Privacy policy

This policy explains how PORTUM VICTORIA ("we") processes personal data as a controller: on the website ubooq.com, in the contact form and in the admin of the businesses that use ubooq.

Did you book an appointment with a business? That business is responsible for the data you entered on its booking page, and we process it only on its behalf. See Data of businesses' customers.

Who we are

The controller is PORTUM VICTORIA, Ćikovići, Novo naselje 36c 51215 Kastav, OIB u postupku dodjele. For any question about personal data, and to exercise your rights, write to hello@ubooq.com.

Visiting the website

This site uses no cookies and no tracking tools. It loads nothing from other servers: fonts, images and scripts come from our own address. If you choose light or dark mode, your browser keeps that choice on your device (in its local storage) and never sends it to us. Choosing "System" deletes it.

We count page views as a sum per day: the page, the language and where you came from (the domain of the page you came from, a search engine or a campaign tag in the address). For this, your browser sends our server the address of the page you opened and the domain you came from, but not the rest of those addresses (such as what you typed into the help search). We store no IP address, browser details or identifier with the numbers, so we cannot link a visit to you or to another visit. We do not count businesses' booking pages.

When you open a page, your browser sends our server your IP address and technical details of the request, without which we cannot send you the page. We do not store the IP address, neither in the database nor in the system logs. To prevent abuse, the server counts requests per network in its working memory, for example how many messages were sent from the same network within an hour. These counters delete themselves after an hour at the latest.

On businesses' pages we count clicks on the "Powered by ubooq" credit, but only as a number per day, without the IP address, browser details or cookies.

The legal basis is our legitimate interest in a working and secure website and in knowing which pages are read (Article 6(1)(f) GDPR).

Contact form

When you write to us through the contact form, we store what you enter: whether you write as a new business or an existing user, your name, the business's name and type, your email address, your phone number if you enter one, your message and the page's language. We do not store your IP address or browser details with it.

We use this data only to answer you and, if you wish, to prepare an offer. The legal basis is taking steps at your request before entering into a contract (point (b)) and our legitimate interest in answering your message (point (f)).

Your message reaches our administrators by email. We send no automatic reply. We delete the message 12 months after we have handled it.

A business's admin

For the owners and staff of businesses that use ubooq, we process:

• the account: name, email address, password (stored only as an argon2id hash, never readable), role, language and appearance of the interface, and the time of the last login;
• the login: the session (only a hash of its token is stored), the address it was opened on, the browser's name, and when it started and was last used;
• a cookie: one strictly necessary cookie that keeps you logged in. There are no other cookies;
• work in the calendar: what the business enters about a staff member (name, working hours, time off and appointments) and who made which change to an appointment;
• emails we send you: the invitation, password reset links and the work notices the business turns on.

The legal basis is the contract with the business you work for (point (b)) and the business's and our legitimate interest in an admin that works and is secure (point (f)).

A session lasts at most 30 days and ends after 7 days without use; we then delete it. A password reset link is valid for an hour and an invitation for 7 days; we delete them when they expire. The account exists while the business uses ubooq. The business can turn off your access, and we delete the account, with the rest of the business's data, within 30 days after the contract with the business ends.

We keep the data needed for the contract and billing (the business's name, OIB, address and invoices) for as long as accounting and tax law requires.

Data of businesses' customers

When a customer books an appointment, joins a waiting list or is entered in a business's calendar, that business is the controller of the data. The business decides which data it asks for, how long it keeps it and who it shares it with, and publishes its privacy policy or notice next to its booking form. We process this data only on the business's behalf, under the data processing agreement.

To access, correct or erase your data, contact the business you booked with. If you contact us instead, we will forward your request to that business.

Who receives data

We do not sell data and do not use it for advertising. We share it only with the processors without which the service cannot work:

Processor	What it does	Where
netcup GmbH	server, database and backups	European Union
Amazon Web Services EMEA SARL (Amazon SES)	sending emails	European Union
Resend, Inc.	sending emails	USA
Cloudflare, Inc.	DNS and receiving mail at our contact address	USA and European Union

We have data processing agreements with our processors. Transfers to the USA rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

We give data to public authorities only where the law requires us to.

How long we keep data

Data	Period
Request counters per network	an hour at most, in working memory only
Page views per day (without any identifier)	25 months
Contact form messages	12 months after they were handled
Admin sessions	until they expire: 30 days at most, or 7 days without use
Password reset links and invitations	until they expire: an hour or 7 days
Admin accounts	while the contract with the business lasts; deleted within 30 days after it ends
Contract and billing data	as long as accounting and tax law requires

Every night we back up the database and keep each backup for 14 days. Deleted data therefore leaves the backups within 14 days of being deleted.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability and to object to processing (Articles 15 to 21 GDPR). Write to us at hello@ubooq.com. We answer within one month at the latest.

If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop.hr, or with the supervisory authority where you live.

Security

• All traffic to our addresses goes over HTTPS.
• Passwords are stored as argon2id hashes, and session and link tokens only as hashes.
• Each business's data is kept apart in the database, so that no other business can access it.
• The system logs contain no names, email addresses or phone numbers.

We make no decisions based solely on automated processing and do no profiling.

Changes

When we change this policy, we publish the new version on this page with the date of the last change. We tell admin users about significant changes by email.