Privacy Policy

1. Data controller

The data controller for your personal data is BookStudioNow, an online platform (hereinafter: "Controller"), for your account, sign-in security, billing and customer support.

Data that an Organisation (e.g. a studio) enters into the Service about its staff and collaborators - bookings, working hours, absences, comments - belongs to that Organisation, which is its controller. BookStudioNow processes it only on the Organisation's behalf, as a processor (GDPR Art. 28), on the terms set out in the Terms of Service (§6). For questions about that data, contact your Organisation first.

2. Data protection contact

For all matters relating to the processing of personal data and the exercise of your rights under the GDPR, contact the Controller at:

3. Purpose and scope of processing

The Controller processes personal data for the following purposes:

a) Account management

We process your email address, name and organisation data to enable sign-in, manage permissions and communicate with you. Accounts are created by the Organisation's administrator.

To keep sign-in secure we also process: your password (only as a one-way hash - nobody, including us, can read it), the encrypted key of your authenticator app (TOTP), a list of recognised devices (a device cookie, the browser type and an approximate country derived from your IP address on our own server) and your sign-in history. This data is used only to protect your account from unauthorised access.

b) Studio booking and schedule management

Booking data (resources, time slots, user assignment, session descriptions) is processed to deliver the core function of the platform - studio schedule management.

c) Hour tracking and absence management

Working hours, time budgets, absence records (holidays, out-of-office), and hour reports are processed to allow the Organisation to manage its team's working time. This processing is carried out solely on the Organisation's instructions as data controller.

d) Custom task management

On Growth plans and above, Organisations may define custom task categories and assign users to them. This data is processed to deliver the task management feature and is visible only to authorised members of the Organisation.

e) Equipment module

Equipment booking data is processed to allow the Organisation to manage its physical studio resources.

f) Invoicing and billing

Data required for invoicing (name or company name, VAT ID, address) is processed to comply with legal obligations under Polish tax law.

g) Audit log

We record user actions within the Organisation (creating/editing/deleting bookings, permission changes, logins) to ensure accountability and security. Retention is configurable by the Organisation: booking change history 12 months by default, all other entries 6 months by default.

h) Security and fraud prevention

We collect technical logs (IP addresses, timestamps, session IDs) to protect service integrity and detect unauthorised access.

i) Customer support

Email correspondence with customer support is retained to handle inquiries and complaints.

4. Legal bases for processing

• GDPR Art. 6(1)(b) (performance of a contract) - processing necessary to provide the services described in the Terms: account management, booking management.
• GDPR Art. 6(1)(c) (legal obligation) - issuing VAT invoices and archiving financial documents as required by Polish tax law.
• GDPR Art. 6(1)(f) (legitimate interests) - security logging, fraud prevention, and service improvement. A balancing test has confirmed these interests do not override the rights and freedoms of data subjects.
• GDPR Art. 6(1)(a) (consent) - marketing newsletter (where applicable); consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5. Retention periods

• Account data - for the duration of the service agreement, then for a further 5 years to the extent required by tax and accounting obligations.
• Booking data (active and completed) - for the duration of the agreement. Bookings are not deleted automatically, as hour records and reports are built from them; the Organisation can delete them at any time.
• Hour records and custom task data - for the duration of the agreement + 2 years (employment and contractual claims).
• Audit log - booking change history 12 months by default, all other entries (sign-ins, permissions, settings) 6 months by default; the Organisation configures both. Older entries are deleted automatically every night.
• Invoices and financial documents - 5 years from the end of the tax year in which the document was issued.
• Technical security logs - 90 days, after which they are automatically deleted.
• Customer support correspondence - 3 years from the resolution of the matter (limitation period for claims).
• Sign-in data - a session expires after 7 days; a recognised device is remembered for 60 days by default (an Organisation setting).
• Backups - encrypted database backups are made daily; daily copies are kept for 14 days and weekly copies for 60 days. Data deleted from the Service may remain in backups until they are automatically deleted.

After the retention period, data is deleted or anonymised in a way that prevents identification.

6. Recipients of personal data

Personal data may be shared with the following categories of recipients:

• Stripe, Inc. (payment processor, USA) - data necessary to process payment transactions, transferred under Standard Contractual Clauses approved by the European Commission.
• Oracle Cloud Infrastructure (Oracle) - hosting of the Service and its database in the Frankfurt data centre (Germany, EU). The provider processes data solely on the Controller's instructions under a data processing agreement.
• ZeptoMail (Zoho Corporation) - sending email (device confirmation codes, system notifications) from an EU data centre, under a data processing agreement.
• The approximate country of an IP address is looked up on our own server using the MaxMind GeoLite2 database - IP addresses are not sent to MaxMind. The bot check at sign-in also runs on our own server, with no third party involved.
• Legally authorised bodies - public authorities (e.g. tax authorities, law enforcement) as required by applicable law.

7. Transfers outside the EEA

Personal data may be transferred outside the European Economic Area (EEA) only:

• under Standard Contractual Clauses (SCCs) adopted by the European Commission (GDPR Art. 46(2)(c)) - applicable to Stripe (USA) and to any access from outside the EEA by the Oracle and Zoho groups;
• under an adequacy decision by the European Commission (GDPR Art. 45) - where applicable for the recipient country.

The Controller does not transfer data to third countries without appropriate safeguards. A copy of the applicable SCCs can be obtained by contacting support@bookstudionow.com.

8. Your rights (GDPR Art. 15–21)

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) - you may request information about the data we process and obtain a copy.
• Right to rectification (Art. 16 GDPR) - you may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR) - the right to be forgotten; you may request deletion of your data when it is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing (Art. 18 GDPR) - you may request restriction of processing in certain cases (e.g. you contest the accuracy of the data).
• Right to data portability (Art. 20 GDPR) - you may receive your data in a structured, commonly used format (JSON/CSV) and transfer it to another controller.
• Right to object (Art. 21 GDPR) - you may object to processing based on the Controller's legitimate interests.

Submit requests to: support@bookstudionow.com. The Controller responds within 30 days (extendable by 60 days in complex cases).

9. Right to lodge a complaint

If you believe we are processing your data in breach of the GDPR, you have the right to lodge a complaint with the Polish Data Protection Authority (UODO):

10. Cookies

The Service uses cookies. For detailed information on the types of cookies used, their purpose, and how to manage them, please see our Cookie Policy.

11. Changes to this policy

The Controller reserves the right to update this Privacy Policy. We will notify you of any material changes via email or an in-app notification at least 14 days before the changes take effect.

The date of the last update is shown in the header of this document. We encourage you to review this policy periodically.

12. Contact

For all data protection enquiries, please contact: