Client Booking Privacy Notice

1. Who controls your data?

The salon or barber you are booking with is normally the data controller for the personal information you submit through their booking page. They decide:

• What information to ask for in the booking form
• How long to keep your booking records
• Which staff members can see your details
• Whether to send you SMS reminders

Bookify Malta (Christian Azzopardi, trading as Bookify Malta, Gcoe, Triq il-Mithna, Qala, Gozo, Malta, VAT MT30087118) acts as the salon’s data processor. We provide the booking software and infrastructure but do not control why or how each salon uses your data.

2. What data is collected when you book?

When you submit a booking request on a salon’s Bookify booking page, the information typically collected includes:

• Your name
• Your phone number
• The service you want
• Your preferred date and time
• Any notes you choose to add

The exact fields depend on how the salon has configured their booking page. We do not collect payment card details — Bookify does not process payments between clients and salons.

3. Who can see your booking information?

• The salon owner and any staff members they have authorised can see your booking details, including your name, phone number, requested service, and appointment time.
• Bookify Maltacan access booking data only as necessary to provide the platform (e.g. sending SMS reminders on the salon’s behalf, troubleshooting, and maintaining the service).
• Epic Communications Ltd (Epic Malta) processes your phone number when the salon enables SMS appointment reminders. Messages pass through a relay Bookify operates on DigitalOcean infrastructure in Germany before reaching Epic for delivery.

Your booking data is not shared with any other salon, client, or third party. We do not sell booking data and we do not use it for advertising or marketing.

4. SMS appointment reminders

If the salon has enabled SMS reminders, you may receive a text message before your appointment. These are strictly transactional reminders — they are not marketing messages. The salon is responsible for ensuring they have a lawful basis to send you reminders (normally the performance of the booking contract or their legitimate interest in reducing no-shows). We send these reminders as the salon’s processor using Epic Communications Ltd, via a relay hosted on DigitalOcean in Germany. Epic receives your phone number and the reminder text solely to deliver the message. Epic does not use them for any other purpose and does not retain message content; it keeps only the limited delivery and billing metadata it needs for its own obligations as a Maltese network operator. For a full breakdown of what Epic sees and retains, see our SMS Communications Policy.

5. How long is your data kept?

Booking retention is controlled by the salon. When the salon deletes your record or their entire account, your booking data is removed from the active database. Backups may retain a copy for up to 30 days before being overwritten. The salon may also keep certain booking records for their own accounting or business purposes under Maltese law.

6. Your data rights

Under the GDPR, you have the right to access, correct, delete, restrict processing of, and receive a copy of your personal data. You also have the right to object to processing and to withdraw consent where processing is based on consent.

First, contact the salon. They are the controller and are best placed to handle your request — for example, correcting a misspelled name or deleting a booking you no longer need.

If the salon does not respond, or if your concern relates to Bookify specifically: email us at legal@bookify.mt. We will assist the salon in responding to your request and may act directly where we are the controller for the relevant data (e.g. if you have contacted Bookify support).

You also have the right to lodge a complaint with the Information and Data Protection Commissioner of Malta, Level 2, Airways House, Triq il-Kbira, HMR 1100, Floriana, Malta (idpc.org.mt, +356 2328 7100).

7. Bookings involving minors

If a parent or guardian books an appointment for a child, the parent’s contact details are typically used for confirmation and reminders. The salon is responsible for determining whether a particular treatment can legally be provided to a minor. Bookify does not make that determination and does not knowingly collect data directly from children under 16.

8. A note on sensitive information

Some salons may add notes about allergies, health conditions, or treatment preferences to your client record. We encourage salons to keep such notes operational and minimal, rather than collecting detailed health data that is not needed for the booking. If you are concerned about what a salon has recorded, please contact the salon directly. Bookify provides the technology but does not initiate or encourage the collection of special-category data.

9. Security

Booking data is transmitted over HTTPS (TLS 1.2+), encrypted at rest, and accessible only to the salon and to Bookify staff on a need-to-know basis. For more detail, see our Security & Reliability overview.

10. Contact

For privacy questions about a specific booking, contact the salon first. For questions about Bookify’s handling of your data, email legal@bookify.mt.