Privacy Policy

1. Who we are

Webshopbirodalom Ltd. ("we", "us", "Provider") is the data controller of the personal data you provide when using BookFlow (bookflow.hu). We are based in Budapest, Hungary, and operate under EU/Hungarian data protection law (GDPR + Hungarian Act CXII of 2011).

2. What data we collect

2.1 From service providers (our customers)

• Name, email address, phone number, business name
• Billing data (tax number, address, payment method)
• Service configuration data (services offered, working hours, pricing)
• Login data (encrypted password, session tokens)

2.2 From end clients (people booking appointments)

• Name, email address (required for booking confirmation)
• Phone number (optional, for the service provider's records)
• Booking details (selected service, date, time)
• Guest-account data, where the client registers (hashed password, optional birthday, language, marketing consent)
• Reviews/feedback and waitlist entries

2.3 Technical data

• IP address, browser type, referrer URL (server logs)
• Session cookies (for login state, not for tracking)

2.4 From people using the provider search (bookflow.hu/en/search)

• Appointment requests at places that are not BookFlow partners yet: name, email address, phone number, the requested service, day, time of day and note, the text and time of your consent, and a one-way hash of your IP address (abuse prevention). We use them to record and confirm your request, to send you the place's contact details, to tell you if the place joins BookFlow, and to set up your guest account. We pass your details to the provider only if the place joins BookFlow and you agreed to this when sending the request. We may use the number of requests a place received, without personal data, to contact the provider.
• Public details of businesses that are not our partners: name, category, address, public phone number, email address, website and social page, taken from the open place database of the Overture Maps Foundation and refreshed monthly, so that visitors can find services near them. If you are a sole trader and this is your data, you can ask for a correction or removal at any time at hello@webshopbirodalom.hu or via the link on the listing; removed places are not brought back by later updates.

3. Why we process this data (lawful basis)

• Contract performance (GDPR Art. 6(1)(b)) — to provide the booking service to our customers and end clients
• Legal obligation (GDPR Art. 6(1)(c)) — to comply with Hungarian tax and accounting law (invoice retention)
• Legitimate interest (GDPR Art. 6(1)(f)) — to maintain system security, detect abuse, and improve the service
• Consent (GDPR Art. 6(1)(a)) — appointment requests at non-partner places in the provider search; you can withdraw your consent at any time at hello@webshopbirodalom.hu
• Legitimate interest (GDPR Art. 6(1)(f)) — showing public details of non-partner businesses in the provider search; you can object to this at any time

4. How long we keep your data

• Customer account data: while the subscription is active, plus 30 days after it ends (except billing data)
• End-client data (bookings, contact details): the service provider can delete it at any time; otherwise it is deleted automatically 2 years after the last booking
• IP logs: 90 days (except in case of a security incident)
• Appointment requests (provider search): unconfirmed requests are deleted after 7 days; confirmed requests are kept for up to 180 days (the guest account separately, until it is deleted)
• Non-partner business details: while they are in the source database (a place missing from two consecutive updates is hidden), or until a removal request
• Invoices and accounting data: 8 years (Hungarian Accounting Act)

5. Who has access to your data (processors)

We use the following data processors:

• Hetzner Online GmbH (Germany, EU) — server hosting (application and database)
• WebSupport (Slovakia, EU) — domain registration and DNS
• MailHub (our own email service, based on Postal, on our own Hetzner server in the EU) — sending emails
• Billingo Zrt. (Hungary, EU) — invoicing (NAV-compliant); filling in from a tax number: the name and registered address for a tax number you enter, from the tax authority's public data (it receives only that tax number, and only when you press the button)
• Stripe Payments Europe, Ltd. (Ireland; some data in the USA) — card payments for BookFlow subscriptions; card data is handled by Stripe under PCI-DSS.
• Google Ireland Ltd. / Google LLC (EU/USA) — Google Calendar sync and Google sign-in, only if the service provider enables them

We do not sell your data to third parties.

6. International transfers

Most data is processed within the EU (Hungary, Germany, Slovakia, Ireland). Some processors — Stripe (subscription payments) and Google (calendar sync / sign-in) — may transfer data to the USA. These transfers are safeguarded by the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

7. Your GDPR rights

Under GDPR, you have the right to:

• Access your personal data (Article 15)
• Rectification of inaccurate data (Article 16)
• Erasure ("right to be forgotten", Article 17)
• Restriction of processing (Article 18)
• Data portability (Article 20)
• Object to processing based on legitimate interest (Article 21)
• Withdraw consent at any time (where applicable)
• Lodge a complaint with the Hungarian Data Protection Authority (NAIH) or your local DPA

To exercise these rights, contact us at hello@webshopbirodalom.hu. We respond within 30 days.

8. Security

• HTTPS encryption for all traffic (Let's Encrypt SSL)
• Passwords stored with bcrypt one-way hashing
• Daily encrypted backups
• EU-based hosting (Hetzner Germany), GDPR-compliant infrastructure
• Access logs retained for security auditing

9. Cookies

We use essential cookies (login session, language preference, CSRF token). We do not use marketing or advertising cookies (no Facebook Pixel, no ad remarketing).

Analytics — Google Analytics 4 (consent-based)

We use Google Analytics 4 (measurement ID G-KJCGJ1F4RF) for anonymous, aggregated traffic statistics. Analytics cookies are set and measurement starts only after you explicitly consent via the "Accept" button in the cookie banner. Without consent (or on "Reject"), Google Analytics sets no analytics cookie and does not measure (Google Consent Mode v2, denied by default).

• Purpose: anonymous, aggregated measurement of traffic and usage (to improve the service).
• Legal basis: your consent (GDPR Art. 6(1)(a)).
• Processor: Google Ireland Limited. GA4 does not store full IP addresses by default.
• Withdraw consent: delete the bf_consent cookie in your browser to see the banner again and choose anew.

10. Children

The Service is intended for businesses and adults. We do not knowingly collect data from children under 16. If you believe we have such data, please contact us for immediate deletion.

11. Supervisory authority

The relevant supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH):

• Website: naih.hu
• Address: 1055 Budapest, Falk Miksa utca 9-11.
• Email: ugyfelszolgalat@naih.hu

EU residents may also contact their local data protection authority.

12. Changes to this policy

We may update this Privacy Policy. Material changes will be communicated by email to existing customers at least 15 days in advance.