Privacy Policy
Effective date: 2026-09-30 Last updated: 2026-09-30
This Privacy Policy explains how the operator of Base, reachable at info@base.cy (“Platform”, “we”, “us”, “our”) handles personal data in connection with Base and its related websites, applications and services (“Service”).
It also explains an important distinction between data for which we are the controller and data that we process on behalf of a Business using the Service.
1. Who is responsible for your personal data?
The answer depends on why the data is being processed.
1.1 When the Platform is the controller
We are the controller for personal data we use for our own purposes, including data about:
- Business owners, administrators and authorised users;
- people who contact us for demos, sales or support;
- visitors to our own websites;
- account authentication and security;
- subscriptions, invoices and our own financial records, where they exist;
- Service operation, reliability, fraud prevention and security monitoring;
- our own legal and compliance obligations.
In those cases, we determine the purposes and essential means of processing.
1.2 When the Business is the controller and we are the processor
A Business using the Service may collect and manage information about its own customers, renters, guests, attendees or other end users (“End Customers”).
For example, an End Customer may provide their name, contact details and booking or rental information to make a reservation with a Business, or write to the Business through its booking page.
For that data, the Business determines why the data is collected and how it is used. The Business is therefore the controller and we process the data on the Business’s behalf as its processor, under our Data Processing Agreement (“DPA”) with the Business and the Business’s documented instructions.
If you are an End Customer and want to exercise rights concerning a booking, rental, message or customer record controlled by a Business, please contact that Business first. We will assist the Business as required by the DPA and applicable law.
2. Personal data we collect as controller
Depending on how you interact with us, we may collect the following categories.
2.1 Account and identity data
- name, where provided;
- Business name;
- job title or role;
- account identifier;
- email address;
- authentication-related information, including a hash of your password and, if you enable it, your second-factor setup;
- the date and time you accepted our Terms of Service;
- language, time-zone and account preferences.
We never store passwords in plain text.
2.2 Contact and communication data
- business email address;
- telephone number, where provided;
- support requests, demo or sales enquiries;
- correspondence and feedback.
2.3 Subscription and billing data
The Service is currently free and we do not collect billing data. If we introduce paid plans, we will process plan and subscription status, billing contact details, invoice references, tax/VAT information where required and payment status. We will not store full payment-card details; card data would be handled by the payment provider.
2.4 Technical, usage and security data
- IP address;
- device, browser and operating-system information;
- timestamps and the pages or functions requested;
- authentication events;
- audit records of actions taken in a Business account;
- diagnostic and error information.
2.5 Cookies and storage on your device
Our websites and apps use only cookies and similar technologies that are strictly necessary to provide what you ask for — signing in, keeping a session secure, keeping a customer’s booking cabinet or chat open, and remembering your choices. They need no consent, and none of them is used for advertising or to follow you across other websites:
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
platform.session |
console | keeps a signed-in Business user signed in | 7 days, renewed while in use |
platform.csrf |
console | protects forms from cross-site request forgery | session |
platform.signed-in |
our websites | tells our pages that you are signed in, so they offer the console rather than a sign-in link; holds no identifier | 30 days |
platform.portal |
a business’s booking page | keeps an End Customer’s booking cabinet open after they confirmed their email | 30 days |
platform.guest |
a business’s booking page | keeps a visitor’s chat with a Business together before they leave contact details | 30 days |
platforma.cookies.notice (local storage) |
our websites | remembers that you have seen or answered the cookie notice | until you clear it |
platform.consent.analytics, booking.consent.analytics (local storage) |
our websites; a business’s booking page | remember whether you allowed optional analytics | until you clear it or change it |
portal-chat-outbox (local storage) |
a business’s booking page | keeps a message you wrote while offline until it can be sent | until sent |
platform-admin.locale and similar (local storage) |
console | remember your language and dismissed notices | until you clear them |
| session token (secure storage) | our mobile app, where available | keeps you signed in on that device | until you sign out |
We do not use advertising cookies. Website analytics on our own site, if we enable it, is optional: it loads only after you accept it in the cookie notice, you can decline on equal terms, and you can change your choice at any time through the «Cookie settings» link at the bottom of our pages. Its provider is then named in section 7.1. That provider’s tool is not ours: once you allow it, the provider may set its own cookies and process what it measures under its own privacy policy.
Analytics set up by a Business. A Business may add its own measurement tools (for example Google Analytics or a Meta pixel) to its booking page. They load only after the visitor accepts them in that page’s notice, and the Business — not the Platform — is the controller of the data they collect; its own privacy notice applies.
3. End Customer Data processed on behalf of a Business
Depending on how a Business configures the Service, Customer Data may include:
- name and contact details;
- booking, reservation and rental dates, times, duration and status;
- the selected service, class, vehicle, asset, resource or location;
- booking reference numbers, prices, deposits and records of payments made to the Business outside the Service;
- messages and attachments exchanged with the Business, and notification history;
- notes or custom fields entered by the Business or the End Customer;
- where the Business collects them (for example for vehicle rental): date of birth, driving-licence or identity-document details, handover and damage photographs, and signatures;
- approximate location, if you allow it, to show businesses near you — used for that search only;
- identifiers provided by integrations configured by the Business.
The Service is designed as a general B2B booking and rental system. Businesses should not use free-text fields to record special-category data under Article 9 GDPR (such as health information) unless that use is legally justified and covered by appropriate safeguards.
4. Why we process personal data as controller and our legal bases
Where GDPR applies, we rely on one or more of the following legal bases.
| Purpose | Typical data | Legal basis |
|---|---|---|
| Create and administer Business accounts | account, contact, organisation data | performance of a contract |
| Record acceptance of our Terms | account identifier, date and time | performance of a contract; legitimate interests (proving the agreement) |
| Provide requested demos or sales communications | contact and correspondence data | steps prior to a contract; legitimate interests |
| Bill for the Service and keep records, once paid plans exist | billing, invoice and tax data | performance of a contract; legal obligation |
| Authenticate users and secure the Service | account, IP, logs, device and security data | legitimate interests; performance of a contract |
| Provide customer support | account, contact, support content | performance of a contract; legitimate interests |
| Diagnose errors and maintain reliability | diagnostic, usage and technical data | legitimate interests |
| Prevent fraud, abuse and security incidents | account, IP, audit and security logs | legitimate interests; legal obligation where applicable |
| Comply with legal obligations and establish or defend claims | relevant account, communication and log data | legal obligation; legitimate interests |
| Send service communications to Business users | account and contact data | performance of a contract; legitimate interests |
| Send product news to Business contacts | account and contact data | legitimate interests where permitted; consent where legally required |
| Optional analytics on our own website | cookie, device and usage data | consent |
Where we rely on legitimate interests, those interests are operating and securing a B2B software service, supporting customers, improving reliability, preventing abuse and protecting our legal rights. We do not rely on them where your interests or fundamental rights override ours, and you may object (section 12).
5. How we receive personal data
We may receive personal data:
- directly from you;
- from the Business that created or administers your Business User account;
- automatically from your browser or device when you use the Service;
- from integrations you or your Business authorise;
- from an End Customer when they use a Business’s booking page, in which case we receive that data as processor for the Business.
6. How we use processor data
When acting as processor for a Business, we process Customer Data only to:
- host and display it to authorised users;
- create and manage bookings, reservations and rentals;
- send communications configured or requested by the Business;
- provide support at the Business’s request;
- maintain security, availability, backups and integrity of the Service;
- operate integrations authorised by the Business;
- comply with documented lawful instructions and applicable legal obligations.
We do not sell End Customer Data and do not use it for our own advertising or marketing.
7. Who we share personal data with
We disclose personal data only where necessary, to the following categories.
7.1 Service providers and subprocessors
We use carefully selected infrastructure providers to operate the Service. For Customer Data that we process as processor, they act as our subprocessors.
| Function | Provider | Location / processing region | Transfer safeguard |
|---|---|---|---|
| Hosting of the Service and its data | Hetzner Online GmbH | Germany (EEA) | data stays in the EEA |
| Network edge: DNS, encrypted connections, protection against attacks | Cloudflare, Inc. | global network; company in the United States | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Email delivery | Purelymail LLC | United States | Standard Contractual Clauses |
| Website analytics (only with consent) | Google Ireland Limited (Google Analytics via Google Tag Manager) | EU and USA (EU–US Data Privacy Framework) | processor |
If you use our mobile app, where available, and allow notifications, the operating-system provider (Apple or Google) delivers them to your device.
The table above is the current subprocessor list; it is also provided on request. We will give Businesses notice of new subprocessors as set out in the DPA.
7.2 Business administrators
A Business’s account owners and authorised administrators may access information relating to Business Users and Customer Data according to their permissions.
7.3 Integrations selected by the Business
If a Business enables a third-party integration — for example its own email or messaging account, a calendar, or an artificial-intelligence provider it connects with its own key — we disclose the data required to operate that integration on the Business’s instructions. The third party’s own terms and privacy practices then apply.
7.4 Professional advisers and authorities
We may disclose data to legal, accounting, audit, insurance or security advisers where reasonably necessary, and to courts, regulators, law-enforcement bodies or other authorities where required by applicable law or a binding legal process.
7.5 Transfer of the Service
If the Service is transferred to a company formed by its operator, or is involved in a merger, financing, acquisition, restructuring or sale of business or assets, personal data may be transferred to the successor subject to appropriate confidentiality and data-protection safeguards. We will tell you before such a transfer takes effect.
8. International data transfers
The Service and Customer Data are hosted in Germany (EEA).
Some providers listed in section 7.1 are established outside the EEA or may process data outside it. Where personal data subject to GDPR is transferred to a country without a European Commission adequacy decision, we use an appropriate transfer mechanism — the EU–US Data Privacy Framework where the recipient is certified, or the European Commission’s Standard Contractual Clauses — together with supplementary measures where necessary. The mechanism used for each provider is shown in section 7.1, and a copy of the relevant safeguards is available on request.
9. Data retention
We keep personal data only for as long as necessary for the purpose it was collected for, including contractual, security, accounting and legal requirements.
| Data | How long |
|---|---|
| Business account data | for the life of the account |
| Customer Data | for the life of the Business account, or until the Business deletes it |
| A free account nobody signs in to or uses for 12 months | closed and deleted after 30 days’ notice to the account’s email address (Terms, Section 23); then as an account that has been closed |
| Customer Data after the account is closed | removed from active systems within 30 days of closing, unless the Business asks for earlier deletion or the law requires retention |
| Backups | taken nightly, kept on a rolling basis and overwritten within 30 days; deleted data disappears from them as they roll over |
| Web server access logs (IP address, requested address, browser) | 14 days |
| Application and security logs | rotated automatically and kept no longer than needed for security and troubleshooting, normally no more than 12 months |
| Audit records of actions in a Business account | for the life of the account, then with the account |
| A visitor’s chat that never received contact details | archived after 30 days without activity |
| Sign-in links and one-time codes | minutes to 24 hours, then unusable |
| Support correspondence | normally up to 24 months after the matter is closed |
| Invoice and accounting records, once they exist | 7 years, or another period required by Cyprus tax and accounting law |
| Demo and sales enquiries that led nowhere | normally 12 months after the last contact |
We may keep limited data longer where required by law, to establish, exercise or defend legal claims, or to document compliance. Data kept only for those reasons is set apart from ordinary use.
10. Security
We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. They currently include:
- TLS encryption for connections between your device and the Service;
- encryption of contact details, identity-document numbers and connection secrets inside the database itself, with the keys kept outside it;
- passwords stored only as salted hashes;
- a second authentication factor available to every user and required for platform administrators;
- role-based access and least-privilege permissions within each Business account;
- separation of each Business’s data, protection against cross-site request forgery and rate limits on sign-in and public functions;
- audit records of actions in a Business account;
- content checks of uploaded files before they are made available;
- nightly backups;
- documented incident-response and recovery procedures;
- confidentiality obligations for anyone with administrative access.
No service can guarantee absolute security. We review these safeguards in proportion to the nature of the data and the risks of processing.
11. Personal data breaches
We maintain procedures to assess and respond to suspected personal data breaches.
Where we are controller, we will notify the supervisory authority and affected people as required by applicable law.
Where we are processor for a Business, we will notify the Business without undue delay after becoming aware of a personal data breach affecting Customer Data and will provide the information reasonably available to us to assist the Business with its own obligations.
12. Your GDPR rights when we are controller
Subject to the conditions and limitations in applicable law, you may have the right to:
- obtain confirmation whether we process your personal data and request access to it;
- request correction of inaccurate or incomplete data;
- request erasure;
- request restriction of processing;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive certain data in a structured, commonly used and machine-readable format and transmit it to another controller;
- withdraw consent at any time where processing is based on consent, without affecting processing before the withdrawal;
- lodge a complaint with a competent supervisory authority.
To exercise these rights, contact info@base.cy. We may need to verify your identity before responding. We respond within one month, which may be extended by up to two further months for complex or numerous requests, as GDPR allows; we will tell you if that happens.
13. End Customer rights where a Business is controller
If you are an End Customer whose information was provided in connection with a booking, rental or message, the relevant Business controls that information.
Please contact the Business directly to exercise your rights. If the Business asks us to assist with a valid request, we will do so in accordance with our DPA and applicable law.
If you contact us directly about such data, we will forward or refer your request to the relevant Business unless the law prohibits us from doing so.
14. Children
Business accounts may be opened only by people aged 18 or over. The Service is not directed to children.
A Business may in some industries record information about a minor as part of a booking made by a parent, guardian or other authorised person. In that situation the Business is responsible for the lawful basis, for any information it must give and for any authorisation it must obtain.
15. Automated decision-making
We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals. Features that suggest actions to a Business — for example a price or a reminder — leave the decision to the Business.
If that changes, we will update this notice and provide the information required by law.
16. Marketing communications
We send service communications needed to operate your account. Where the law permits, we may also send relevant product news to Business contacts. You can opt out of non-essential messages at any time using the link in them or by contacting us. Opting out does not stop operational, security, billing or legal communications.
17. Do we sell personal data?
No. We do not sell personal data, and we never sell End Customer Data.
18. Links and third-party websites
The Service may contain links to websites or services operated by others. Their privacy practices are governed by their own notices, not this Privacy Policy.
19. Changes to this Privacy Policy
We may update this Privacy Policy as the Service, providers or legal requirements change. We will change the “Last updated” date above and, for material changes, give additional notice where required.
20. Supervisory authority
If GDPR applies and you believe your data-protection rights have been infringed, you may lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, place of work or the alleged infringement.
In Cyprus, the supervisory authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, subject to the GDPR’s rules on competence and lead supervisory authorities.
21. Contact us
For privacy questions or requests relating to processing for which we are controller:
Privacy email: info@base.cy Support: info@base.cy