KabinetkoPrivacy policy
Last updated: 3 November 2026
1. Who we are
Kabinetko (kabinetko.com and kabinetko.app) is a service of Holistik Femili EOOD, UIC 206458960, registered at 2 Anton Pavlovich Chekhov St., bl. 71, entr. G, fl. 3, apt. 43, Izgrev, 1113 Sofia, Bulgaria ("we"). For questions about personal data, write to info@kabinetko.com.
2. Our two roles
- We are the controller of the data of people who use Kabinetko on behalf of a business (owners, admins and employees with an account), and of visitors to kabinetko.com.
- We are a processor of the data businesses enter about their own clients, such as name, phone, email and bookings. For that data, the business is the controller. We process it only on the business's instructions and under our data processing agreement with it.
If you are a client of a business that uses Kabinetko, contact that business first about your rights. You can also write to us, and we will forward your request.
3. What data we process
- Kabinetko accounts: name, email, password (stored only as a hash), role in the business, login sessions, interface settings.
- Data a business enters about its clients: name, email, phone, bookings and their history, notes, service packages, payments recorded at the venue.
- When you book online: the data you enter in the business's booking form.
- Technical data: IP address and request data (for security and abuse prevention), technical logs, email delivery data (for example, whether an email bounced or was marked as spam).
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service and maintaining the account | Performance of a contract (GDPR Art. 6(1)(b)) |
| System emails: confirmations, reminders, login, invitations | Performance of a contract; for a business's clients: on the business's instructions |
| Security, abuse and bot prevention | Legitimate interest (GDPR Art. 6(1)(f)) |
| Invoicing and accounting | Legal obligation (GDPR Art. 6(1)(c)) |
| Answering enquiries | Legitimate interest, or steps before entering a contract |
5. Where data is stored and who can access it
Data is stored in the European Union, in Amazon Web Services data centres in Frankfurt, Germany.
We use these providers (sub-processors):
- Amazon Web Services (AWS): hosting, database, file storage, sending email. Frankfurt, EU.
- Cloudflare: DNS and the network requests to the service pass through. Cloudflare may process traffic data outside the EU, under appropriate safeguards such as the EU standard contractual clauses.
- Lovable: hosting of the kabinetko.app web application's files. The data you enter in the app does not pass through Lovable.
We do not sell personal data or share it for advertising.
6. How long we keep data
- Account and business data: while the subscription is active and up to 30 days after it ends, so the business can export its data. Then we delete it.
- Database backups: up to 7 days.
- Technical logs: up to 30 days.
- Accounting records: as long as the law requires.
7. Cookies and browser storage
Kabinetko uses no advertising or analytics cookies. To keep you signed in, the app stores your session in the browser's local storage. This is strictly necessary for the service to work.
The anti-bot check on forms (Altcha) runs on our own servers, with no third-party provider.
8. Your rights
You have the right to:
- access your data;
- correct inaccurate data;
- erasure;
- restrict processing;
- data portability;
- object to processing based on legitimate interest.
Write to us at info@kabinetko.com. We reply within one month.
You also have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP): www.cpdp.bg.
9. Security
Access to data is limited to what is necessary. Connections are encrypted (HTTPS), passwords are stored as hashes, and each business's data is technically separated from everyone else's.
10. Changes to this policy
If we make significant changes, we will notify users by email or in the app. The current version is always at kabinetko.com/privacy.
This is a translation. In case of discrepancy, the Bulgarian version prevails.