Privacy notice — Galatea online booking system

The Galatea online booking system (hereinafter: the “Service”) is a cloud-based online booking system that can be embedded in a website and is available at galateabooking.com.

The company providing the Service and acting as controller is INNOCON LTD (hereinafter: the “Provider”), which also qualifies as a processor in relation to the salon using the Service (the Professional).

Company details

Company name

INNOCON LTD

Registered office

1a Falmer Court, London Road, Uckfield, England, TN22 1HN, United Kingdom

Postal address

1a Falmer Court, London Road, Uckfield, England, TN22 1HN, United Kingdom

Registering authority

Companies House (England and Wales)

Company number

11725433

VAT number

GB 314 7505 19

Email

info@galateabooking.com

Website

galateabooking.com

Data protection contact: INNOCON LTD customer service Email: info@galateabooking.com

Users of the system

Visitors: visitors to our website who do not wish to use our services either as a Professional or as a Client, and who do not register.

Professionals: natural or legal persons who, through the registration made by their representative, receive a booking system, or who hold a team member or administrator account within it, and who use the Service for the purpose of managing their bookings.

Clients: persons who book an appointment for a given service on a Professional’s booking page, and whose personal data, through their registration or booking, also appear in the Provider’s system.

The Service collects and processes personal data from its users for the purposes and to the extent described in the sections below.

I. All our users (Visitor, Professional, Client)

By visiting our website, our visitors place technical data from their own devices on the Provider’s web servers.

A) Handling of cookies

1. The Provider’s website and the Booking system use cookies. Cookies are text-format data files that are stored by your browser on your own hard drive. Their content covers the web pages and advertisements you visit and search for. At the same time, cookies do not contain personal data such as your name, address or email address. The cookie is used by the visitor to the site, for example in order to be authorised to view the information on a page.

2. No special settings are needed in your browser for it to be able to download cookies to your computer. With the default settings, your browser will accept cookies and store them in a list, as this does not involve any risk. If you do not want the operator to use cookies, disable accepting them in your browser. You can find more information in your browser’s help.

3. If you accept cookies, they are stored on your computer unless you delete them earlier. Please note, however, that not using cookies may result in our website working only to a limited extent.

4. The Booking system (galateabooking.com) uses cookies that are strictly necessary for it to work:

   • login (session) cookie — keeps you logged in until you log out or until it expires. The system does not work without it, so no consent is needed for it.

   • language cookie — remembers the language you choose; it is only set if you choose a language.

   • currency cookie — remembers the currency in which you see converted prices; it is only set if you choose a currency, and choosing “Original price” deletes it.

   • region cookie — remembers the country you choose, whose providers the home page and the search show; it is only set if you choose a country.

   • appearance cookie — remembers whether you chose the day or the evening look; it is only set if you choose one of them, and choosing “Automatic” deletes it (from then on the page follows your device’s setting).

   The language, currency, region and appearance cookies last one year, and every new choice restarts that year.

   • the token of your own sign-up in the browser’s local storage (not a cookie) — only on the page of the private assistant’s shared link, if you sign up there: on the same device the page shows your sign-up and the option to cancel (see III/E). It is not sent to the server; you can delete it in your browser.

   The Booking system does not set any third-party cookies for marketing or statistical purposes.

5. On the Provider’s website and within the Service you will also find links or icons of other websites – e.g. the Facebook Like button or a YouTube video link – that take you to the website concerned. These websites also use cookies, and you can find information about them on the websites concerned. The Provider does not control third-party websites and is not responsible for the content of other external websites.

6. If you do not want to accept certain types of cookies, you can set your browser so that it does not allow a unique identifier to be placed, or so that your browser warns you when a website wants to send a cookie. If you would like to find out more about these functions, see your browser’s instructions or help screen.

7. By using the Service, you accept that restricting the operation of cookies may cause certain functions of the website to stop working.

8. Legal background and legal basis of cookies. We basically distinguish three types of cookies: cookies essential for operation, which ensure that the Website works properly; cookies for statistical purposes; and cookies for marketing purposes.

   The legal basis for the processing is your consent under Article 6(1)(a) of the Regulation in the case of statistical and marketing cookies, and the legitimate interest in ensuring the operation of the Website under Article 6(1)(f) of the Regulation in the case of cookies necessary for operation.

9. Logging of consent. We log the existence of your consent to cookies — so that it can be demonstrated in accordance with Article 7(1) GDPR. As part of this, we record the time and content of the decision, the way the decision was made (accept button or detailed settings), your IP address, a random browser identifier and, in the case of a logged-in customer, your account identifier and email address. We use this data solely to demonstrate consent and for no other purpose, and we store it for 3 years from the decision, after which it is deleted automatically. The data is stored by Supabase (European Union, Frankfurt) as processor.

II. Professionals

A) Processing related to registration and the creation of the booking system

• Legal basis: the Professional, or their natural-person representative, gives consent to the processing by registering and by ticking the checkbox indicating acceptance of this privacy notice.

• Purpose: creating a new booking system for the Professional, identifying the Professional, enabling contact (in order to understand their needs and to provide telephone or in-person support with the settings), and providing information about the features and services.

• Data processed: full name, email address, password (only in encrypted, non-decryptable form), phone number, the salon’s name and address, the booking system’s identifier and address (slug), and the data provided when setting up the booking system (e.g. opening hours, services, team members).

• Retention period: up to 3 years after the active contractual relationship ends or after the natural person concerned ceases to act as representative.

B) Processing related to customer service (support)

• Legal basis: the Professional’s explicit consent, given by completing the registration form.

• Purpose: supporting registered Professionals: offering help with setting up the system, understanding their needs, support in using the system, complaint handling and other general contact functions.

• Data processed: name, phone number, email address, and customer service notes containing no personal data about needs, questions and technical problems.

• Retention period: see point A).

III. Clients

A) Processing of data recorded in the booking systems

• Legal basis: when registering on the Professional’s booking page or when booking an appointment, the Client gives their consent by providing their personal data and ticking the checkbox indicating acceptance of the data processing statement. The Provider qualifies as a controller in respect of this data.

• Purpose: supporting the Professional in the tasks related to managing bookings, receiving their clients and providing the service, for example: preparing to provide the service, identifying the client who arrives at the agreed time, and providing information about any change to or cancellation of the appointment.

• Data processed: full name, email address, phone number, the booking system’s identifier, the chosen salon and team member, the service chosen for the booking, the chosen appointment time, the note written for the booking, the Client’s IP address, and technical information sent automatically by their browser (e.g. device type, operating system, language setting, screen size and type).

• Retention period: the data is kept in the booking system’s database for no more than 3 years after the last booked appointment linked to the Professional’s client.

B) Photo for the booking

Photo for the booking. At the last step of booking an appointment, you can upload up to three photos for the professional. This is optional. The photo may also show the condition of your hair or scalp, which may be health data, so we ask for separate, explicit consent before the upload (Article 9(2)(a) GDPR). Only the salon you have chosen and its team members see the photo; it has no public web address, we do not send it by email, and it is not analysed by artificial intelligence. We delete the photo automatically 30 days after the booking is closed — in the case of cancellation, counting from the day of cancellation. You can withdraw your consent at any time: you can delete the photo yourself on the My bookings page, or request its deletion at info@galateabooking.com.

• Legal basis: the Client’s explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR), which they give at the last step of the booking by ticking a separate checkbox below the photo selection field. Without ticking the checkbox, the photo cannot be uploaded, and the Provider also checks this on the server.

• Purpose: so that the Professional can see the condition of the Client’s hair or scalp before the treatment and can prepare for the appointment.

• Data processed: up to three photos per booking, the fact and time of the upload, and the fact and time of the consent and the version number of the consent text.

• Retention period: 30 days after the booking is closed (completion, missed appointment, rejection), or, in the case of cancellation, 30 days from the day of cancellation. Deletion is carried out by a scheduled task, both from the storage and from the records. This does not apply to the text of the note written for the booking, which we keep for the period set out in point III/A.

• Who can access the photo: only the salon where the Client booked the appointment, and its team members. This restriction is enforced not by the user interface but by the database’s row-level access rule. The photo is kept in closed storage and has no public web address; the Professional can also only open it via a unique address that is valid for a short time.

• What the Provider does not do with the photo: it does not send it by email, does not analyse it with artificial intelligence, and does not transfer it outside the European Union. From upload until deletion, the photo is kept in the Provider’s own storage within the EU. Of the processors listed in point III/C, Supabase (storage) and Vercel (serving) are involved in the photo upload; Resend is not.

• Withdrawal of consent: the Client can delete the photo themselves on the “My bookings” page, or request its deletion at info@galateabooking.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

• Uploading a photo is not a condition for anything: the appointment can be booked in the same way without a photo, and the treatment can still be received.

This consent does not apply to the text note written for the booking: the Client must still not write health data there, and a warning about this is also shown at the note field.

C) Our processors used to operate the Service

The Provider processes the data handled and stored by the booking system with the involvement of the processors below. The data is stored within the European Union, in a data centre in Germany (Frankfurt).

The booking page’s server functions run in Frankfurt. Requests arrive via Vercel’s worldwide server network, so the technical data of a request (IP address, time, requested address, browser identifier) may also be processed by the server location nearest to the visitor, which may also be outside the European Union.

Retention period: see point III/A.

D) The Client’s account

• What it is: the Client may create a guest account with their name, email address and phone number; adding their home address is optional. We do not ask for a password: logging in works with a one-time code sent to the email address.

• Legal basis: the Client’s consent, given by ticking the checkbox when creating the account. The Provider qualifies as a controller in respect of this data.

• Purpose: managing the account, identifying the Client when they log in, and filling in the booking form. The home address is added to a booking only when the Client books a Professional who comes to their home, and only the chosen Professional sees it.

• Data processed: full name, email address, phone number, home address (optional).

• Retention period: until the account is deleted. The Client can change their data at any time on the “My account” page (a new email address is confirmed with a code) and can delete their account there; the account and the data stored in it are then deleted, while the data of earlier bookings remains with the Professional for the period set out in point A).

E) Signing up through the private assistant’s shared link

• What it is: a user of the private assistant (the Organiser) may share a link to their plans. Anyone who receives the link can see the upcoming dates of the plans on that link without logging in, and can join or vote for a date with their name; we do not ask for an email address or phone number.

• Legal basis: the consent of the person signing up, given by ticking the checkbox when signing up. The sign-up data is processed by the Organiser to organise their plan; the Provider acts as a processor in this respect.

• Purpose: recording the sign-up, showing the number of participants and the state of the vote to those who have the link, and notifying the Organiser.

• Data processed: the name given, the chosen plan, the number of guests, the note to the Organiser (optional), the time and text version of the consent, the language of the sign-up. Who sees it: everyone who opens the link sees the name and the chosen plan; only the Organiser sees the note.

• Suggesting another plan: anyone with the link may suggest another plan or their own idea for a date. To do so, they give their name, their suggestion and (optionally) a note to the Organiser, with their consent; only the Organiser sees these, not the people who open the page. If the Organiser accepts, the plan of the date changes for everyone who joined. Retention: 90 days after the Organiser’s decision — or, if they haven’t decided by then, after the date starts — after which the name and the note are deleted.

• A new plan in the Organiser’s free time: the page also shows the time windows that are still free in the Organiser’s free time, with exact times (not their busy times). Anyone with the link may request a new plan in this time with one of the link’s plans, with the same data and consent as a sign-up; until the Organiser approves it, only the Organiser sees the request, and afterwards it is shown like any other sign-up.

• The personal cancellation link and the browser’s storage: after signing up, the person receives a personal link to cancel the sign-up or change their vote. Only they receive its secret token; we keep only a hash derived from it. Their browser also remembers the token in its local storage (not a cookie), so the page can show their sign-up on the same device; they can clear this storage in their browser settings at any time.

• Retention period: 90 days after the date, after which the name and the note are deleted; earlier if the person cancels or the Organiser removes the sign-up (a cancelled sign-up’s name remains visible to the Organiser until the date).

F) Text messages about the booking

• What it is: if the Client books with the salon’s AI phone assistant and asks to receive notifications by text message (SMS), the Provider sends text messages to the mobile number given: a verification code (if the number given is not the one shown for the call), the booking confirmation, the salon’s decision, a reminder before the free cancellation deadline and, if the salon asks for a deposit, the payment link, the confirmation of the payment and, if the Client cancels, the confirmation of the cancellation. A user of the personal assistant may also send their customer a text message about a cancelled job.

• Legal basis: performance of the booking (the contract), which the Client requests during the call (Article 6(1)(b) GDPR). In respect of this data the salon — or the user of the personal assistant — is the controller, and the Provider is the processor.

• Data processed: the mobile number, the type of message, the time and status of sending and delivery, the number of segments and the fee of the text message. We do not store the text of the message; of the verification code we keep only a hash, and the code expires after 10 minutes.

• Who receives it: to send the text message, Bird receives the phone number and the message, and to deliver it, the recipient’s mobile carrier; for a foreign number, this may be a carrier outside the European Union. We do not use the phone number for marketing, and we do not share or sell mobile numbers, or the fact that someone asked for text messages, to third parties for marketing purposes.

• Opting out: in the United States and Canada, the Client can opt out by replying “STOP” to a text message; after that, we do not send text messages to that number on behalf of any salon. Elsewhere, the Client can ask for the same at info@galateabooking.com. We keep the opt-out together with the number so that we can respect it; if the Client wants text messages again, they can ask for it to be removed at info@galateabooking.com.

• Retention period: the log of text messages is deleted after 90 days and the hashes of verification codes after 30 days (the system cleans up daily). The fee of the text message remains, without the phone number, among the movements of the salon’s credit (for the personal assistant: the wallet).

IV. Data transfers

1. The Provider does not sell the personal data of Professionals and Clients, and does not transfer it to third parties for marketing purposes.

2. The data provided by the Client may be accessed, for the purpose of providing the service, by the salon chosen by the Client (the Professional) and its selected team member. In respect of this data, the salon qualifies as an independent controller, and the Provider as its processor.

3. The Provider uses the processors named in point III/C above. These processors may process the data only in accordance with the Provider’s instructions and for the specified purpose.

4. The Provider discloses data to the authorised body in the event of a legal obligation or a request from an authority or court.

V. Data security

1. The Provider takes all necessary security steps and organisational and technical measures to ensure the highest level of security of personal data and to prevent its unauthorised alteration, destruction and use.

2. The Provider takes all necessary measures to ensure data integrity, that is, the accuracy and completeness of the personal data it processes as controller and/or as processor.

3. The Provider protects the data with appropriate measures, in particular against unauthorised access, alteration, transfer, disclosure, deletion or destruction, as well as against accidental destruction or damage, and against becoming inaccessible as a result of changes in the technology used.

4. The Provider does everything it can to preserve the authenticity and confidentiality of the data processed, and to ensure that the data subjects and those authorised to do so always have access to it.

5. In order to fulfil the above obligations, the Provider reserves the right, if it detects a security gap in its system on the part of its customers or partners, to inform its customers and partners about it and, at the same time, to restrict their access to the Provider’s system and services, or to certain functions of them, until the security gap has been eliminated.

6. The detailed rules of the procedure to be followed in the event of personal data breaches are set out in the Provider’s internal security policy.

VI. Rights of the data subject

1. The data subject may request the Provider – in writing, using the Provider’s contact details given above – to provide information about the processing of their personal data; they may also request the rectification of their personal data, and may request – except in the case of mandatory processing – the erasure of their personal data or the restriction of its processing, and may object to the processing of their personal data. The data subject may withdraw their consent to processing at any time; such withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

2. At the data subject’s request, the Provider provides information about the data it processes, its source, the purpose, legal basis and duration of the processing, the name and address of any processor and its activities related to the processing, and – if the data subject’s personal data has been transferred – the legal basis and recipient of the transfer. The Provider provides the information in writing, in an easily understandable form, within the shortest possible time from the submission of the request, but no later than within 30 days. The information is free of charge.

3. The Provider rectifies personal data if it is inaccurate and the accurate personal data is available to the controller.

4. The Provider erases personal data without delay if its processing is unlawful, if the data subject requests it, if the data processed is incomplete or incorrect – and this cannot lawfully be remedied – provided that erasure is not excluded by law, if the purpose of the processing has ceased or the time limit for storing the data has expired, or if erasure has been ordered by a court or by the Hungarian National Authority for Data Protection and Freedom of Information. The Provider accepts no liability for pages that it has deleted but that were previously archived by internet search engines; these can be removed by the operator of the search engine, and the request for deletion must be made to them.

5. The Provider notifies the data subject of the rectification, the restriction of processing or the erasure of the data. The Provider has 30 days to erase or rectify the personal data or to implement the restriction.

6. If the data subject considers that their rights have been infringed as a result of the Provider’s processing, they may lodge a complaint with the following authority:

   Hungarian National Authority for Data Protection and Freedom of Information 1055 Budapest, Falk Miksa utca 9–11. Postal address: 1363 Budapest, Pf. 9. Phone: +36-1-391-1400 Fax: +36-1-391-1410 Email: ugyfelszolgalat@naih.hu

VII. Declaration

1. The Provider, as Controller and Processor, acknowledges the content of this privacy notice as binding on itself.

2. It undertakes that its processing in connection with the Service and its operation will at all times comply with the provisions laid down in this document and in the legislation in force, with particular regard to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

3. The Provider makes this notice continuously available on the galateabooking.com website. Amendments to the privacy notice take effect upon publication on this website.

Uckfield, 1 October 2026