Privacy.

1. Controller.

BookaBox Service GmbH: Data Protection
An der Meisenburg 22
45133 Essen

Email: datenschutz@bookabox.com
Phone: +49 201 859 74 811

Questions about your data? Contact our helpdesk or write to us directly.

2. What data we process, and why.

Booking & contract

When you book a box, we process your name, company name if applicable, email address, phone number and postal address (for invoicing), your booking details (location, box size, term) as well as payment references, to conclude the contract, provide the service, handle billing and answer your requests.

We never store credit card data ourselves. Payment processing is handled exclusively by PCI DSS-compliant payment providers.

Account & app access

For your customer account we process your login data (email, personal password) and contract data. The BookaBox app opens your box door, no key, no code. For this we process access and opening events (which user opened which door and when) as well as shared access when you grant other people access. Purpose: secure entry, traceability in case of loss or damage, contract management and invoices in the app.

Video & AI security at our locations

Our locations are equipped with video surveillance and AI-assisted security analysis. When you enter the marked areas, images of you are recorded and automatically analysed for security-relevant events (e.g. unauthorised entry).

• Purpose: protection of your stored belongings, the building and all users; investigation of incidents. Part of our security package incl. 2.000 € basic insurance.
• No automated individual decision-making: the AI flags anomalies, the assessment is made by a human.
• Signage: monitored areas are marked on site with notice signs.

Website, cookies & analytics

When you visit bookabox.com we process browser data: IP address, time and date of the visit, browser version and platform, referrer website, browser language and geolocation as well as a session cookie. We analyse this data anonymously to improve our services (incl. Google Analytics with anonymised IP, opt-out available). We protect forms with Google reCAPTCHA. You can find details on cookies in section 7.

Support & communication

If you contact us via ticket, live chat, phone or WhatsApp (AI bot), we process your contact details and the content of your request, to handle your enquiry. You can unsubscribe from marketing communication at any time.

Job applications

We use application data (name, email, phone, cover letter, CV) only for the hiring process. We do not collect sensitive data (e.g. ethnic origin, political opinions, religious beliefs). Deletion at any time on request.

3. Legal bases.

• Art. 6(1)(b) GDPR (contract): booking, account, app access, billing, support.
• Art. 6(1)(f) GDPR (legitimate interest): video & AI security at the locations, fraud prevention, form protection, anonymous reach analytics.
• Art. 6(1)(a) GDPR (consent): optional cookies (interaction history, advertising & marketing), marketing communication. Can be withdrawn at any time.
• Art. 6(1)(c) GDPR (legal obligation): retention under tax and commercial law.

4. Recipients of your data.

We do not sell, trade or transfer your personal data to third parties, except to the service providers named here, insofar as necessary for the respective purpose:

• Payment processing: PayPal, Ingenico Payment Services, Stripe, Twikey (all PCI DSS-compliant). They receive order details, name and email; credit card information is held only by the payment provider.
• Hosting & infrastructure: OVHCloud SAS, Google Cloud EMEA Ltd (production, backups, DDoS protection; ISO 27001-certified, among others).
• ERP & database hosting: Odoo.com.
• Website services: Google Analytics (anonymous analytics), Google reCAPTCHA (form protection), Cloudflare (caching), GoDaddy (domain hosting), OneSignal (browser push), Acuity Scheduling (appointment scheduling), FullStory (only with consent to the UX programme), Clearbit (business contact info).

Data transfers: hosting regions include Europe (France, Belgium); backups are replicated across several continents (Canada, France, Belgium). Hosting exclusively within the EU is currently not supported.

We may share aggregated, anonymised information for research and statistical purposes.

Subprocessors in detail

For each service we name what we use it for and which data is shared. We only pass on what the respective purpose requires.

5. Retention periods.

• Account & contact data: only as long as necessary for the purpose, including statutory retention periods (administration, billing, tax).
• Browser data: a maximum of 12 months; server-side session information 3 months with active use, otherwise discarded after 7 days.
• Customer data after cancellation: deactivated for 3 weeks (grace period), then permanently deleted.
• Application data: if not hired, up to 3 years (unless you object); if hired, for the duration of the contract plus statutory periods.
• Backups: deleted data may remain in immutable backups for up to 12 months and is then destroyed automatically.
• Video recordings (locations): deletion after a short period unless there is a security-relevant incident.

6. Your rights.

Under the GDPR you have the right at any time to:

• Access (Art. 15): what data we hold about you,
• Rectification (Art. 16): have incorrect data corrected,
• Erasure (Art. 17): insofar as no statutory retention obligations prevent it,
• Restriction of processing (Art. 18),
• Data portability (Art. 20),
• Objection (Art. 21): in particular against processing based on legitimate interests,
• Withdrawal of consent given (Art. 7(3)), with effect for the future,
• Complaint to a supervisory authority (Art. 77).

In practice this means: you can view and update your account and contact data yourself in your account at any time. You can request permanent deletion via the helpdesk, unless legal obligations (e.g. tax) prevent it.

7. Cookies.

Cookies help us make your experience on BookaBox.com better, and see which ads brought you to us. On your first visit you can choose in the cookie banner:

• Allow all cookies: Essential plus optional cookies (interaction history, advertising & marketing).
• Essential cookies only: Only what the website needs to function (session, security, preferences).
• Adjust settings: Decide category by category, changeable at any time.

Cookie categories in detail

• Session & security (essential): authenticates you, protects your data and enables cart and uploads. Example: session_id. Without these cookies the website does not work properly.
• Preferences (essential): remembers language and region. Example: frontend_lang.
• Interaction history (optional): records visited pages and marketing campaigns that led you to us. Examples: utm_campaign, utm_source, utm_medium.
• Advertising & marketing (optional): more relevant advertising and campaign reporting. Examples: __gads, __gac (Google). Additional opt-out via optout.networkadvertising.org.

You can also control cookies at any time via your browser settings or disable them completely. Do Not Track signals are currently not supported, as there is no industry standard for compliance.

8. Security of your data.

We protect your data with technical and organisational measures. Our hosting partners are certified to ISO 27001, SOC 1/2 and PCI DSS, among others. Helpdesk staff and technicians access customer data only in a limited and appropriate way, for support, legal obligations or security.

9. Changes to this policy.

We may update this privacy policy from time to time. The date above shows you the last revision and the effective date. We will give you access to archived versions on request.

10. Contact.

Questions about this policy or about your data?

• Email: datenschutz@bookabox.com
• Mail: BookaBox Service GmbH, Data Protection, An der Meisenburg 22, 45133 Essen
• Or directly via our help page, Lena, our AI helpdesk, will point you in the right direction.