Platform Privacy Policy

1. Who we are

Bookify Malta is operated by Christian Azzopardi, trading as Bookify Malta, a Malta-based service founded in 2024. Your data is hosted in the EU. Questions about this policy can be sent to legal@bookify.mt.

2. Our role and yours

Data protection roles depend on the data in question:

• Your account and business data: we act as the controller. This includes your name, email, business name and profile.
• Your clients’ data: when you record client names, phone numbers or booking history in Bookify Malta, you act as the data controller and we act as your processor. Our Data Processing Agreement governs that relationship.

3. Data we collect

• Account data: name, email address, password (stored securely hashed), and staff accounts you create.
• Business data: business name, services, categories, opening hours, settings and preferences.
• Client data you record: client names, phone numbers and booking history, entered by you or by your clients through self-booking.
• Usage data: bookings, logs of activity within the platform, and billing records for invoices we issue.

4. How we use your data

• To operate, maintain and improve the platform;
• To authenticate you and manage staff access;
• To send SMS reminders to your clients (where you enable this feature);
• To invoice you and manage your subscription;
• To provide support and communicate with you about your account;
• To meet our legal and security obligations.

5. Legal basis

We process account and business data on the basis of the contract between us (the Terms of Service) and our legitimate interestsin operating a reliable service. Where we process client data as your processor, the legal basis is yours: you are responsible for ensuring you have a lawful basis, for example client consent to receive SMS reminders. We do not sell your data or your clients’ data, ever.

6. Where your data goes

Your data is hosted in the EU. To run the platform we rely on a small number of processors, including Google (Firebase for authentication and storage, Cloud Functions for backend logic, and Cloud Tasks for scheduling SMS reminders), an SMS delivery provider, and an email delivery provider. A full, current list with the purpose and region of each is on our Subprocessor List.

We keep data within the EU/EEA wherever possible. Where a processor operates outside the EU, we rely on appropriate safeguards such as EU Standard Contractual Clauses.

7. SMS reminders

SMS reminders are sent to the phone numbers you hold for your clients, 24 hours before an appointment. Bookify Malta acts as your processor for these messages. You must only send reminders to clients who have agreed to receive them, and each reminder we send identifies your business.

8. Retention

We keep your account and business data while your account is active. Client records and booking history are kept for as long as needed to operate the service, and are deleted when you close your account, subject to legal retention obligations (for example, keeping invoicing records for tax purposes). See our Account Deletion Policy for details.

9. Security

We take reasonable technical and organisational measures to protect your data: encrypted transmission over HTTPS, secure authentication via Firebase, access controls on staff accounts, and EU-hosted infrastructure. No method of transmission over the internet is fully secure, however.

10. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you;
• Have inaccurate data corrected;
• Request erasure of your data;
• Restrict or object to our processing;
• Data portability; and
• Withdraw your consent at any time.

To exercise any of these rights, or if you receive a request from one of your clients about their data, email us at legal@bookify.mt.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and notified by email where practical.