Privacy Policy
1. Who is responsible for personal data
1.1. Where it determines the purposes and means of processing for its own activities, the data controller is Revox Software LTD, Bulgarian UIC 204101301, registered address 203 Storgozia, Northern Industrial Zone, 5802 Pleven, Bulgaria, privacy contact [PRIVACY_EMAIL] (“CocoBook”, “we”). No data protection officer has been appointed; privacy questions go to the privacy contact above.
1.2. This Policy covers the main cocobook.app website, CocoBook applications, subscription and customer-relationship activities, and processing carried out by CocoBook as an independent controller. It also explains some activities where CocoBook processes data on behalf of Customers.
2. Roles relating to customer properties
2.1. CocoBook generally acts as controller for account registration, subscriptions, support, platform security and its own analytics.
2.2. Where the Customer determines why guest records, bookings, calendars, team tasks, notes or enquiries are processed and who can access them, the Customer is generally the controller and CocoBook provides infrastructure as a processor under a data processing agreement (“DPA”).
2.3. For enquiries sent through a Customer’s hosted property page, the person offering the property generally determines the purpose of collecting the form data and is the controller. CocoBook may technically receive, store or forward the information, without negotiating or confirming reservations. Visitors should also read the specific Customer’s privacy notice shown on that property website.
2.4. Where CocoBook uses limited data for separate lawful purposes, such as security, preventing abuse or complying with legal duties, it may independently act as controller for that processing. Legal roles depend on actual activities, not contractual labels alone.
3. Categories of information
3.1. Accounts and teams: name, email, user ID, language, settings, access role, invitations, permissions and proportionate activity history.
3.2. SaaS billing: plan, orders, invoices, billing contact information and payment status; payment-method metadata only to the extent actually provided by the chosen payment service provider. CocoBook does not process accommodation payments.
3.3. Customer workspace data: properties, rooms, parking spaces, prices, photos, guest lists, internal booking records, tasks, notes, contact information, calendar entries and metadata obtained through Customer-enabled integrations (such as iCal). This data is generally processed on the Customer’s behalf.
3.4. Public sites and directory: descriptions, photos, locations, contact details, outbound links and availability data deliberately selected by the Customer for publication. Such information becomes publicly available only after relevant Customer settings are enabled.
3.5. Enquiries: name, email, phone number (where requested), preferred dates, number of guests, message and necessary routing/technical metadata. Exact fields depend on the Customer’s form.
3.6. Technical information: IP address, device and session identifiers, browser, operating system, timestamps, diagnostics, security events, cookies and similar technologies.
3.7. Communications with CocoBook: support requests, illegal-content notices, correspondence and feedback. Notifications: push notification tokens and preferences where applicable.
3.8. Please do not enter special-category personal data (such as health, religious or biometric information) into open text fields unless an appropriate lawful basis and safeguards exist. The Platform does not require this information as a standard feature.
4. Purposes and legal grounds
4.1. Account creation, authentication and delivery of subscriptions: Article 6(1)(b) GDPR (contract); depending on the situation, business-contact details may be processed under legitimate interests, Article 6(1)(f).
4.2. Invoicing, accounting and legal compliance: Article 6(1)(c) GDPR (legal obligation).
4.3. Security, abuse prevention, diagnostics and legal claims: Article 6(1)(f) GDPR (our legitimate interests in maintaining a reliable and secure service).
4.4. Support and responding to requests: Article 6(1)(b) and/or (f) GDPR, depending on the request and relationship.
4.5. Non-essential analytics or marketing cookies and electronic direct marketing: consent where required by applicable law; consent can be withdrawn using an equally accessible mechanism.
4.6. Legal-content notices and related compliance: Article 6(1)(c), and where relevant Article 6(1)(f) GDPR.
4.7. Guest, reservation and enquiry data processed for Customers: the Customer, acting as controller, identifies the applicable legal grounds; CocoBook processes such data according to documented instructions as processor.
5. Public disclosures and recipients
5.1. Customer pages and directory entries are publicly visible only if the Customer has enabled the relevant settings. Customers must not disclose guest data or other individuals’ information without an appropriate lawful basis.
5.2. As necessary, data may be shared with categories of service providers: cloud hosting, data storage and backup, email and notification providers, analytics services (if enabled), payment processors for SaaS subscription charges, accounting and legal advisers, and authorities where required by law.
5.3. Actual key processors/subprocessors, processing locations and purposes are listed at [SUBPROCESSOR_LIST_URL] or available on request at [PRIVACY_EMAIL]. The list must be confirmed against the actual production technology stack.
5.4. We do not sell personal data. Following a link to an external site is a separate action, and that website operator applies its own privacy terms.
6. Transfers outside the EEA
6.1. Where information is processed outside the European Economic Area, appropriate Chapter V GDPR mechanisms apply, such as adequacy decisions or standard contractual clauses together with any necessary supplementary safeguards.
6.2. Details of actual processing countries and safeguards are available at [SUBPROCESSOR_LIST_URL] or on request. We do not claim that all data is held within the EU until that is technically verified.
7. Retention periods
7.1. We retain personal data only as long as needed for each purpose. Account and contract information is generally kept during the active contractual relationship and for an additional period required for legal claims and statutory obligations.
7.2. Accounting and tax records are retained for mandatory legal periods. Diagnostic and security logs are retained according to an approved schedule and actual necessity: 1 year.
7.3. Data processed for Customers is kept according to their instructions, the DPA and selected product features. Following termination, Customer data may be exported and is returned or deleted within 1 year, unless retention is legally required. Backup copies are purged within 1 year.
7.4. Customer-site enquiries are retained according to Customer settings/instructions: 1 year.
8. Security
8.1. We apply risk-based technical and organisational safeguards, including appropriate role-based access, least privilege, secure transport, event logging, backups and vulnerability management, to the extent deployed in production.
8.2. No online service is perfectly secure. Where a personal-data breach occurs, we assess it and provide required notices to Customers/controllers, regulators and individuals under GDPR where the legal conditions are met.
9. Your data protection rights
9.1. Subject to legal conditions, you may request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests and withdraw consent without retroactive effect.
9.2. Send requests concerning CocoBook as controller to [PRIVACY_EMAIL]. We generally respond within one month, subject to permitted extensions. For data about a specific accommodation enquiry or booking, please contact the relevant Customer/controller first; CocoBook will support that Customer as required by law and the DPA.
9.3. You may complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg), another competent GDPR supervisory authority, and seek judicial redress.
9.4. CocoBook does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects unless such functionality is introduced and separately disclosed.
10. Cookies, analytics and local storage
10.1. Strictly necessary technologies support login, security, sessions, language preferences and the website’s core operation. Non-essential analytics, advertising and comparable technologies are used only with prior consent where applicable.
10.2. The cookie interface should offer equally accessible “Accept” and “Reject non-essential” controls, together with category settings. Consent can be withdrawn via [COOKIE_SETTINGS_LINK_OR_BUTTON].
10.3. Before publication, insert the actual cookie and SDK inventory: [TABLE: COOKIE/SDK NAME, PROVIDER, PURPOSE, CATEGORY, DURATION, FIRST/THIRD PARTY]. Unused technology must not be claimed and actual deployed tools must not be omitted.
10.4. Hosted Customer sites may have different integrations that the Customer adds or enables. Each Customer must provide the notices and consents required for the technologies for which it is controller.
11. Children, notifications and external services
11.1. CocoBook is not directed to independent users under 18. If you believe a child’s information is processed unlawfully, contact [PRIVACY_EMAIL].
11.2. Mobile push notifications, when enabled, may use a device token and services of the relevant mobile operating system. Notification permissions may be changed in device and application settings.
11.3. External websites and calendar providers process data according to their own policies. With iCal syncing, the Customer should recognise that a shared calendar URL may reveal availability or event information.
12. Updates and contact
12.1. We will publish updated versions with effective dates and notify users appropriately of material changes.
12.2. Privacy questions and requests: [PRIVACY_EMAIL], 203 Storgozia, Northern Industrial Zone, 5802 Pleven, Bulgaria. Current Policy: https://cocobook.app/privacy.