Legal
Privacy policy
How Booking Desks collects, uses and protects personal data, written to be read, not just to comply. It applies to our website, the booking application on the web and on phones, and our relationship with customers.
Zuletzt aktualisiert am 21. Oktober 2026
1. The short version
- We collect what is needed to book desks and parking and to run a business with our customers. Nothing more.
- Your employer decides what happens with booking data in its workspace. We process it on their behalf.
- We do not sell personal data, show advertising, or use tracking or analytics cookies.
- Data is hosted in the European Union. Card payments are handled by Stripe; we never see your card number.
- You can download your data and delete your account yourself, from your Account page in the app.
- You can reach us about privacy at any time at privacy@booking-desks.com.
2. Who is responsible for your data
Viallo s. r. o., Šustekova 3697/49, 851 04 Bratislava – Petržalka, Slovak Republic, IČO 57 859 043 ("we") is the controller for personal data we process for our own purposes: visitors to our website, people who sign their company up, contacts at customer organisations (such as billing and administrator contacts), prospects who write to us, and job applicants.
For booking data inside a workspace, your organisation is the controller and we act as its processor under our Data processing agreement. If you use Booking Desks through your employer and want to exercise your rights over booking data, contact your employer first; we will help them respond.
We have not appointed a data protection officer because the law does not require one for our processing. Privacy questions go to privacy@booking-desks.com.
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, work email address, organisation, role (user or administrator), profile picture if your identity provider supplies one, the date you last used the service | Your administrator, you when you register, or Google or Microsoft when you sign in with them |
| Sign-up data | Company name, workspace address, the founder's work email address, whether colleagues with the same email domain may join | You, when you sign your company up on our website |
| Booking data | Desks and parking spaces booked, dates and times, check-ins, carpool driver and passengers, who booked on whose behalf, favourite desks, team members you follow | Created as you and your colleagues use the service |
| Preferences | Language, email and push notification settings, completed onboarding steps | Your choices in the app |
| Device data | Push notification subscription (a browser-generated address and keys) if you turn on push notifications in your browser; a push token for each phone where you allow the phone app's notifications | Your browser or phone, only after you allow notifications |
| Technical data | IP address, browser type, time of request, error logs | Automatically, when you use the site or app |
| Customer contact and billing data | Names and email addresses of administrators and the billing contact, company name, billing address and VAT number, plan, invoices and payments (amount, date, invoice number). For a payment our staff record by hand (a bank transfer, say), also which of our staff recorded it and their note on it. Never card numbers | Your organisation when it signs up or orders, Stripe when a card payment is made, and our accounting |
| Correspondence | Messages you send us and our replies | You |
When you sign in with Google or Microsoft, we keep your name, email address, profile picture and the identifier of your account there. We do not keep the access tokens they issue at sign-in: we never use them to reach your Google or Microsoft account.
The phone app can check you in when you arrive at the office. It uses your phone's location for that on the phone itself: your position is never sent to us, only the check-in.
We do not ask for special categories of personal data (such as health data). Please do not put them into names, labels or closed-date descriptions.
4. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the booking service to a customer's workspace: accounts, bookings, check-in, parking, carpooling, notifications | Performed on behalf of the customer as processor (Art. 28); for the customer, usually Art. 6(1)(b) or (f) |
| Signing a company up: confirming the founder's work email and creating the workspace | Steps before a contract (Art. 6(1)(b)) |
| Signing you in, including with Google or Microsoft, and keeping accounts secure | Contract (Art. 6(1)(b)) and legitimate interest in security (Art. 6(1)(f)) |
| Managing our contract with customers, taking card payments through Stripe, invoicing and collecting payment | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Keeping payment records, invoices and accounting records | Legal obligation under the Slovak Accounting Act (Act No. 431/2002 Coll.) and tax law (Art. 6(1)(c)) |
| Answering enquiries and support requests | Legitimate interest in responding (Art. 6(1)(f)), or steps before a contract (Art. 6(1)(b)) |
| Operating, securing and improving the service: logs, error monitoring, health checks, preventing abuse, and an audit log of changes our staff make | Legitimate interest (Art. 6(1)(f)) |
| Deleting accounts and workspaces nobody uses, after telling them first | Legitimate interest in keeping no data that is no longer needed (Art. 6(1)(f)), in line with storage limitation (Art. 5(1)(e)); for workspace data, the customer's instructions |
| Service emails such as booking confirmations, check-in reminders, payment reminders and notices about changes | Contract (Art. 6(1)(b)); optional notifications follow your settings |
| Assessing job applications | Steps before a contract (Art. 6(1)(b)); consent (Art. 6(1)(a)) if we keep your application for future roles |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automatic release of an unchecked-in desk follows a rule your organisation sets, and can always be reversed by booking again.
5. Who we share it with
Inside a workspace, colleagues can see what the workspace is designed to show: who sits where on a floor plan, team members' desks, and the people in a carpool. Administrators can see and manage the workspace's users and bookings.
We use a small number of service providers, each only for the purpose shown. Those that work for us, such as our hosting, email and push notification providers, process data only on our instructions and under contracts that meet GDPR requirements:
| Provider | Purpose | Location |
|---|---|---|
| INTERNET CZ, a.s. (Forpsi), Czech Republic | Servers and database hosting | Czech Republic (EU) |
| Websupport, s. r. o., Slovakia | Sending service emails | Slovakia (EU) |
| Stripe Payments Europe, Limited | Issuing invoices and receipts for card payments, and emailing them to the billing contact | Ireland (EU), with transfers to Stripe in the USA under the EU–US Data Privacy Framework and standard contractual clauses |
| 650 Industries, Inc. (Expo) | Passing push notifications on to the phone app: the phone's push token and the notification's text, only if you allow the app's notifications | USA, under the EU–US Data Privacy Framework |
| Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) | Delivering the phone app's push notifications to iPhones and Android phones, only if you allow them | USA: Google under the EU–US Data Privacy Framework, Apple under standard contractual clauses |
| Google (Google Ireland Ltd.) | Sign in with Google, only if your organisation enables it | EU, with transfers under the EU–US Data Privacy Framework |
| Microsoft (Microsoft Ireland Operations Ltd.) | Sign in with Microsoft, only if your organisation enables it | EU, with transfers under the EU–US Data Privacy Framework |
| Your browser's push service (for example Google, Mozilla, Apple or Microsoft) | Delivering browser push notifications, only if you turn them on. The content is encrypted so that the push service cannot read it | Depends on your browser |
Stripe for card payments. Paid plans are bought in Stripe Checkout and managed in Stripe's customer portal, on Stripe's own pages. There, Stripe Payments Europe, Limited (Ireland) receives the card details, the billing address and VAT number, and the name and email address of the person paying, and processes them as an independent controller for the payment itself, fraud prevention and its own legal obligations, under the Stripe Privacy Policy. For invoices and receipts it acts as our processor, as in the table above. Stripe receives only the paying company's billing details, never booking data. We never see or store card numbers: Stripe tells us only whether a payment succeeded, its amount and period, and the invoice's number. When an administrator who is Stripe's contact for the company is deleted, Stripe's copy of their email address is replaced with another administrator's. When a workspace is deleted, we delete its customer record at Stripe (the company's name, billing email, address and VAT number) too. Stripe keeps the invoices and payments it has processed, with the billing details they were issued to, for as long as the law requires of it, under its own privacy policy.
We also share data where the law requires it, for example with tax authorities, courts or supervisory authorities, and with our accountants and legal advisers under confidentiality. We never sell personal data.
6. International transfers
Our servers are in the European Union (Czech Republic), and so are our email provider (Slovakia) and Stripe's European company (Ireland). Some providers may process data in the USA: Expo for the phone app's push notifications, your browser's push service for browser notifications (only if you turn them on), Google and Microsoft for sign-in (only if your organisation enables it), and Stripe. These transfers are covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework, or by the Commission's standard contractual clauses, as shown for each provider above.
7. How long we keep it
- Workspace data (accounts, bookings, settings): for as long as the customer's contract runs. When an administrator closes the workspace, it is deleted at once; when the contract ends otherwise, within 30 days. A workspace suspended for not paying is deleted 30 days after the suspension, after a warning 7 days before. An administrator can delete individual users earlier, and you can delete your own account at any time.
- Past bookings are kept as part of the workspace so organisations can see how their office is used, unless the customer asks us to delete them sooner. They are deleted with the person's account or with the workspace.
- Accounts nobody uses: an account that has not been signed in to or used for 24 months is deleted, 30 days after an email that tells you so; signing in keeps it. If that email cannot be sent, nothing is deleted until one has been. The last administrator of a paid workspace is not deleted this way: they hold its contract. An account created when a colleague booked a desk for someone who never signed in is deleted 6 months after its last booking.
- Free workspaces nobody uses, and any other workspace not on a paid plan, are deleted with all their data after 12 months without use, 30 days after an email to their administrators. Paid workspaces are never deleted for inactivity.
- Sign-in sessions expire after 30 days without use. Sign-up, registration and password links nobody used are deleted 7 days after they expire.
- Technical data: server logs up to 30 days, health-check records 90 days, unless needed longer to investigate a specific security incident.
- Audit log of changes our staff make in the platform: 24 months. When an account or a workspace is deleted, the email addresses of the people in it are removed from the log, which keeps what was done.
- Payment records, invoices and accounting records: 10 years, as the Slovak Accounting Act (Act No. 431/2002 Coll., §35) requires, also after the workspace is deleted. Payment records hold the company's name, the amount and the invoice number; one our staff recorded by hand also holds the email address of the staff member who recorded it and their note.
- Enquiries and correspondence: up to 3 years after the last contact.
- Job applications: until the role is filled and 6 months after, or up to 2 years with your consent.
8. How we protect it
Every connection is encrypted with TLS. Each organisation's data is separated at the database level and every request is checked against the organisation it belongs to. Passwords are stored only as salted hashes. Servers are patched automatically, protected by a firewall and accessible only with cryptographic keys. More detail is on our Security page.
If a personal data breach occurs that is likely to put your rights at risk, we will inform the affected customers without undue delay, and the supervisory authority where required.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of inaccurate data;
- erasure of data we no longer need or process unlawfully;
- restriction of processing in certain situations;
- data portability, receiving data you gave us in a machine-readable format;
- object to processing based on legitimate interest;
- withdraw consent at any time where processing is based on consent, without affecting earlier processing.
Much of this you can do yourself. On your Account page in the app you can download your personal data as a JSON file and delete your account at any time; deleting it removes your account and bookings, except what the law requires us to keep. If you are the last administrator of a workspace that still has other members, hand the administrator role to someone else first. An administrator can also close the whole workspace, which deletes it and all its data at once.
For anything else, write to privacy@booking-desks.com. We answer within one month and may ask you to confirm your identity. For booking data in your employer's workspace, we pass your request to your employer as controller and help them answer it.
You also have the right to lodge a complaint with a supervisory authority. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk. You may also contact the authority in the EU country where you live or work.
10. Cookies
We use only the cookies and browser storage needed for the service to work: keeping you signed in, protecting a sign-in while it is in progress, recognising a browser you have signed in with before (so that someone guessing your password elsewhere cannot lock you out), and remembering your language. We use no advertising or analytics cookies. Card payments happen on Stripe's own pages, under Stripe's cookie policy. See our Cookie policy for the full list.
11. Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version. We notify customer administrators by email of significant changes.