Privacy policy

Last updated: 18 October 2026

GetBooking is booking software for dance and movement studios. This policy explains what personal data we handle, why, who helps us handle it, how long we keep it and what rights you have. We have tried to write it plainly; if anything is unclear, write to us.

1. Who we are

GetBooking is run by DUNGARD SRL, Str. Vasile Lucaciu nr. 105-107, cam. 3, et. 3, ap. 28, Sector 3, Bucharest, Romania. Trade register J2016014944409, VAT number RO36736491.

For anything about your data, write to privacy@getbooking.now.

2. Two roles: for ourselves, and for studios

For our own customers, we are the controller. That covers studio owners and staff who use GetBooking, people who visit getbooking.now, and the studios we bill. We decide how and why their data is used, and this policy is our notice to them.

For a studio's customers, the studio is the controller and we are its processor. When you book a class on a studio's site, the studio decides what it collects and why: its timetable, its prices, its questions, its messages. We store and process that data for the studio and only on its instructions, under our data processing agreement. For how a studio uses your data, see that studio's own privacy notice or ask the studio. This policy explains how we, as its processor, look after it.

3. What data we handle

Studio owners and staff

• Account: name, email, phone number if you give it, password (stored only as a one-way hash), passkeys and two-step sign-in settings, the devices you chose to remember, your language.
• Your studio's business details: company name, tax and registration numbers, address, billing email, and the results of checking your VAT number with ANAF or the EU's VIES service, which we keep as proof.
• Billing: your plan, what you used, statements, invoices and payments. Card details are held by Stripe; we only keep the card's brand and last four digits.
• Use of the admin: a record of changes made to the studio (who changed what, and when), sign-ins, and conversations with the admin assistant if you use it.
• Teachers' own calendars: if a teacher connects their Google, Outlook or iCloud calendar, we keep its private address (encrypted) and the times they are busy over the next six months, read every 15 minutes, so private lessons aren't booked then. We never keep what the events are. Disconnecting deletes both.

Studios' customers (processed for the studio)

• Account and contact: name, email, phone number, password hash or guest details, language, and consents (for example to marketing or photos).
• Signing in with Google: if you choose to, Google tells us your name, your email address, whether Google has verified it, and an ID for your Google account. We never see your Google password or anything else in your Google account.
• Bookings and attendance: classes and appointments booked, waitlists, check-ins, cancellations and no-shows.
• Passes and payments: passes, memberships, gift cards and discount codes used, payments, refunds and invoices. Card payments are handled by Stripe on the studio's own Stripe account.
• Answers to the studio's questions: whatever a studio asks when you book or register, such as an emergency contact or experience. A studio may ask about health (for example injuries); if it does, it is responsible for having a valid reason to.
• Messages: emails, SMS and WhatsApp messages the studio sends you, and conversations on WhatsApp, Instagram or Messenger if the studio connects those channels.

Visitors to our websites

• Technical data every website receives: IP address, browser and device type, the pages requested and when, kept in short-lived server and security logs.
• We do not use advertising or analytics trackers.

4. Why we use it, and on what legal basis

• To provide GetBooking to studios and, for them, to their customers: running accounts, sites, bookings, payments and messages (performance of a contract, GDPR art. 6(1)(b)).
• To bill studios and keep accounting records, including checking VAT numbers and issuing invoices (legal obligation, art. 6(1)(c)).
• To keep the service secure and prevent abuse: sign-in protection, logs, audit records (legitimate interests, art. 6(1)(f)).
• To support you when you ask for help; with a studio owner's permission, our staff can access their studio's admin to help, and each visit is recorded and shown to the owner (contract and legitimate interests).
• To send optional messages such as a studio's marketing emails, only with your consent (art. 6(1)(a)), which you can withdraw at any time.

5. The AI assistants

GetBooking has two optional AI assistants. Both are off until a studio turns them on.

• The admin assistant helps studio staff set up and run their studio by chat. It can only see and do what the staff member using it is allowed to, and asks them to confirm important changes.
• Customer support can answer a studio's customers on WhatsApp, Instagram or Messenger about its schedule, prices and policies, and book them in. A studio can let it draft replies for staff to approve, or answer on its own.

To do this, the text of the conversation and the studio data needed to answer it are sent to an AI model run by Scaleway in its data centres in France. We do not use your data to train AI models. The assistants make no decisions with legal or similarly significant effects on you; a person at the studio can always step in.

6. Who helps us (sub-processors)

We use these companies to run GetBooking. Each receives only what it needs for its task, under a contract that requires it to protect the data.

We also check studios' VAT numbers with Romania's tax authority (ANAF) and the European Commission's VIES service. These are public authorities and receive only company details. If you follow a map link on a studio's site, Google Maps receives that request directly. If you sign in with Google, you do so on Google's own pages, under Google's privacy policy.

7. Data outside the European Union

Our database and files are stored in the EU, with Scaleway in France. Some providers above are based in, or may process data from, countries outside the EU, such as the USA or Singapore. When that happens, we rely on the European Commission's adequacy decisions (including the EU-US Data Privacy Framework for certified companies) or the Commission's standard contractual clauses, with the additional safeguards they require.

8. How long we keep data

• Accounts are kept while they are in use. When a studio closes its account or you ask us to delete yours, we delete or anonymise the data, except what we must keep for the reasons below.
• Invoices, payments and accounting records are kept for as long as Romanian accounting and tax law requires, generally up to 10 years.
• Proof of VAT number checks is kept with the accounting records it supports.
• Sign-in codes sent by SMS, WhatsApp or email are erased within an hour of being used or expiring. The record that a code was sent, without the code, is deleted after 7 days.
• Sign-ins last 7 days. The record of one is deleted 90 days after it ends.
• Copies of automatic messages we send, such as booking confirmations and reminders, are deleted after 6 months. Messages from payment providers about payments are deleted 90 days after we've processed them.
• A studio's customers' data is kept for as long as the studio uses GetBooking, or until the studio deletes it or a customer's erasure request is completed. On erasure, profile details, answers and marketing consents are removed; bookings, passes, payments and invoices are kept, because the studio must keep financial and attendance records.
• Server and security logs are kept only as long as needed to run and secure the service. Records of changes in the studio admin are kept while the studio uses GetBooking.

9. How we protect it

Connections are encrypted (HTTPS). Passwords are stored only as strong one-way hashes, and staff can use passkeys and two-step sign-in, which a studio can require. Connection credentials, such as studios' messaging keys, are encrypted. Access to data is limited by role, and changes in the admin are recorded. GetBooking staff can only enter a studio's admin when its owner allows it, and the owner sees each visit.

10. Cookies

We only use cookies needed for the service to work, so we do not ask for consent to them:

• SESSION: keeps you signed in (up to 7 days).
• TWO_STEP, PASSKEY_LOGIN, PASSKEY_SETUP: a sign-in in progress (10 minutes).
• TRUSTED_DEVICE: skips two-step sign-in on a device you chose to remember (30 days).
• GUEST_BOOKINGS: lets a guest see the bookings they just made (1 day).
• lang: remembers your language (1 year).

11. Your rights

Under the GDPR you can ask to see your data, have it corrected or deleted, restrict or object to its use, receive it in a portable format, and withdraw consent you gave. Customers of a studio can download their data and ask for erasure from their account on the studio's site.

If you are a studio's customer, the studio decides on your request; you can write to the studio, or to us and we will pass it on and help. Otherwise write to privacy@getbooking.now. We answer within a month.

You can also complain to the Romanian data protection authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro, or the authority where you live.

12. Children

GetBooking accounts are for adults. Studios that teach children take bookings from parents or guardians, and are responsible for the children's data they collect.

13. Changes

When we change this policy we update the date at the top. If a change matters to how your data is used, we tell studios in advance by email or in the admin.