and residual data. Personal data deleted from the operational system may remain in the automatic backups — Point-in-Time Recovery (7 days), daily backup (14 days) and weekly backup (84 days), see DPA Section 14 — until the backup's retention period expires. Data in backups is access-restricted, serves only disaster recovery, and is not restored in normal operation. Records and transactions created at external providers (invoicing, payment providers) are retained under those providers' own retention rules.

4. Data subject requests

Bokko handles requests concerning guest booking data according to the instructions of the business concerned, since the business is the controller of that data; guests can also request anonymisation in the booking.bokko.app/hu/adataim portal. For data needed for Bokko's own purposes as controller, Bokko acts directly (support@bokko.app).

5. Review

This document is reviewed at least once a year and whenever a new data flow, a new external provider or a new legal requirement is introduced.