Privacy policy

This English version is provided for convenience; the Hebrew version governs.

1. Introduction

C.T. Technologies Ltd. (the "Company", "we"), which operates the Bookily platform, respects your privacy and the privacy of your customers. This policy explains what information we collect, for what purposes, with whom it is shared, how it is secured and what your rights are. The policy applies to the marketing site, the management system, and the booking pages and business websites we operate for our customers. The policy is written in line with the Privacy Protection Law, 1981 and the Privacy Protection Regulations (Information Security), 2017.

2. Two kinds of information, and two hats

It is important to tell them apart: (a) information about the business owners who use Bookily ("Users"), for which the Company is the database owner; (b) information about the businesses’ end customers ("End customers"), which the business enters into the system. For this information the business is the database owner, and the Company acts as a holder and processor on its behalf and according to its instructions only.

3. Information we collect about Users

When you register and start using the Service we collect: the full name, email, phone and (encrypted) password of the system manager and of additional users; business details: name, type, address, phone, opening hours and number of staff; plan details, add-ons and billing history (credit card details are kept only with the payment processor and are not kept by us); and technical usage data: IP address, browser and device type, pages viewed and actions in the system.

4. Information about end customers

The business enters customer details into the system, such as name, phone, email, appointment and purchase history, notes and invoices. When an end customer books an appointment through the self-service page or the business website, we collect the details they enter (name, phone, service and time) and pass them to the business’s calendar. We process this information only to provide the Service to the business, and we do not use it for our own purposes, for advertising or for sale. The responsibility for obtaining end customers’ consent and giving a privacy notice on its behalf rests with the business.

5. Purposes of use

We use the information to: provide and run the Service (calendar, messages, invoices, website); manage the account, billing and invoices; send SMS messages and emails on the business’s behalf to its customers; provide technical support; improve the system and develop new features on the basis of aggregate and anonymous data; protect the system from fraud and abuse; and meet legal requirements. Information about Users will also be used to send product updates, which you can opt out of at any time.

6. Legal basis for processing

Processing is based on your consent at registration, on the need to perform the agreement between us (the terms of use), on our legitimate interests (security, improving the Service, preventing fraud) and on legal obligations (keeping accounting records). For end customers, the legal basis is set by the business, and we act as a processor on its behalf.

7. Sharing information with third parties

We do not sell personal information. We share information only with sub-processors needed to provide the Service, who act under confidentiality and data processing agreements: hosting and cloud infrastructure providers; SMS and email sending providers; a credit card payment processor; a domain registrar (for the Business plan); and analytics and support tools. We will also share information if required by law, a court order or a competent authority, or to protect our rights. In a merger or acquisition, the information will pass to the continuing body subject to this policy.

8. Transfer of information outside Israel

Some of our cloud and communication providers operate outside Israel. Information is transferred to those countries in line with the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 2001, to countries that provide an adequate level of protection or under contracts that ensure equivalent protection.

9. Retention and deletion

Information is kept as long as the account is active and as needed to provide the Service. After a subscription ends, the information is kept for 90 days for export and return, and is then permanently deleted from the live systems (backups are deleted in the normal backup cycle, up to 30 more days). Accounting records are kept for 7 years as the law requires. The business can delete individual end customers at any time from within the system.

10. Information security

We apply physical, technical and organisational security measures in line with the information security regulations: encryption in transit (TLS) and encryption of stored data; hashed passwords; access permissions by role and an action log (audit log); regular backups; separated environments; and access controls for Company staff on a "need to know" basis. Still, no security is perfect, and we recommend choosing strong passwords and not sharing them. In the event of a serious security incident we will act according to the reporting duties in law and notify the relevant users.

11. Your rights

Under the Privacy Protection Law you have the right to see the information kept about you, to correct it, to ask for it to be deleted and to object to its use for direct mailing. You can export all the business and customer data from the system at any time. End customers who want to exercise their rights should contact the relevant business, and we will help the business carry out the request. For enquiries on this, see the "Contact" section.

12. Cookies and tracking tools

The site and the system use cookies and similar technologies: cookies essential for operation (signing in, security, remembering preferences); analytics cookies for aggregate analysis of use and improving the site; and, on the marketing site only, marketing cookies for measuring campaigns. You can block or delete cookies in your browser settings; blocking essential cookies may harm how the system works. We do not run marketing cookies on end customers’ booking pages.

13. Minors

The Service is for business owners aged 18 and over. We do not knowingly collect information about minors under 18 as users. Businesses that serve minors (for example, private tutors) are responsible for obtaining the consent of a parent or guardian as the law requires.

14. Changes to the policy

We may update this policy from time to time. For a material change, notice will be given by email or inside the system at least 14 days before it takes effect. The date of the last update appears at the top of the page.

15. Contact

For questions, requests to view, correct or delete information, and enquiries about privacy, you can contact C.T. Technologies Ltd. through the "Contact" page on the site, writing "Privacy" in the subject of the enquiry. We will reply within 30 days at most, as the law requires.