Privacy policy

Laws covered by this privacy policy

This privacy policy is adapted to current Spanish and European regulations on the protection of personal data on the internet. In particular, it complies with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
• Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).
• Royal Decree 1720/2007 of 21 December, approving the Regulation implementing Organic Law 15/1999 on the Protection of Personal Data (RDLOPD).
• Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).

Identity of the data controller

The controller of the personal data collected through BookService is PUBLICIDAD DIGITAL MULTIMEDIA INTERNACIONAL, S.L.U. (Cupperlab), tax ID (NIF/CIF) B87580866, registered in the Madrid Commercial Registry at Volume 34,799, Folio 189, Section 8, Sheet M-625954, represented by Mr. Juan José Santana Pérez (Sole Director) (hereinafter, the Controller). Contact details:

• Address: Calle de Caracas, 15, Chamberí, 28010 Madrid (Spain)
• Phone: +34 91 495 2585
• Email: dpo@cupperlab.com

Cupperlab's role in BookService

Cupperlab is the controller of the data of merchants who install BookService and of this website.

For the data of each store's end customers (the people who make a booking), the merchant is the controller and Cupperlab acts as a processor on its behalf, in accordance with Article 28 GDPR and Shopify's terms. If you are a customer of a store that uses BookService, we recommend contacting the merchant first.

Record of processing activities

In accordance with the GDPR and the LOPD-GDD, personal data processed through BookService will be stored and processed in our systems in order to provide the service contracted by the merchant. Unless the exception in Article 30.5 GDPR applies, we keep a record of processing activities specifying, by purpose, the processing carried out and the other circumstances required by the GDPR.

Principles applicable to the processing of personal data

Personal data will be processed in accordance with the principles set out in Article 5 GDPR and Article 4 et seq. of the LOPD-GDD:

• Lawfulness, fairness and transparency.
• Purpose limitation: personal data will be collected for specified, explicit and legitimate purposes.
• Data minimisation: only the personal data strictly necessary for the purposes of processing will be collected.
• Accuracy: personal data must be accurate and kept up to date.
• Storage limitation: personal data will be kept in a form that permits identification only for as long as necessary for the purposes of processing.
• Integrity and confidentiality: personal data will be processed in a way that ensures its security and confidentiality.
• Accountability: the Controller is responsible for ensuring compliance with the above principles.

Categories of personal data

BookService only processes the data needed to manage bookings:

• Merchant data: store domain, store owner's name, email and contact details provided by Shopify.
• End customers' identification and contact data: name, email, phone and address or postal code needed for the booking.
• Booking data: service, date, time, assigned professional, add-ons and the related Shopify order.
• The merchant's professionals: name, email, schedule, service areas and vacations.
• Technical data: IP address, browser, operating system and approximate location, used for service security and to show the right availability.

Special categories of personal data within the meaning of Article 9 GDPR are never processed.

Legal basis for processing

The legal basis for processing merchant data is the performance of the BookService terms of use accepted when installing the app from the Shopify App Store, as well as compliance with legal obligations.

End customer data is processed following the merchant's instructions; the merchant determines the applicable legal basis towards its customers.

Connecting third-party services such as Google Calendar or Klaviyo is based on the express consent of the merchant or professional, who can withdraw it at any time by disconnecting the integration.

Purposes of processing

Cupperlab processes personal data for the following purposes:

• Showing availability, creating and managing bookings and assigning professionals.
• Syncing bookings with Google Calendar when a professional connects it.
• Sending confirmations and reminders through Klaviyo when the merchant enables the integration.
• Billing the subscription through Shopify and providing technical support.
• Improving the quality, operation and security of the service.

Data retention periods

Personal data will only be kept for as long as necessary to fulfil the purposes for which it was collected or until its erasure is requested, and for the legally required periods to address any liabilities arising from the processing.

When a merchant uninstalls BookService, Shopify sends us an erasure request and we delete the store's data. We also handle the end customer data access and erasure requests that Shopify forwards to us.

Recipients of personal data

Personal data may be disclosed to the following recipients or categories of recipients, always in order to provide the requested services and comply with legal obligations:

• Shopify, as the platform the app runs on.
• Railway, hosting provider for the app, its database and this website.
• Google (Google Calendar) and Klaviyo, only if the merchant or professional enables those integrations.
• Tax, labour and accounting advisors and banks, to comply with legal obligations.
• Courts, administrative bodies and law enforcement authorities when required by law.

An up-to-date list of processors, with their identification and contact details, is available on request at dpo@cupperlab.com. Cupperlab signs with each processor the data processing agreement required by Article 28 GDPR.

Some of these providers may process data outside the European Economic Area. In those cases, transfers rely on adequacy decisions of the European Commission or on standard contractual clauses.

Personal data of minors

In accordance with Article 8 GDPR and Article 7 LOPD-GDD, only persons over 14 years of age may lawfully consent to the processing of their personal data. For minors under 14, the consent of their parents or guardians is required, and processing will only be lawful to the extent they have authorised it.

Confidentiality and security of personal data

Cupperlab undertakes to adopt the technical and organisational measures required for a level of security appropriate to the risk, so as to guarantee the security of personal data and prevent its accidental or unlawful destruction, loss or alteration, or unauthorised disclosure or access.

BookService and this website use an SSL/TLS certificate, so personal data is transmitted securely and confidentially, fully encrypted between the server and the User.

However, since it is not possible to guarantee that the internet is impregnable or that fraudulent access will never occur, the Controller undertakes to report without undue delay any personal data breach likely to result in a high risk to the rights and freedoms of natural persons.

Personal data will be treated as confidential, and the Controller ensures, through legal or contractual obligations, that this confidentiality is respected by its employees, partners and anyone to whom the information is made accessible.

Data sharing and disclosure

We do not sell or rent our users' personal data.

We may share or disclose personal information only in the following cases:

• With technology providers acting as processors that are necessary to provide the service (for example, hosting, storage, communications or infrastructure providers), always under contracts that guarantee confidentiality and data protection.
• With public administrations, judicial authorities or law enforcement when there is a legal obligation.
• In corporate transactions such as mergers, acquisitions or restructurings, always in compliance with applicable law.
• When the user has given express consent.

When the user authorises a connection with third-party services, such as identity providers, calendars or other services integrated via OAuth, the information obtained is used exclusively to provide the functionality requested by the user.

Data obtained through these integrations is not used for advertising, is not sold to third parties and is not used to train general-purpose artificial intelligence or machine learning models.

For Google integrations, the use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements where applicable.

Rights regarding the processing of personal data

The User may exercise the following rights recognised by the GDPR and the LOPD-GDD against the Controller:

• Right of access: to obtain confirmation of whether their personal data is being processed and, if so, information about it, its origin and the recipients of any disclosures.
• Right to rectification: to have inaccurate or incomplete personal data corrected.
• Right to erasure ("right to be forgotten"): to have personal data erased when it is no longer necessary, consent has been withdrawn, the User objects to the processing, it has been processed unlawfully or must be erased to comply with a legal obligation.
• Right to restriction of processing: when the User contests the accuracy of the data, the processing is unlawful, the Controller no longer needs the data but the User needs it for legal claims, or the User has objected to the processing.
• Right to data portability: to receive their personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.
• Right to object: to stop or prevent the processing of their personal data.
• Right not to be subject to a decision based solely on automated processing, including profiling.

The User may exercise these rights by writing to the Controller with the reference "RGPD-BookService", including: full name and a copy of their ID or any other legally valid proof of identity (and, where represented, that of the representative and proof of representation); the request and its specific reasons; address for notifications; date and signature; and any supporting documents.

Requests may be sent by post to Calle de Caracas, 15, Chamberí, 28010 Madrid (Spain) or by email to dpo@cupperlab.com.

This website

bookservice.app is a static informational site: it uses no cookies, forms, analytics or advertising tools.

Links to third-party websites

This website and the app may include links to third-party websites not operated by Cupperlab, such as the Shopify App Store. Their owners have their own data protection policies and are responsible for their own files and privacy practices.

Complaints to the supervisory authority

If the User believes there is a problem or breach of current regulations in the way their personal data is processed, they are entitled to effective judicial protection and to lodge a complaint with a supervisory authority, in particular in the State of their habitual residence, place of work or place of the alleged infringement. In Spain, the supervisory authority is the Spanish Data Protection Agency (https://www.aepd.es/).