CONTENTS
- 1. Who is responsible
- 2. Two situations to tell apart
- 3. What we process, and why
- 4. We do not sell your data
- 5. Our providers
- 6. What the plugin sends to our servers
- 7. Transfers outside the European Union
- 8. Your rights
- 9. Security
- 10. Your visitors’ data stays with you
- 11. Cookies
- 12. Minors
- 13. Complaints
- 14. Changes
- 15. Contact
This policy explains what personal data we process, why, for how long, and what your rights are. It covers the bookingleads.pro website, the shop and customer area running on sdravobiz.com, and the BookingLeads WordPress plugin.
It is written under Regulation (EU) 2016/679 (“GDPR”), Legea nr. 190/2018 and Legea nr. 506/2004.
1. Who is responsible
Sdravobiz S.R.L.
Strada Trandafirilor 51, 307220 Giroc, Romania
CUI: RO51472367 — EU VAT: RO51472369
Registrul Comerțului: J2025016522009
Email: contact@sdravobiz.com
Sdravobiz is not required to appoint a data protection officer under article 37 of the GDPR: its activity involves neither large-scale processing of sensitive data nor large-scale systematic monitoring of individuals.
Any request can be sent to contact@sdravobiz.com, with “GDPR” in the subject line.
2. Two situations to tell apart
This is the most important point in this policy, and it is also the main difference between BookingLeads and an online service.
Your own data, as a customer or a visitor to our site. We are the controller for it: account, order, invoice, licence, support, newsletter. That is what articles 3 to 9 are about.
The data of the people who fill in your access screen. It is recorded in the database of your WordPress site, on your hosting. It passes through none of our servers, is never sent to us and is not accessible to us. You are the sole controller for it, and we are neither controller nor processor. That is what article 10 is about.
3. What we process, and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Order, licence and invoicing — account creation, performance of the contract, invoices, accounting obligations | Surname, first name, company, address, email, VAT number, order and invoice history, licence key | Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c) | Term of the contract, then 10 years under Legea nr. 82/1991 |
| Activation management — checking that the licence is valid, counting sites, delivering updates | Licence key, addresses of activated sites, product identifier, version installed, activation and check dates | Performance of the contract (art. 6.1.b); legitimate interest in protection against unauthorised use (art. 6.1.f) | Term of the licence, then 3 years |
| Payments — collection, fraud prevention, disputes and refunds | Billing details, transaction history and identifiers | Performance of the contract (art. 6.1.b); legitimate interest in fraud prevention (art. 6.1.f) | 10 years (accounting obligations) |
| Service emails — confirmation, invoice, licence key, availability of an update, renewal date, security incident | Name, email, account identifier | Performance of the contract (art. 6.1.b) | Term of the contract, then statutory archiving |
| Support and customer relations | Name, email, content of exchanges, screenshots and environment reports you send us | Performance of the contract (art. 6.1.b); legitimate interest for prospects (art. 6.1.f) | 3 years after the last exchange (customers); 13 months (prospects) |
| BookingLeads community — access to the peer support area, posts and replies | Display name, email, content of the messages posted | Performance of the contract (art. 6.1.b); consent for publication (art. 6.1.a) | Duration of participation, then 12 months |
| Newsletter and product news | Name, email, language, opens and clicks | Legitimate interest (art. 6.1.f) for customers, regarding a similar product, and for professionals who write to us through the contact form, about their business; consent (art. 6.1.a) in other cases | Until you unsubscribe, in one click from any email, and at the latest 3 years after the last interaction |
| Site audience measurement | Anonymised IP address, pages viewed, time spent, traffic source, device and browser | Consent (art. 6.1.a) for non-essential cookies; legitimate interest for anonymised measurement | 14 months |
| Legal obligations and litigation | Invoices, supporting documents, connection data | Legal obligation (art. 6.1.c); legitimate interest in defending legal claims | Applicable statutory period |
We take no fully automated decisions producing legal effects concerning you, and we do not carry out advertising profiling.
4. We do not sell your data
Sdravobiz does not sell, rent or transfer your personal data to third parties for commercial purposes.
Your data is disclosed only to the providers listed in article 5, to the competent administrative or judicial authorities upon a lawful request, and to our advisers in the event of legal proceedings.
5. Our providers
We use processors within the meaning of article 28 of the GDPR, chosen for the guarantees they offer. This list may change.
| Provider | Role | Location | Transfer safeguards |
|---|---|---|---|
| Stripe Payments Europe, Ltd | Online payment, fraud prevention | Ireland (EU), servers in the United States for the group | Standard contractual clauses + EU-US Data Privacy Framework |
| o2switch | Hosting of the site, the shop, the customer area and the licence server | France (EU) | No transfer outside the EU |
| Shop, licences and customer area (self-hosted) | Orders, subscriptions, licence keys, activations, invoices | France (EU) | Not applicable — self-hosted |
| Contact management and emails (self-hosted) | Service emails, newsletter | France (EU) | Not applicable — self-hosted |
| Support and community (self-hosted) | Support tickets, peer support area for users | France (EU) | Not applicable — self-hosted |
| Google Ireland Ltd (Analytics, Search Console) | Audience measurement and search ranking monitoring | Ireland (EU), servers in the United States | Standard contractual clauses + EU-US Data Privacy Framework |
| Accountant and legal advisers | Accounting and legal obligations | Romania | Service contract, confidentiality clause |
None of these providers has access to the data you collect with the plugin on your own site.
6. What the plugin sends to our servers
The plugin installed on your site talks to our licence server in three situations: when you activate a key, when you deactivate it, and during periodic checks or update lookups.
On each of those occasions, and only on those occasions, your site sends exactly the following:
- the product identifier;
- your licence key;
- your site’s address;
- the version number of the plugin installed;
- a single-use random value, to prevent the reply being replayed.
And nothing else. In particular, the following are never sent: your leads’ data, their email addresses, their answers, their IP addresses, your statistics, your questions, your settings, your site’s content, your administrator email address, your PHP or WordPress version, the list of your plugins.
The plugin contains no telemetry, no usage statistics reporting and no call home on installation. The diagnostics screen shows a description of your technical environment: that description stays on your site and is only sent if you copy it into a message to support yourself.
Exchanges with your contact management system, your webhook endpoints, your team chat channels and your external calendars go from your server to the destinations you entered yourself. They pass through none of the Publisher’s servers.
7. Transfers outside the European Union
Our customer data is hosted in the European Union. The only transfers that may take place outside the European Economic Area concern our payment provider and our audience measurement tools, whose groups have infrastructure in the United States.
These transfers are covered by the safeguards in chapter V of the GDPR: an adequacy decision where one exists (notably the EU-US Data Privacy Framework) and standard contractual clauses adopted by the European Commission. A copy of these safeguards can be obtained on request at contact@sdravobiz.com.
The data you collect with the plugin is not transferred by us at all, since it never reaches us.
8. Your rights
You have the following rights (articles 15 to 22 of the GDPR):
- access: to know whether we process data about you and to obtain a copy of it;
- rectification: to have inaccurate or incomplete data corrected;
- erasure: to have it deleted, within the limits of our statutory retention obligations;
- restriction: to temporarily restrict processing;
- portability: to receive your data in a structured, machine-readable format;
- objection: to object to processing based on legitimate interest, and without condition to direct marketing;
- withdrawal of consent at any time, without affecting the lawfulness of earlier processing;
- post-mortem instructions on what becomes of your data;
- complaint to a supervisory authority (article 13).
How to exercise them. By email to contact@sdravobiz.com (subject “GDPR”) or by post to our registered office. To guard against fraudulent disclosure, we may ask for proof of identity. We reply within one (1) month, which may be extended by two months where the request is complex or where there are many of them (article 12.3 of the GDPR).
If you filled in the access screen on the site of a business using BookingLeads and want to exercise your rights over that information, contact that business directly: it alone is the controller, and it alone holds that data. We have no access to it and so can neither send it to you nor erase it.
9. Security
We put in place the appropriate technical and organisational measures required by article 32 of the GDPR, in particular: encrypted connections (HTTPS/TLS), payments handled by a PCI-DSS Level 1 certified provider, strict access control and strong authentication for administrator accounts, access logging, regular backups, continuous security updates, and contractual confidentiality undertakings with our processors.
The update archives served by our server are sealed and cryptographically signed, and their signature is checked by your site before installation.
No system can guarantee absolute security. In the event of a data breach likely to create a risk to your rights and freedoms, we notify the ANSPDCP within seventy-two (72) hours and inform you directly where the risk is high (articles 33 and 34 of the GDPR).
10. Your visitors’ data stays with you
This article is addressed to you, the customer, about the people who fill in the access screen installed on your site.
10.1 You are the sole controller
This data is recorded in tables in your own WordPress database, on your own hosting. We do not receive it, do not host it, do not look at it and cannot restore it.
You alone determine the purposes and means of the processing. It is up to you to inform your visitors, to set your legal bases and your retention periods, to publish your own privacy policy, to collect the necessary consents and to answer requests to exercise rights. On this data we are neither controller nor processor: we supply you with software, not a processing service.
10.2 What the plugin records on your site
So that you can reuse it word for word in your own policy, here is what is recorded when a visitor fills in the access screen:
- their identity and contact details: first name, surname, email address, phone number where it is asked for;
- the country and time zone inferred from their browser;
- their answers to the questions you wrote, and the resulting score;
- the page they were on;
- their IP address, recorded in full and untruncated;
- where they came from: campaign parameters, advertising click identifiers, landing page and referring site;
- proof of their consent: the exact text shown to them, its fingerprint, the date and the way it was collected;
- the sales follow-up you then enter: appointment, attendance, sale, amount, notes and activity log.
The plugin also keeps aggregated daily counters — screens seen, forms started — which contain nothing that could identify a person.
10.3 What the plugin gives you
- An exporter and an eraser registered with WordPress’s built-in tools: the export and erasure requests you handle from the “Tools” screen of your site automatically include leads.
- A configurable retention period, beyond which leads are purged automatically every day.
- A suggested privacy policy text, added to the WordPress privacy policy screen, which you can reuse and adapt.
- Complete erasure on uninstall, if you choose that option.
Please note: the retention period is set by default to a value that triggers no purge at all. Unless you act, leads — IP addresses included — are kept indefinitely. Set this value as soon as you install the plugin.
10.4 What you need to do
- Describe in your privacy policy the data listed in 10.2, its purposes, its legal bases and its retention periods.
- Show a clear consent text before anything is recorded, and keep it as it is: that is the text archived as proof.
- Declare in your cookie policy the attribution cookie described in article 11.3, and make it subject to consent if it is used for advertising purposes.
- Do not ask questions that call for sensitive data within the meaning of article 9 of the GDPR, nor for bank details, nor for government identifiers.
- Check that your follow-up emails comply with the rules on electronic marketing.
- Check what the contact management system you copy this data into does with it: that copying is processing you answer for.
10.5 The one case where we see your data
If, as part of support, you send us a screenshot, an export or access to your site, we may be exposed to your visitors’ data. We then act as processor, on your specific and documented instruction, for only as long as it takes to handle your request. These items are deleted when the ticket is closed, and at the latest within the three (3) years for which support exchanges are kept.
We recommend that you anonymise your screenshots before sending them to us.
11. Cookies
11.1 On our site
| Category | Tool | Purpose | Duration | Legal basis |
|---|---|---|---|---|
| Strictly necessary | WordPress session (wordpress_*) | Sign-in to the customer area, security | Session / 30 days | Legitimate interest — no consent needed |
| Strictly necessary | Basket and order | Keeping the order in progress | Session | Legitimate interest — no consent needed |
| Strictly necessary | Language preference (pll_language) | Display language | 12 months | Legitimate interest — no consent needed |
| Audience measurement | Google Analytics (_ga, _ga_*) | Anonymised statistics | 13 months | Consent |
| Functional / marketing | Email tracking (fcrm_*) | Opens and clicks on our emails | 12 months | Consent |
On your first visit, a banner lets you accept, refuse or configure the cookies that are not strictly necessary. You can change your preferences at any time through the “Manage my cookies” link at the bottom of every page. Refusing non-essential cookies does not stop you accessing the site or reading its content.
11.2 What the plugin stores on your visitors’ devices
On our customers’ sites, the plugin stores the following in visitors’ browsers. They are set by your site, under your domain name, and it is for you to declare them.
| Name | Type | Purpose | Duration |
|---|---|---|---|
bkl_gate_… | Signed cookie, not readable by JavaScript | Remembering that the visitor has passed the access screen, so they do not have to start again and so their booking can be matched to their record | Configurable, 12 hours by default |
bkl_attr | Cookie set by the browser | Remembering where the visit came from: campaign parameters, advertising click identifiers, landing page and referring site | 90 days |
bkl_pulse_… | Session storage | Not counting the same visit twice in the statistics | Until the tab is closed |
bkl_lift_… | Session and local storage | Remembering that an invitation has already been shown or dismissed | Configurable duration, cleared automatically |
11.3 The case of the attribution cookie
The bkl_attr cookie keeps the origin of the visit for 90 days. Used to measure where your leads come from, it counts as audience measurement; used to steer advertising campaigns, it counts as marketing and must then be subject to your visitors’ prior consent.
It is for you, as the publisher of your site, to decide which use applies and to connect this cookie to your consent tool.
The plugin also loads a hosted scheduler’s calendar only after the access screen has been passed: until the visitor has filled in the form, no request is made to that third-party provider from their browser.
12. Minors
Our site and our product are not intended for children under sixteen (16). We do not knowingly collect their data without the consent of the holder of parental responsibility (article 8 of the GDPR). If we find such data, we delete it without delay.
If your access screen is aimed at an audience of minors, it is for you, as the controller, to put in place the required age verification and parental consent measures.
13. Complaints
If you believe your data is not being processed lawfully, you can contact the Romanian supervisory authority:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, București, 010336, Romania
https://www.dataprotection.ro — anspdcp@dataprotection.ro — +40 318 059 211
If you live in another Member State, you can also contact your national authority (the CNIL in France, the AEPD in Spain, the Garante in Italy, the CNPD in Portugal, the BfDI in Germany, and so on).
14. Changes
We may change this policy to reflect legal, regulatory, technical or contractual developments. The version that applies is the one published on the date you read it. If we make a substantial change, we will tell you through a banner on the site, or by email if you are a customer.
15. Contact
Sdravobiz S.R.L.
Strada Trandafirilor 51
307220 Giroc, Romania
contact@sdravobiz.com (legal and GDPR) — contact@bookingleads.pro (service and support)
https://bookingleads.pro
This is a courtesy translation. In the event of any discrepancy, the French version prevails.
Last updated: 28 September 2026
