Privacy Policy

Learn how Clickobook collects, uses, and safeguards your information.

Last updated: 25-08-2026

1. Introduction

This Privacy Policy explains how we collect, use, and protect personal data of users and their customers. We comply with the General Data Protection Regulation (GDPR) and applicable data protection laws.

2. Who We Are

GCII, Tax ID: 49067593, European Union (referred to in this policy as "we", "us", or "our") is a booking platform provider. This Privacy Policy describes how we process personal data in connection with our booking platform (the "Service").

3. Data We Collect

Data you provide:

  • name, email, phone number;

  • billing information;

  • booking details and customer information;

  • business settings and preferences.

Data collected automatically:

  • IP address;

  • device and browser type;

  • usage data and activity logs;

  • analytics and performance metrics (only where you have consented to analytics cookies).

Customer Data (your clients):

  • names, contact details, booking history, notes. You are the Data Controller for this Customer Data; we act as Data Processor under GDPR, as set out in our Data Processing Agreement.

4. How We Use Data

  • to operate and provide the Service;

  • to send operational notifications;

  • to ensure security and prevent fraud;

  • to perform aggregated analytics;

  • to comply with legal obligations.

5. Legal Basis (GDPR)

  • contract performance;

  • consent (for marketing and, where required, analytics cookies);

  • legitimate interest (security, analytics);

  • legal compliance.

6. Data Sharing

We may share data with:

  • hosting and infrastructure providers;

  • payment processors;

  • analytics services (only where you have consented);

  • authorities when legally required.

Payment Data

Where you pay by card, payment card data is processed and stored by our payment processors (such as Stripe and PayPal). We do not store full card numbers on our own servers. Card data is handled in accordance with the Payment Card Industry Data Security Standard (PCI-DSS) by the payment processor. Our payment processors may also retain card details (such as for recurring subscription payments) in accordance with their own privacy policies and PCI-DSS requirements.

We do not sell personal data. We do not sell, rent, or otherwise disclose your customers' data to third parties for their own purposes.

7. Your Responsibilities as Controller (Business Customers)

If you use the Service to manage bookings and process data about your customers, employees, and end users ("Customer Data"), you are the data controller for that Customer Data. You are responsible for:

  • providing your customers with your own privacy policy and any required notices;

  • obtaining any lawful consents required to collect and process their data;

  • having a valid legal basis for the processing, including for any special categories of data (such as health or medical data);

  • complying with all applicable laws, including the GDPR and sector-specific rules (such as HIPAA for US healthcare customers), and for deciding how you use the Service.

To the fullest extent permitted by law, and except to the extent caused by our own gross negligence or willful misconduct, we are not liable for claims, damages, or losses arising from your use of Customer Data or from your failure to comply with applicable law.

8. Health and Medical Data

The Service may be used by customers in the health and wellness sector. Health and medical data are a special category of personal data under Article 9 GDPR and require a higher level of protection. We process such data only on your documented instructions to provide and maintain the Service, and as set out in the Data Processing Agreement. You are responsible for having a lawful basis to process such data and, where you are a US healthcare customer, for complying with HIPAA and entering into any Business Associate Agreement required for your own operations.

9. International Transfers

If data is transferred outside the EU/EEA, we use GDPR-compliant safeguards such as Standard Contractual Clauses or applicable adequacy decisions.

10. Data Retention

We retain data as long as necessary to provide the Service or comply with legal requirements. You may request deletion at any time. Data is deleted in accordance with our Data Processing Agreement.

11. Your Rights

  • access your data;

  • correct inaccurate data;

  • request deletion;

  • restrict processing;

  • object to processing;

  • withdraw consent.

You may exercise these rights by contacting us at the address below. Where we process Customer Data on behalf of a customer, we will assist that customer in responding to data subject requests in accordance with our Data Processing Agreement.

12. Security

We implement technical and organizational measures such as encryption, access controls, monitoring, and backups.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and, where material, notify you. Continued use of the Service after the updated policy is posted constitutes acceptance of the changes.

14. Contact

For GDPR inquiries: [email protected]

GCII, Tax ID (CUI): 49067593, European Union