Privacy Policy

1. Introduction

At Naksti, operated by Sobrio OÜ (registry code: 17374940), we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our booking management platform.

We comply with the EU General Data Protection Regulation (GDPR) and Estonian data protection laws. By using Naksti, you agree to the collection and use of information in accordance with this policy.

2. Data Protection Roles

For the purposes of data protection laws, Sobrio OÜ acts as the data controller for personal data processed in connection with the operation of the Naksti website, account registration, billing, communications, and service usage analytics.

For personal data processed on behalf of Customers through the Naksti platform (such as your clients' booking data), Sobrio OÜ acts as a data processor, as further described below and governed by the Data Processing Agreement (DPA).

3. Information We Collect

3.1 Account Information (Business Users)

When you register for a Naksti account, we collect:

• Name and email address
• Business name and contact information
• Password (stored using bcrypt hashing — we never store plaintext passwords)
• Business profile information (optional)
• Billing information (for paid plans — processed by our payment providers, not stored on our servers)

3.2 Client Data (Processed on Your Behalf)

When your clients book through your Naksti booking page, the following data may be collected:

• Client name, email address, and phone number
• Booking details (service, date, time, location)
• Additional information required for the service (as configured by you)
• Booking notes and communication history

Important: For client data, you act as the data controller, and we act as the data processor. You are responsible for obtaining necessary consents from your clients and providing them with appropriate privacy notices.

Such processing is governed by our Data Processing Agreement (DPA), which forms an integral part of the Terms and Conditions.

3.3 Usage Information

We automatically collect certain information about your use of the Service:

• Device information (browser type, operating system, screen resolution)
• IP address and general geographic location (country/region level)
• Pages visited and features used
• Date, time, and duration of access
• Referring website addresses
• Error logs and performance data

3.4 Cookies and Tracking Technologies

We use cookies and similar technologies to ensure platform functionality, maintain session information, and improve user experience. See Section 10 below for full details on the cookies we use and how to manage them.

4. How We Use Your Information

We use your information for the following purposes:

4.1 Service Provision

• Create and manage your account, booking pages, and widgets
• Process bookings and send automated notifications (confirmations, reminders, cancellations)
• Synchronize with Google Calendar and Google Meet when you enable these integrations
• Process payments through Maksekeskus or Stripe
• Provide customer support

4.2 Service Improvement

• Analyze usage patterns to improve features and user experience
• Troubleshoot technical issues and monitor platform performance
• Develop new features and services

4.3 Communication

• Send important service updates and security notifications
• Respond to your inquiries and support requests
• Send billing, subscription, and payment-related information
• Send promotional emails (only with your consent; you can opt out at any time via the unsubscribe link in each email)

4.4 Security and Legal Compliance

• Comply with legal obligations and regulatory requirements
• Enforce our Terms & Conditions
• Detect, prevent, and respond to fraud, abuse, or security incidents
• Protect the rights, property, and safety of Sobrio OÜ and its users

5. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds under Article 6(1) of the GDPR:

• Contract Performance (Art. 6(1)(b)): To provide the services you've signed up for, manage your account, process bookings, and handle billing.
• Legitimate Interests (Art. 6(1)(f)): To improve our services, ensure platform security, prevent fraud, provide customer support, and conduct analytics. We balance our interests against your rights and freedoms.
• Legal Obligation (Art. 6(1)(c)): To comply with applicable laws and regulations, including accounting and tax requirements.
• Consent (Art. 6(1)(a)): For marketing communications and non-essential cookies. You can withdraw consent at any time without affecting the lawfulness of processing performed prior to withdrawal.

6. Data Storage and Security

6.1 Data Storage Location

Your data is stored on secure servers provided by Hetzner Online GmbH, located in Germany and Finland within the European Union. This ensures full compliance with GDPR and EU data protection standards. No primary data is stored outside the EU/EEA.

6.2 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption of data in transit (TLS 1.2+) and at rest
• Secure password storage using bcrypt hashing
• Regular security updates and vulnerability patching
• Role-based access controls and authentication
• Regular encrypted backups
• Firewall protection and network-level security
• CSRF protection and input validation
• Rate limiting and abuse prevention (Google reCAPTCHA)

While we take all reasonable measures to protect your data, no system is completely secure. You are responsible for keeping your account credentials confidential and for notifying us immediately of any suspected unauthorized access.

7. Data Sharing and Third Parties

We do not sell your personal data. We only share data with third parties as necessary to provide the Service, as described below:

7.1 Service Providers (Sub-processors)

• Hetzner Online GmbH (Germany/Finland) — Data hosting and server infrastructure
• Maksekeskus AS (Estonia) — Payment processing for Estonian bank links
• Stripe Technology Europe Ltd (Ireland) — Payment processing for credit/debit card recurring subscriptions
• Google LLC — Calendar synchronization (Google Calendar) and video conferencing (Google Meet), only when you enable these integrations
• Mailgun Technologies Inc (USA) — Transactional and notification email delivery
• Google reCAPTCHA — Abuse prevention and bot detection on booking forms and registration

A complete list of sub-processors is available in our Data Processing Agreement (DPA).

7.2 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or if necessary to protect the rights, property, or safety of Sobrio OÜ, its users, or the public.

7.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the acquiring entity. We will notify you by email and/or through the Service of any such transfer and of any changes to applicable terms or data processing practices.

8. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• Active accounts: Data is retained for the duration your account remains active.
• Closed accounts: Data is retained for 30 days after account closure, during which you may request a data export. After 30 days, data is permanently deleted from active systems. Backup copies are purged within 90 days of account closure.
• Billing records: Retained for 7 years as required by Estonian accounting laws (Accounting Act).
• Server logs: Automatically deleted after 90 days.
• Legal compliance: Some data may be retained longer if required by law or to establish, exercise, or defend legal claims.

You can request earlier deletion of your data by contacting us at [email protected], subject to mandatory legal retention requirements.

9. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data. These rights apply to data for which Sobrio OÜ acts as the data controller. For data where you are the data controller (your clients' data), you are responsible for handling data subject requests from your clients.

9.1 Right of Access

You can request a copy of the personal data we hold about you in a commonly used, machine-readable format.

9.2 Right to Rectification

You can update or correct inaccurate or incomplete data through your account settings or by contacting us.

9.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data, subject to mandatory legal retention requirements (e.g., accounting records).

9.4 Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances, for example, while we verify the accuracy of your data or assess an objection.

9.5 Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format (e.g., CSV, JSON) and have the right to transmit that data to another service provider.

9.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. If you object to direct marketing, we will stop processing your data for that purpose immediately.

9.7 Right to Withdraw Consent

Where we rely on consent as the legal basis for processing (e.g., marketing emails), you can withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. See Section 14.1 for details of the relevant authority.

9.9 How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will verify your identity and respond within 30 days. In complex cases, we may extend this period by an additional 60 days, in which case we will inform you of the extension and the reasons within the initial 30-day period. There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.

10. Cookies and Tracking

10.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website or use our platform. They help us recognize you, maintain your session, and remember your preferences.

10.2 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the platform to function properly. These include session management, authentication (login), CSRF protection, and language preference tokens. These cookies cannot be disabled as they are essential for the Service to operate. Legal basis: Legitimate interest / contract performance.
• Functional Cookies: Remember your preferences and settings to enhance your experience (e.g., timezone, display preferences). Legal basis: Legitimate interest.
• Security Cookies: Used by Google reCAPTCHA to protect forms from automated abuse and bot submissions. Legal basis: Legitimate interest (security).

Note: We do not currently use analytics or advertising cookies. If this changes in the future, we will update this policy and obtain your consent where required.

10.3 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies may prevent the platform from functioning correctly, and you may not be able to log in or use core features.

11. International Data Transfers

Your data is primarily stored in the EU (Germany and Finland). However, some third-party services may process data outside the EU/EEA:

• Stripe: Stripe Technology Europe Ltd is based in Ireland. Where data is transferred outside the EU/EEA, Stripe relies on Standard Contractual Clauses (SCCs) approved by the European Commission.
• Google (Calendar, Meet, reCAPTCHA): Google complies with the EU-US Data Privacy Framework. Where applicable, Google also relies on SCCs.
• Mailgun: Mailgun Technologies Inc is based in the USA. Data transfers are protected by Standard Contractual Clauses (SCCs) and supplementary security measures.

We ensure that appropriate safeguards are in place for all international data transfers in accordance with Chapter V of the GDPR. You may request further details about these safeguards by contacting us at [email protected].

12. Children's Privacy

Our Service is a B2B platform not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a person under 18, please contact us immediately at [email protected], and we will take steps to delete such data promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by email and/or through a prominent notice on our platform at least 30 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Service after the updated policy takes effect constitutes your acceptance of the changes.

14. Contact Us

If you have questions about this Privacy Policy, how we handle your data, or wish to exercise your data protection rights, please contact us:

14.1 Supervisory Authority

If you are not satisfied with our response to your data protection concern, you have the right to lodge a complaint with a data protection supervisory authority. In Estonia, the competent authority is:

If you are located in another EU/EEA member state, you may also lodge a complaint with the supervisory authority in your country of residence.