Booqa privacy notice

[BOOQA LEGAL NAME], [BOOQA ADDRESS], registered with the Dutch Chamber of Commerce under number [BOOQA KVK NUMBER]. For anything about your data, email [BOOQA PRIVACY EMAIL].

Every studio on Booqa is responsible for its own clients' data: your bookings, passes, memberships, attendance, phone number and anything else you share with that studio. For that data the studio is the controller and Booqa processes it on the studio's behalf, under a processing agreement. Each studio publishes its own privacy notice, linked at the bottom of its pages. Questions about what a studio does with your data go to that studio.

This notice covers what Booqa itself is responsible for: your Booqa account, signing in, keeping the platform secure, and access by Booqa support.

• Your account: your name, email address and preferred language.
• Signing in: the six-digit codes we email you (stored only as a hash and deleted after use or after 5 minutes) and your sign-in sessions.
• Security records: a log of sensitive actions, such as who changed what in a studio's backend and every time Booqa support entered a studio, with the time and the account involved. For rate limiting we briefly use your IP address in memory.
• Which studios you belong to: so we can show them on your account page. What you do at each studio is that studio's data.

We do not use analytics, advertising or tracking cookies, and we do not ask for sensitive data such as health information.

• To give you an account, sign you in and show you your studios. This is necessary to provide the service you asked for (Art. 6(1)(b) GDPR).
• To keep the platform and every studio's data secure: rate limiting, the audit log and the record of support access. This is our legitimate interest in running a safe service, and yours in your data not being misused (Art. 6(1)(f) GDPR).
• To send you the emails the service needs, such as sign-in codes. This is part of the service (Art. 6(1)(b) GDPR).

Studios keep their sales records because Dutch tax law requires it (Art. 6(1)(c) GDPR). That is the studio's obligation, described in its own notice.

We use these service providers, under processing agreements:

• Hetzner Online GmbH (Germany) hosts the platform and its backups in data centres in the European Union.
• Resend [TO CONFIRM: legal entity] sends our emails. Resend is a company in the United States; the transfer is covered by [TO CONFIRM: EU sending region / EU-US Data Privacy Framework / standard contractual clauses].

The studios you join see your name and email address. When you pay a studio online, the payment is handled by that studio's own payment provider, Mollie, which is responsible for the payment data itself. We do not sell your data to anyone.

• Sign-in codes: until used, or 5 minutes.
• Sign-in sessions: 60 days after your last visit.
• Your account: for as long as you have it. [TO CONFIRM: retention after an account is closed or unused.]
• The audit log and the record of support access: [TO CONFIRM: retention period]. These are kept longer than other data because they are the evidence of who did what.
• Backups: [TO CONFIRM: backup retention period].

You can ask us to see the data we hold about you, to correct it, to delete it, to limit how we use it, to give it to you in a portable format, and you can object to use based on our legitimate interest (Art. 15 to 21 GDPR). We do not make automated decisions about you that have legal or similarly significant effects (Art. 22 GDPR).

These requests are not self-service yet. Email [BOOQA PRIVACY EMAIL] from the address on your account and we will answer within one month. For data a studio holds about you, ask that studio; if you ask us, we will pass the request on.

If you are not happy with how we handle your data, tell us first at [BOOQA PRIVACY EMAIL]. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

Booqa uses only cookies that are strictly necessary for the service, so we do not ask for consent:

• the session cookie, which keeps you signed in on the site where you signed in;
• booqa_locale, which remembers the language you chose;
• sidebar_state, which remembers whether the backend sidebar is open (studio owners only);
• booqa_preview, which lets someone with the preview password look at a studio that has not been published yet.

Videos in online courses come from YouTube or Vimeo and are loaded only after you press play. From that moment those services may set their own cookies.

When we change this notice we update the date at the top. If a change matters for how we use your data, we tell you by email or in the service.