Privacy & GDPR

Protecting your customers' personal data is both a legal requirement and a trust-building practice. SeroBook provides the tools and features you need to comply with GDPR and other data protection regulations, giving your customers confidence that their information is handled responsibly.

Data Protection Compliance

SeroBook is designed to help you meet your data protection obligations under the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and similar regulations worldwide. Our compliance approach includes:

• Privacy by design – Data protection principles are built into every feature from the start, not added as an afterthought
• Data minimization – We only collect and process data that is necessary for providing our services
• Purpose limitation – Customer data is used only for the purposes you define (booking management, communication, analytics)
• Transparent processing – Clear documentation of how data is collected, stored, and used
• Regular reviews – Our data processing practices are reviewed quarterly by our legal and security teams

Your GDPR Obligations

As a business using SeroBook to manage customer bookings, you have specific obligations under GDPR. Here's what you need to do and how SeroBook helps:

Lawful Basis for Processing

You must have a lawful basis for processing customer personal data. For most booking scenarios, the appropriate basis is:

• Contract performance – Processing is necessary to fulfill a booking (the most common basis for booking platforms)
• Legitimate interest – Processing for business purposes like analytics, provided it doesn't override the individual's rights
• Consent – For marketing emails and non-essential communications, explicit consent is required

Transparency Requirements

You must inform customers about what data you collect and how you use it. SeroBook helps by:

• Providing a customizable privacy notice on your booking page
• Including consent checkboxes in booking forms
• Linking to your full privacy policy during the booking flow
• Recording when and how consent was given

Record of Processing Activities

GDPR requires you to maintain records of your data processing activities. SeroBook automatically generates and maintains a processing activity record that you can download from Settings > Privacy > Processing Records. This document lists the types of data processed, purposes, retention periods, and security measures.

Customer Data Rights

Under GDPR, your customers have specific rights regarding their personal data. SeroBook provides tools to help you fulfill these rights efficiently.

Right of Access (Subject Access Request)

Customers can request a copy of all personal data you hold about them. To fulfill this:

1. Navigate to Customers and find the customer's profile
2. Click Privacy > Export Data
3. SeroBook generates a complete data package including: profile information, booking history, communications, notes, and payment records
4. Download the package and provide it to the customer within 30 days of their request

Right to Erasure (Right to Be Forgotten)

Customers can request deletion of their personal data. To process this:

1. Navigate to the customer's profile
2. Click Privacy > Delete Customer Data
3. Review the data that will be deleted – SeroBook shows a summary before proceeding
4. Confirm the deletion

Some data may need to be retained for legal or tax purposes (e.g., financial transaction records). SeroBook will anonymize this data rather than fully deleting it, removing all personally identifiable information while preserving necessary business records.

Right to Data Portability

Customers can request their data in a machine-readable format so they can transfer it to another service. SeroBook's data export generates a structured JSON file that includes all customer data in a standardized format, making portability straightforward.

Right to Rectification

Customers can request corrections to inaccurate personal data. You can update any customer field directly from their profile page. Changes are logged in the audit trail so you have a record of what was corrected and when.

Right to Object

Customers can object to certain types of processing, such as marketing communications. SeroBook's email preference center lets customers manage their communication preferences, and all marketing emails include an unsubscribe link as required.

Consent Management

Managing consent properly is essential for GDPR compliance, especially for marketing and non-essential communications.

Booking Form Consent

Customize the consent checkboxes on your booking form under Settings > Booking Page > Consent:

• Terms and Conditions – Required checkbox linking to your terms of service
• Privacy Policy – Required checkbox acknowledging your privacy policy
• Marketing Communications – Optional checkbox for email marketing consent (must be unchecked by default under GDPR)
• SMS Notifications – Optional checkbox for SMS reminder and marketing consent

Consent Records

SeroBook automatically records:

• When consent was given (date and time)
• What the customer consented to (exact text shown)
• How consent was given (booking form, manual entry, import)
• When consent was withdrawn (if applicable)

You can view a customer's consent history on their profile page under the Privacy tab. This record is essential for demonstrating compliance if questioned by a data protection authority.

Cookie Policy

SeroBook uses cookies on your public booking page and the dashboard. Here's how cookies are categorized:

Essential Cookies

These are required for the platform to function and do not require consent:

• Session cookies for maintaining your login state
• CSRF tokens for security
• Load balancing cookies for performance

Analytics Cookies

Used to track booking page performance and conversion metrics. These require consent under GDPR:

• Page view tracking for conversion rate calculation
• Session duration and interaction tracking
• Referral source identification

Cookie Consent Banner

SeroBook includes a built-in cookie consent banner for your public booking page. Enable and customize it under Settings > Booking Page > Cookie Consent. The banner:

• Appears on the first visit before any non-essential cookies are set
• Allows visitors to accept or decline analytics cookies
• Remembers the visitor's preference for subsequent visits
• Can be customized with your brand colors and text

Data Processing Agreements

GDPR requires a data processing agreement (DPA) between data controllers (you) and data processors (SeroBook). Our DPA is available and covers:

• Scope of processing – Exactly what data SeroBook processes and for what purposes
• Security measures – The technical and organizational measures we implement to protect data
• Sub-processors – A list of third-party services that may process data on our behalf (payment processors, email delivery, hosting)
• Data location – Where data is stored and processed geographically
• Breach notification – Our commitment to notify you within 72 hours of a confirmed data breach
• Data return and deletion – Procedures for returning or deleting your data when the agreement ends

Download the DPA from Settings > Privacy > Data Processing Agreement. The agreement is pre-signed by SeroBook and takes effect when you countersign and return it.

Privacy Policy Template

SeroBook provides a customizable privacy policy template that covers common booking-related data processing activities. You can use this as a starting point for your own privacy policy:

1. Navigate to Settings > Privacy > Privacy Policy Template
2. Review the template content, which covers:
   • What personal data is collected (name, email, phone, booking details)
   • Why data is collected (service delivery, communication, analytics)
   • How data is stored and protected
   • Third parties with whom data may be shared
   • Customer rights and how to exercise them
   • Cookie usage and consent
   • Contact information for data protection queries
3. Customize the template with your business details, specific services, and any additional processing activities
4. Publish the policy to your booking page or copy it to your website

International Data Transfers

If your business or customers are located outside the region where SeroBook processes data, you should be aware of international transfer safeguards:

• EU-US Data Privacy Framework – SeroBook complies with applicable EU-US data transfer mechanisms
• Standard Contractual Clauses (SCCs) – Our DPA includes the latest EU-approved SCCs for international transfers
• Data residency options – Pro plan customers can choose their primary data region (US or EU) to keep data closer to their customers
• Transfer impact assessments – We maintain transfer impact assessments for each country where sub-processors operate

Next Steps

Now that you understand privacy and GDPR compliance:

• Review the platform security overview
• Configure user permissions and access controls
• Learn about data exports and retention