Back to Legal

Privacy and Cookie Policy

1. Introduction

This Privacy and Cookie Policy (hereinafter the "Policy") describes in detail how we collect, use, store and protect your personal data when you use the website www.bookmax.gr (the "Website"), the bookmax mobile application, available for download from Google Play (the "App"), and all services provided through them (the "Platform").

The Platform is intended for both end users/clients who make appointment bookings (hereinafter "Clients") and appointment-based service businesses (including but not limited to: hair salons, barber shops, spas, clinics, tattoo studios, gyms, pet services, vehicle services and any other business operating by appointment) that use the Platform to manage their appointments and business (hereinafter "Partners").

We are committed to protecting the privacy of our users and Partners. Please take time to read this Policy carefully.

1.1 Data Controller

The data controller, i.e. the person who determines the purposes and means of processing your personal data, is:

Foivos Iliopoulos

Sole Proprietorship

Registered address: Koritsas 34, 17455 Alimos, Greece

Tax ID (AFM): 169305372 — Tax Office: KEFODE Attikis

Business Registry (GEMI): [GEMI Number]

Contact email: hello@bookmax.gr

Data protection email: privacy@bookmax.gr

(hereinafter "bookmax", "we", "us")

1.2 Legal Framework

This Policy is drafted in compliance with:

  • The General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR")
  • Greek Law 4624/2019 on measures implementing the GDPR (Greek Data Protection Act)
  • Greek Law 3471/2006 on the protection of personal data and privacy in the electronic communications sector (e-Privacy)
  • Any relevant decision or guideline of the Hellenic Data Protection Authority (HDPA)

2. What Data We Collect

When you visit and/or use our Platform or communicate with us, we may collect the following data:

2.1 Client Data

Registration and account data

  • Full name
  • Email address
  • Mobile phone number (verified via OTP code)
  • Password (stored in encrypted form — hash)

Booking data

  • Appointment details (date, time, service, business, professional)
  • Booking and cancellation history
  • Appointment status (pending, confirmed, completed, cancelled, no-show)

Payment data

Payment details (last four digits of card, expiry date, card type). bookmax does not store full card details. Payment processing is handled by the third-party payment provider Stripe (Stripe Payments Europe Limited, Ireland). Data processing by Stripe is governed by their own Privacy Policy: https://stripe.com/privacy

  • Transaction history (amounts, dates, refunds)
  • Saved payment methods (if you choose to save a card as a booking guarantee or for future payments, via Stripe)

Review data

  • Rating and review text
  • Submission date

Communication data

If you choose to contact us (via email, phone or social media), we will record the fact of the communication, its content, your contact details and your IP address.

Important: Please do not share special categories of personal data with us (e.g. health data, racial or ethnic origin, political opinions, religious beliefs) unless directly related to the service you are requesting (e.g. allergies relevant to a treatment).

2.2 Partner Data

Registration and account data

  • Full name of owner/legal representative
  • Business name
  • Email address
  • Phone number
  • Business address

Business data

  • Business type (e.g. hair salon, barber shop, spa, clinic, tattoo studio, gym, pet services, etc.)
  • Services, categories, prices
  • Operating hours, days closed
  • Business photos
  • Team details (names, roles, working hours)

Subscription and payment data

  • Billing details (via Stripe Connect)
  • Subscription payment history
  • Subscription status (trial, active, cancelled)

2.3 Automatically Collected Data (all users)

  • IP address
  • Browser type and version
  • Operating system and device
  • Pages visited, time spent, referral source
  • Interactions on the Platform (businesses and services you are interested in)
  • Cookies and similar technologies (see Section 8)

Please note that we may associate this data with your bookmax account.

2.4 Data Accuracy

It is important that all personal data you provide during registration or use of the Platform is correct and accurate, including ensuring we have your correct contact details at all times.

Bookings on behalf of third parties: If you intend to make a booking on behalf of another person, you should only provide their details with their consent, after they have been given access to this Policy.

3. Purposes of Processing and Legal Bases

Under data protection law, we may only use your personal data when we have a legal basis (e.g. legal obligation, contract, legitimate interest, consent, etc.). The legal bases, purposes and retention periods applicable to our main processing activities are set out in the table below:

Legitimate Interest Balancing: We have carried out a balancing test for all data processing based on our legitimate interests. You may obtain information about this balancing by contacting us at privacy@bookmax.gr.

4. Controller and Processor Roles

4.1 bookmax as Data Controller

bookmax acts as data controller for data collected directly through the Platform, including:

  • Registration and account data of Clients and Partners
  • Booking data for bookings made through the Platform (online bookings)
  • Payment and transaction data
  • Review data
  • Usage data and cookies

4.2 bookmax as Data Processor

When a Partner uses the Platform to manage clients who do not have a bookmax account (e.g. manual bookings, walk-in clients, client list imports), bookmax acts as a data processor on behalf of the Partner. In this case:

  • The Partner is the data controller for this data
  • bookmax processes the data solely in accordance with the Partner's instructions and for the purpose of providing the service
  • Details are governed by the Data Processing Agreement (DPA) which forms part of the Partner Terms

4.3 Partners as Independent Data Controllers

When you make a booking at a business through the Platform, the business receives the necessary details for your service (full name, phone number, appointment details). The Partner acts as an independent data controller for the data received in this context and is obliged to process it in accordance with the GDPR.

5. Disclosure of Data to Third Parties

We will never sell your personal data to third parties under any circumstances. We may disclose data to the following categories of recipients:

Payment service providers

Stripe (Stripe Payments Europe Limited, registered in Ireland) processes your payments. In the course of providing payment processing services, Stripe Payments Europe Limited may transfer data to Stripe, Inc. in the USA, subject to appropriate safeguards (see Section 6). Stripe Privacy Policy: https://stripe.com/privacy

Infrastructure and hosting providers

  • Vercel (website/application hosting)
  • Neon (database — within the EU)

Partners (businesses)

Your data is shared with Partners in order to:

  • Facilitate bookings and related pre-appointment communications
  • Improve their services by providing customer statistics

Legal obligations

We may disclose data to competent authorities, courts or third parties where required by law or for the establishment, exercise or defence of legal claims.

6. Data Transfers Outside the EU/EEA

Your personal data is stored and processed primarily within the European Union (EU) and the European Economic Area (EEA).

Where our service providers transfer data to third countries (e.g. USA), the transfer is carried out on the basis of:

  • Adequacy decisions of the European Commission (e.g. EU-US Data Privacy Framework)
  • Standard Contractual Clauses (SCCs)
  • Appropriate technical and organisational security measures

Each service provider is assessed for its level of data protection before any data transfer.

7. Data Retention Periods

We retain your personal data only for as long as necessary for the purpose for which it was collected. In determining the appropriate retention period, we take into account the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use, the purposes of processing and our legal obligations.

Client Accounts

Account data is retained for the duration of your account. Upon account deletion, your personal data is anonymised within 30 days, except for data that must be retained under legal obligation (e.g. tax records).

Transaction and payment data

Retained for at least 5 years from the end of the financial year to which they relate, in accordance with tax legislation (Law 4308/2014, Article 7 — Greek Accounting Standards, and Law 4174/2013 — Greek Code of Tax Procedure).

Partner Accounts

Partner account data is retained for the duration of the subscription, plus 24 months after termination/cancellation, to allow reactivation and data export. After this period, the data is anonymised.

Data for legal claims

Data necessary for the establishment, exercise or defence of legal claims is retained for 5 years (general limitation period — Civil Code, Article 250).

Anonymised/Aggregated data

Anonymised data (e.g. aggregated usage statistics) no longer constitutes personal data and may be retained indefinitely for analysis, service improvement and statistical purposes.

8. Cookies and Similar Technologies

Our Platform uses cookies and similar technologies in accordance with Law 3471/2006 (transposing Directive 2002/58/EC). Cookies are small text files stored on your device.

Strictly Necessary Cookies

These are essential for the Platform to function (e.g. user authentication, session management, language preference). They do not require consent. Some of these cookies are deleted when you close your browser (session cookies), while others remain on your device (persistent cookies).

Analytics/Performance Cookies

These help us understand how you use the Platform (e.g. which pages you visit most). They are only activated with your explicit consent via the cookie banner.

Managing cookie preferences

You can manage your cookie preferences through:

  • The cookie banner that appears on your first visit to the Platform
  • Your browser settings

If you do not wish cookies to be used, you can set your browser to block them. Please note that this may affect the functionality of the Platform.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, destruction or alteration, including:

  • Encryption of data in transit (TLS/HTTPS) and at rest
  • Secure password storage (hashing)
  • Role-based access control
  • Regular security audits

The transmission of information via the internet is not completely secure. While we make every effort to protect your data, we cannot guarantee complete security. Any transmission is at your own risk.

10. Your Rights

Under the GDPR and Law 4624/2019, you have the following rights in relation to the personal data we hold about you:

  • Right of access (Article 15 GDPR): To receive confirmation of whether we process your data and obtain a copy
  • Right to rectification (Article 16 GDPR): To request correction of inaccurate or incomplete data
  • Right to erasure (Article 17 GDPR): To request deletion of your data, subject to legal limitations (e.g. tax obligations)
  • Right to restriction of processing (Article 18 GDPR)
  • Right to data portability (Article 20 GDPR): To receive your data in a structured, commonly used and machine-readable format
  • Right to object (Article 21 GDPR): To object to processing based on legitimate interest or for direct marketing
  • Right to withdraw consent: At any time, without affecting the lawfulness of prior processing

You can first view or change your data by logging into your account on the Platform.

To exercise any right, contact us at: privacy@bookmax.gr

We will respond to your request within one (1) month. In cases of complexity or a high number of requests, the deadline may be extended by two (2) additional months, of which you will be informed in a timely manner.

Your rights may be subject to limitations in certain cases, e.g. if fulfilling your request would reveal data of a third party or if we have a legitimate reason to continue processing.

10.1 Withdrawal of Marketing Consent

If you wish to stop receiving promotional messages:

  • Email: click the "unsubscribe" link at the bottom of each promotional email
  • Push notifications: revoke permission through your device settings
  • Contact us at privacy@bookmax.gr

Please note that even after unsubscribing from promotional messages, you will continue to receive service notifications (e.g. booking confirmations, appointment reminders) that are necessary for the performance of the contract.

11. Right to Lodge a Complaint

We encourage you to contact us first regarding any issue concerning your personal data. However, if you believe that the processing of your data violates the GDPR or Law 4624/2019, you have the right to lodge a complaint with the:

Hellenic Data Protection Authority (HDPA)

Kifisias 1-3, 115 23, Athens, Greece

Tel: +30 210 6475600

Email: contact@dpa.gr

Website: www.dpa.gr

12. Minors

Our Platform is not intended for persons under the age of 15. We do not knowingly collect data from minors under 15. If we become aware that we have collected such data, we will delete it immediately. For users aged 15-18, parental or guardian consent is required, in accordance with Law 4624/2019.

13. Changes to This Policy

We may update this Policy from time to time. In the event of material changes, we will notify you via the Platform or by email before they take effect. The date of the last update is stated at the top of this document. We encourage you to check this Policy regularly.

14. Contact

For any questions, requests or complaints regarding this Policy or the processing of your personal data:

Data protection email: privacy@bookmax.gr

General contact: hello@bookmax.gr

Website: www.bookmax.gr