Privacy Policy

2. Roles and Responsibilities

We act as:

• A data processor for any End-Customer data uploaded by our users for bookings or service records.
• A data controller for user (business or freelancer) data collected when you register, use, or subscribe to the platform.

If you are an End-Customer using our system via a business, please refer to their privacy policy directly as they are the controller of your data.

3. Personal Data We Collect

3.1 Data from Users (Controllers)

• First name, last name
• Email address
• Phone number
• Billing information
• OAuth authentication data (e.g., via Google)

3.2 Data from End-Customers (Processed on Behalf of Users)

• First name, last name
• Email address
• Phone number
• Booking data (e.g., event date and time)

We retain data only for as long as necessary to fulfill the purpose for which it was collected or to comply with legal obligations.

4. Legal Basis for Processing

We process your data under one of the following legal bases:

• Article 6(1)(a) GDPR – based on your consent (e.g., for marketing emails or cookies)
• Article 6(1)(b) GDPR – for performance of a contract
• Article 6(1)(c) GDPR – to comply with legal obligations
• Article 6(1)(f) GDPR – based on our legitimate interest (e.g., to improve services)

5. Cookies and Tracking Technologies

We use cookies and similar tools, including Google Analytics, Google Tag Manager, and Hotjar, to understand user behavior and improve functionality. You will be asked to provide explicit consent for non-essential cookies when visiting our websites.

Types of Cookies:

• Essential cookies: Required for service functionality.
• Analytics cookies: Measure performance and usage.
• Marketing cookies: Help us show you relevant content.

You may withdraw cookie consent at any time by adjusting settings in the cookie banner.

6. Email Communications

• Transactional emails (e.g., onboarding or feature guides) are sent under contractual necessity.
• Marketing emails are sent only with your prior consent. You can unsubscribe at any time via the link in the email.

7. Subprocessors and International Transfers

We work with trusted subprocessors, including:

• Hotjar (Behavioral analytics)
• Stripe (Payments)
• Twilio (SMS)
• AWS (Hosting)
• Google (Analytics, OAuth)

Some subprocessors are located outside the EU. Where applicable, we ensure safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions.

8. Data Retention

We store:

• User data for the duration of your account and up to 10 years for tax/accounting purposes.
• End-Customer data for up to 30 days after termination, upon user request.

10. Your Rights

You have the following rights under the GDPR:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction (Art. 18)
• Right to object (Art. 21)
• Right to data portability (Art. 20)
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

To exercise your rights, contact us at: support@finebooking.com.