Privacy Policy

Last updated: November 5, 2026

1. Introduction

Net 'n' Design ("we", "us", or "our") respects your privacy and is committed to protecting the personal data of visitors to our website and users of BookyFlow.

This Privacy Policy explains what personal data we collect, how we use it, when we share it, and what rights you have under applicable data protection laws, including the General Data Protection Regulation (GDPR).

Data Controller

Net 'n' Design
Pergamou 124 26226 Patra, Greece
VAT ID: EL045904150

For privacy-related enquiries, please contact us through our Contact Form at https://bookyflow.com/contact.

2. Personal Data We Collect

The personal data we collect depends on how you interact with our website and BookyFlow.

2.1 Website Visitors

When you visit our website, certain technical information may be collected, including your IP address, browser type, device information, operating system, pages visited, referring URLs, and access timestamps. This information may be processed through server logs and security mechanisms to maintain the website's operation, security, and performance.

2.2 Contact and Support Requests

When you contact us through our contact form or request support, we may collect your name, email address, subject, message, and any additional information you voluntarily provide.

Our contact form uses a simple arithmetic question to help prevent automated and unwanted submissions. This mechanism does not require an external CAPTCHA service.

2.3 Orders, Licences, and Subscriptions

When you purchase a BookyFlow plan directly from Net 'n' Design, we collect and maintain information necessary to take and fulfil your order, issue and administer your licence, manage any subscription and renewal, provide support, prevent fraud or abuse, and meet our legal and accounting obligations. This may include your name, email address, billing details, purchased plan, licence status, subscription status, order reference and transaction status.

Payments are processed through EveryPay Payment Services Single Member S.A. ("EveryPay"). Payment card details are provided for processing through the EveryPay payment flow. Net 'n' Design does not need complete card details to administer a BookyFlow licence. We may receive transaction confirmations, references and limited payment information required to reconcile the order and activate your licence. We do not ask you to send card details through our contact or support form.

2.4 Licence Activation and Verification

BookyFlow is software installed and operated in the customer's own Joomla environment. When a licence is activated or verified, BookyFlow communicates with our server and transmits the following information: licence key, purchased plan, duration of the purchased plan, user's name, and the domain name associated with the licence.

We process this information to activate and verify licences, validate the domain associated with a licence, administer usage entitlements, and provide the functionality associated with the purchased plan.

2.5 Customer Websites

BookyFlow may be installed on websites operated by our customers. We do not routinely access or collect the personal data processed through those websites merely because BookyFlow is installed there.

Customers are responsible for their own websites, their data processing activities, and their compliance with applicable privacy laws. If a customer requests technical support and voluntarily provides relevant information, we process that information only as necessary to address the request. Our role for any personal data in a support request depends on the circumstances and the instructions and agreement with the customer.

3. How We Use Personal Data

We may use personal data:

• to operate, maintain, and secure our website and services;
• to process orders and administer BookyFlow licences and subscriptions;
• to activate and verify licences and apply plan-specific entitlements;
• to respond to enquiries and provide technical support;
• to communicate important information about purchases, licences, security, and service changes;
• to monitor website traffic and understand website usage through Google Analytics, subject to applicable consent requirements;
• to prevent fraud, abuse, unauthorised use, and security incidents;
• to comply with legal, accounting, tax, and regulatory obligations; and
• to establish, exercise, or defend legal claims where necessary.

We do not sell personal data to third parties.

4. Legal Bases for Processing

Where the GDPR applies, we process personal data on one or more of the following legal bases:

• Contract: where processing is necessary to fulfil a purchase, administer a licence, provide support, or take steps requested before entering into a contract.
• Legitimate interests: where necessary to secure our systems, prevent abuse, maintain our services, respond to business enquiries, and protect our legal interests, provided those interests do not override your rights and freedoms.
• Legal obligation: where processing is necessary to comply with applicable laws, including accounting and tax requirements.
• Consent: where you have given consent, including where required for non-essential cookies and analytics technologies or optional marketing communications.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Google Analytics and Cookies

Our website uses Google Analytics to understand how visitors interact with the website and to measure website traffic.

Google Analytics may collect information such as pages visited, session information, browser and device details, approximate location information, and online identifiers, depending on the configuration of the service.

We use a cookie consent mechanism on our website. Google Analytics and any associated non-essential cookies or similar technologies will be used in accordance with applicable consent requirements and the choices you make through that mechanism.

You can change your cookie preferences through the cookie settings available on our website, where provided. You can also manage cookies through your browser settings, although disabling certain cookies may affect website functionality.

For further information about how Google processes data, please consult the Google Privacy Policy. Information about the cookies and similar technologies used on our website may also be provided in a separate Cookie Policy, where applicable.

6. Payments and EveryPay

Net 'n' Design is the seller of BookyFlow. We use EveryPay Payment Services Single Member S.A. to process payment instructions and settle payments for orders placed with us. EveryPay is a payment service provider; it does not sell or licence BookyFlow and is not responsible for providing the software, updates or support.

EveryPay may collect and process payment, payer, transaction, device, verification and related information to execute and settle payments, prevent fraud, meet its regulatory duties, and provide its payment services. EveryPay describes itself as a data controller for personal data it processes for its own purposes and may act in a different role for particular processing under the applicable merchant agreement. Net 'n' Design separately processes the order and transaction information needed to fulfil the purchase, issue the licence and meet its own obligations.

For further information about EveryPay's processing, see its Privacy Policy and the payment information shown in the checkout. We do not use purchaser information received through the payment process for unrelated marketing purposes without an appropriate legal basis and, where required, your consent.

7. How We Share Personal Data

We may share personal data, where necessary and appropriate, with:

• EveryPay: to initiate, process and settle payment transactions, reconcile orders, manage refunds and prevent payment fraud. EveryPay processes personal data under its own privacy notice and the applicable merchant agreement; its role may depend on the processing purpose.
• Hosting and infrastructure providers: to host and maintain our website, server, and related services.
• Communication providers: to deliver and manage business emails and support communications.
• Analytics providers: including Google Analytics, subject to applicable consent requirements.
• Security and anti-abuse services: where necessary to protect our website and services.
• Professional advisers: such as accountants, lawyers, and other advisers where necessary.
• Public authorities and legal entities: where disclosure is required by law or necessary to protect our legal rights.

Where a provider processes personal data solely on our documented instructions, we require appropriate contractual and security safeguards. This statement does not apply to EveryPay's independent processing for its own payment, regulatory, fraud-prevention or security purposes.

8. Data Storage and International Transfers

Our website and related services are hosted on a server managed by Net 'n' Design within the European Union.

Personal data is retained only for as long as reasonably necessary for the purposes described in this Privacy Policy, including the fulfilment of contractual obligations, the provision of support, the maintenance of security records, and compliance with legal requirements.

EveryPay and other third-party providers may process personal data in locations determined by their services and contractual arrangements. Where Net 'n' Design transfers personal data outside the European Economic Area, we will use an appropriate transfer mechanism or safeguard where required by data protection law. For information about EveryPay's own processing locations and safeguards, consult its privacy notice and applicable terms.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required or permitted by law. Retention periods depend on the type of information and the relevant purpose. For example:

• contact and support correspondence may be retained for as long as needed to resolve enquiries and maintain relevant support records;
• licence and order records may be retained for the duration of the customer relationship and thereafter as necessary for legal, accounting, tax, and dispute-resolution purposes;
• technical and security logs may be retained for a limited period appropriate to security, troubleshooting, and operational requirements; and
• analytics data is retained according to the applicable Google Analytics configuration and retention settings.

When personal data is no longer required, we will take reasonable steps to delete it or otherwise dispose of it securely, subject to applicable legal obligations.

10. Data Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

However, no method of transmission or electronic storage can be guaranteed to be completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect the information we process.

11. Your Data Protection Rights

Subject to the conditions and limitations set out in applicable law, you may have the right to request access to your personal data; request correction of inaccurate or incomplete personal data; request deletion; request restriction of processing; object to processing based on legitimate interests; request data portability where applicable; withdraw consent where processing is based on consent; and lodge a complaint with a competent data protection supervisory authority.

To exercise your rights regarding data controlled by Net 'n' Design, please contact us through our Contact Form. We may need to verify your identity before responding. For data controlled by EveryPay for its own purposes, contact EveryPay using the details in its Privacy Policy.

If you are in Greece, you may contact the Hellenic Data Protection Authority. You may also contact the supervisory authority competent for your place of residence or work, where applicable.

12. Marketing Communications

We may send service-related communications necessary to administer purchases, licences, subscriptions, security matters, and support requests.

We will send optional marketing communications only where we have an appropriate legal basis and, where required, your consent. You may unsubscribe from marketing emails at any time using the unsubscribe mechanism provided or by contacting us.

We do not treat the provision of contact details for a purchase or support request as automatic consent to unrelated marketing.

13. Children's Privacy

BookyFlow is a business software product and is not directed at children. We do not knowingly collect personal data directly from children in circumstances where parental consent or other legal authorisation is required.

If you believe that a child has provided us with personal data unlawfully, please contact us so that we can assess the situation and take appropriate action.

14. Third-Party Websites

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices, content, or security of third-party websites. We encourage you to review their privacy policies before providing personal data.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, data processing practices, or legal requirements. The latest revision date will be displayed at the top of this page. Where required by law, we will provide additional notice of material changes.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights regarding personal data controlled by Net 'n' Design, please contact:

Net 'n' Design
Pergamou 124 26226 Patra, Greece
VAT ID: EL045904150
Contact form: https://bookyflow.com/contact