Privacy policy

1. Data controller

The controller of personal data for the BookSys website, enquiries and customer relationships is:

ПИ ЕС ДИ ЕООД
Company registration number: 200716471
Address: Sofia, 19 Prof. Hristo Vakarelski Street
Brand/service: BookSys — online booking system
Website: booksys.bg

Email for personal data enquiries: Show email address

When you book with a studio or another business using BookSys, that business is usually the controller of the data for the relevant service. In these cases, ПИ ЕС ДИ ЕООД provides the system and processes data on its behalf under the agreed terms. Please also read the privacy policy of the relevant service provider.

2. What personal data we process

Depending on how you use BookSys and the services provided through the system, the following categories of information may be processed:

Registration and contact details

When you create a profile, make a booking or send an enquiry, the following may be processed:

• name;
• phone number;
• email address;
• user profile details;
• information about your business and details you provide in your enquiry.

Booking data

• selected class, workout or other service;
• booking date and time;
• history of bookings made, cancelled or attended;
• purchased packages or subscriptions;
• payment status information;
• other information needed to provide the requested service.

Payment data

Online payments may be processed through an external payment service provider. BookSys does not store your full bank card number or CVV/CVC code.

To confirm a payment, we may process the transaction identifier, amount paid, status, payment date and time, and limited payment method information.

Technical data

• IP address and hostname;
• device type, operating system and browser;
• visit date and time and pages visited;
• request address and referral source;
• session identifiers and technical session information;
• diagnostic and error information.

Technical data may be used for security, abuse prevention, diagnostics and service improvements.

Visit source data

For statistics and advertising performance measurement, we may process UTM parameters, Google Ads identifiers such as GCLID, Meta identifiers such as FBCLID, FBC and FBP, referral source and visit type information.

This data may be linked to a session or booking to report the source and effectiveness of advertising campaigns.

3. How we use the information

• creating and managing user profiles;
• accepting and managing bookings;
• providing and maintaining the BookSys system;
• managing packages and subscriptions;
• processing and confirming payments;
• sending booking confirmations, reminders and information;
• responding to enquiries and providing customer service;
• preventing fraud and abuse;
• maintaining security and technical diagnostics;
• improving the applications, website and services;
• statistics, analysis and advertising campaign measurement;
• complying with legal and accounting obligations.

4. Legal basis for processing

Personal data is processed where there is an appropriate legal basis under applicable law:

Performance of a contract or steps at your request — for example, when making an enquiry, using the system, booking or purchasing a package.

Legal obligation — to retain information required by accounting, tax or other applicable legislation.

Legitimate interest — for security, abuse prevention, technical support and protection of legitimate interests, where those interests do not override your rights.

Consent — where required, including for certain marketing or analytics technologies. You may withdraw consent at any time without affecting the lawfulness of earlier processing.

5. Cookies and similar technologies

The website and applications may use cookies, local storage and identifiers to maintain sessions, remember preferences, enable bookings and provide security.

Other technologies may be used for statistics, visit analysis and advertising campaign measurement. Where applicable law requires it, technologies that are not strictly necessary require prior consent.

You can manage and delete cookies in your browser settings. Restricting necessary cookies may affect signing in and system operation.

6. Analytics and advertising services

For statistics, analytics and advertising campaign measurement, services from the following providers may be used:

Google — for example, Google Analytics, Google Tag Manager and Google Ads.

Meta Platforms — for example, Meta Pixel and Meta Conversions API to measure advertising on Facebook and Instagram.

Technical information and information about interactions with the website or application, including advertising identifiers and event data, may be shared with these providers in accordance with service settings and applicable law.

7. Payment services

For certain online payments through BookSys, external payment providers may be used, such as myPOS, depending on the configuration of the relevant business.

When making a payment, the necessary information is provided to the payment provider. It processes payment data under its own privacy policy and terms.

8. Communication

Depending on the enabled features and settings of the relevant business, email, SMS, Viber, push notifications or phone calls may be used for booking information, schedule changes and customer service.

Confirmations and reminders needed to fulfil a requested service form part of its delivery. Advertising and marketing messages are sent only where there is an appropriate legal basis.

9. Who we may share data with

ПИ ЕС ДИ ЕООД does not sell your personal data. Where necessary for the relevant purpose, data may be shared with:

• the business where you make a booking;
• hosting and server service providers;
• payment providers;
• email, SMS and communication service providers;
• analytics and advertising service providers, including Google and Meta Platforms;
• technical providers and subcontractors;
• accounting and legal advisers;
• public authorities where disclosure is required by law.

Only information necessary for the relevant purpose is shared, subject to applicable data protection obligations.

10. International data transfers

Some providers may process information outside the European Economic Area. In such cases, the necessary safeguards under European law apply, such as an adequacy decision or standard contractual clauses, where applicable.

11. How long we retain information

Data is retained for as long as necessary for the purposes for which it was collected. Profile and booking data may be kept while the profile is active and afterwards where necessary for legal obligations or the protection of legitimate interests.

Accounting, tax and other mandatory information is retained for the periods required by law. Technical and advertising data is retained according to its purpose and the applicable system settings.

When we process data on behalf of a business using BookSys, retention periods also depend on its instructions and the agreed terms. Data that is no longer needed and has no basis for continued retention is deleted or anonymised.

12. Deleting your profile and personal data

You can request deletion of your profile and related personal data using the available function in the application or via the contact email address.

For booking data held by a particular business, you may also contact that business directly as the controller. Where a request concerns data we process on its behalf, we will assist within the agreed relationship and legal obligations.

To prevent unauthorised deletion, verification of your identity or ownership of the profile may be required. Data is deleted or anonymised, except where there is a legal basis for continued retention.

13. Security

Appropriate technical and organisational measures are applied against unauthorised access, unlawful use, alteration, loss, destruction and disclosure of personal data.

Communication with the website and applications uses an encrypted HTTPS connection where applicable. No method of transmission or electronic storage can guarantee absolute security.

14. Your rights

Under the General Data Protection Regulation (GDPR), where the applicable conditions are met, you have the right:

• to information and access to your personal data;
• to correct inaccurate or incomplete data;
• to have data erased;
• to restrict processing;
• to object to certain types of processing;
• to data portability;
• to withdraw consent;
• to lodge a complaint with the competent supervisory authority.

To exercise your rights, use the contact email address. We will respond within the periods set by applicable law.

15. Supervisory authority

In Bulgaria, the competent supervisory authority is the Commission for Personal Data Protection (CPDP). You may lodge a complaint if you believe the processing breaches applicable law.

Website: cpdp.bg.

16. Children's data

BookSys services are not specifically intended for young children. We do not knowingly collect children's data without the necessary consent of a parent or legal representative where required.

If a child's data is found to have been provided unlawfully, reasonable steps will be taken to delete it. The rules of the relevant studio also apply to children's participation in its services.

17. External links

The website and applications may contain links to external services. ПИ ЕС ДИ ЕООД is not responsible for their privacy practices. We recommend reading the relevant policies.

18. Changes to this policy

This policy may be updated when the services, technologies used or legal requirements change. When updated, the date at the beginning of the document changes.

The current version is available on the BookSys website through the Privacy policy link.

19. Contact

ПИ ЕС ДИ ЕООД / BookSys
Company registration number: 200716471
Sofia, 19 Prof. Hristo Vakarelski Street
Website: booksys.bg

Email for personal data questions and requests: Show email address