Privacy Policy

1. Data controller

The data controller is Nowave (Brûsk Kurt), whose registered office is located in Belgium.

Contact: contact@bookelya.com

2. Data collected

2.1 Account data

Upon registration, we collect: surname, first name, email address, phone number, password (encrypted), and for professionals, the name and address of the establishment.

2.2 Appointment data

Appointment information: date, time, booked service, assigned professional, possible notes.

2.3 Navigation data

Technical data collected automatically: IP address, browser type, pages viewed, visit duration. This data is collected via cookies (see our cookie policy).

3. Legal basis for processing

The processing of your data is based on the following legal bases:

• Performance of contract: processing necessary for the provision of the service (account management, appointments, notifications)
• Consent: for sending marketing communications and the use of non-essential cookies
• Legitimate interest: for service improvement, Platform security and fraud prevention

4. Purposes of processing

Your data is processed for the following purposes:

• Creation and management of your user account
• Appointment and booking management
• Sending reminders and notifications (SMS, email)
• Service improvement and usage analysis
• Customer support
• Compliance with our legal obligations

5. Data sharing

Your personal data is not sold to third parties. It may be shared with the following processors, strictly in the context of providing the service:

• Hosting provider: for secure data storage
• Twilio: for sending SMS (appointment reminders, verification, campaigns if enabled)
• Apple MapKit: for geocoding services and address autocompletion
• Resend: for sending transactional emails
• Stripe: for payment and subscription management
• Google (Tag Manager / Analytics / Ads): audience measurement and marketing performance, subject to your consent
• Microsoft Clarity: usage analysis and session recordings, subject to your consent
• Crisp: chat support, subject to your consent

These processors are contractually required to protect your data and use it only for the defined purposes.

Some processors may process data outside the European Economic Area. When this is the case, we implement appropriate safeguards (notably standard contractual clauses and supplementary contractual measures).

6. Retention period and deletion

We apply a policy of data minimization and immediate deletion. Bookelya has neither archives nor a trash: any data deleted by the user is permanently and immediately removed from our systems, with no possibility of recovery.

6.1 Retention periods

• Account data: retained as long as your account is active. Upon account deletion, all associated data is permanently erased
• Appointment data, client profiles, notes and attachments: retained for service operation. Any deletion by the user results in permanent and irreversible erasure
• Browsing data: 13 months maximum for trackers subject to consent (see cookie policy)
• Establishment claim documents: automatically deleted 30 days after processing (approval/rejection)

6.2 Deletion at the user's initiative

When a user deletes data (client, appointment, note, attachment or any other information), it is immediately and permanently deleted from our servers and backups. No copy is retained and no recovery is possible after deletion.

You can also request the complete deletion of your account and all your data via contact@bookelya.com.

7. Your rights

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request the deletion of your data
• Right to portability: receive your data in a structured and readable format
• Right to object: object to the processing of your data for legitimate reasons
• Right to restriction: request restriction of processing in certain cases

To exercise these rights, contact us at contact@bookelya.com. We undertake to respond within one month.

8. Cookies

The Platform uses cookies for its operation. To learn more, see our cookie policy.

9. Security

We implement appropriate technical and organizational measures to protect your personal data against any unauthorized access, loss, destruction or alteration. Passwords are encrypted and communications are secured by HTTPS.

10. DPO Contact

For any questions regarding the protection of your personal data, you may contact our data protection officer at the following address: contact@bookelya.com

You also have the right to lodge a complaint with the Belgian Data Protection Authority (DPA): www.autoriteprotectiondonnees.be