BookinX by Xorbit

Privacy Policy for BookinX

As of: 2 October 2026

This Privacy Policy explains how personal data are processed when using BookinX, an online service for setting up and managing appointment bookings.

BookinX is currently in test operation.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR; German: DSGVO) for BookinX's own processing activities described in this Privacy Policy is:

Robert F. Craciun

Girardigasse 4/28

1060 Wien

Austria

Phone: +43 664 166 44 46

E-mail: robert@x-orbit.app

BookinX is a service of the Xorbit product family (x-orbit.app). The operator and controller is the person named above; Xorbit is a product name, not a separate legal entity.

The founding of a company is in progress.

2. Data Protection Roles at BookinX

At BookinX, a distinction must be made between two different processing situations.

2.1 BookinX as Controller

BookinX is itself the controller insofar as personal data are processed in particular for the following purposes:

The following information applies directly to these processing activities.

2.2 BookinX as Processor

BookinX customers can set up their own booking pages and enable their customers, prospects or other persons to book appointments.

For personal data processed via such a booking page on behalf of a BookinX customer, the respective BookinX customer is in principle the controller within the meaning of Art. 4(7) GDPR.

BookinX in principle processes these data as a processor pursuant to Art. 4(8) and Art. 28 GDPR in accordance with the instructions of the respective customer.

For this purpose, a separate Data Processing Agreement pursuant to Art. 28 GDPR is concluded between BookinX and the customer.

Persons who book an appointment via a BookinX booking page may in principle contact the provider of the respective booking page regarding their data protection rights. BookinX supports its customers in handling such requests within the scope of its statutory and contractual obligations.

Insofar as BookinX processes personal data on behalf of a customer, the processing takes place on the basis of a Data Processing Agreement pursuant to Art. 28 GDPR. This agreement governs in particular the subject matter and duration of the processing, the nature and purpose of the processing, the categories of personal data and data subjects, and the rights and obligations of the parties.

3. Registration with BookinX

During registration, the following data in particular may be processed:

The processing takes place to set up the requested BookinX account, to carry out pre-contractual measures and to prepare or perform the contractual relationship. Legal basis: Art. 6(1)(b) GDPR.

Insofar as consent is expressly obtained for certain voluntary processing operations, the processing takes place on the basis of Art. 6(1)(a) GDPR.

The IP address used for abuse prevention and rate limits is processed on the basis of our legitimate interest in the security, stability and prevention of abuse of the service pursuant to Art. 6(1)(f) GDPR.

The IP address stored for this purpose is in principle deleted or removed from the corresponding rate-limit system after 24 hours.

When the registration page is accessed, your IP address is mapped to a country locally on our server using the freely available “user-country” database of the ip-location-db project (public domain, PDDL) in order to suggest the country code for the phone field; the IP address is not disclosed to third parties in the process (Art. 6(1)(f) GDPR).

Unconfirmed registrations are in principle deleted after 24 hours.

4. Administration and User Accounts

For the administration of BookinX, the following data in particular may be processed:

Passwords are not stored in plain text. Only a cryptographic password hash using Argon2id or scrypt is stored. The processing serves authentication, account management, access control and secure provision of the service. Insofar as the processing is necessary for the use of BookinX, the legal basis is Art. 6(1)(b) GDPR.

Security logging, access control and audit logs are additionally carried out on the basis of our legitimate interest in securing our systems, detecting abuse and ensuring traceable administration pursuant to Art. 6(1)(f) GDPR. In the BookinX administration area, a session ends after 30 minutes of inactivity, but no later than 12 hours after login. Activity extends only the inactivity period; the maximum session duration of 12 hours remains unaffected.

A session in Xorbit ends no later than 12 hours after login. When the password is changed, all existing sessions of the account concerned are terminated immediately. Data of expired or terminated sessions are permanently deleted no later than seven days after the expiry or termination of the session during the next login process. Audit logs are in principle stored for 12 months and then deleted, unless longer storage is necessary to investigate a specific security incident or to establish, exercise or defend legal claims.

5. Appointment Bookings

When an appointment is booked via BookinX, depending on the configuration of the respective booking page, the following data in particular may be processed:

These data are used to record and manage the requested appointment and to make it available to the persons involved. The controller under data protection law for the processing of booking data is in principle the respective customer operating the booking page concerned. This customer determines the purposes and legal bases of the processing and is responsible for fulfilling the information obligations towards the booking persons. BookinX processes the booking data as a processor pursuant to Art. 28 GDPR on the basis of the Data Processing Agreement concluded with the respective customer and the customer's documented instructions. Booking persons can obtain further information on the processing of booking data from the respective controller.

6. Calendar Integration

BookinX optionally enables users to connect a personal calendar from Microsoft Outlook / Microsoft 365, Google Calendar or Apple Calendar to BookinX. The connection is established solely at the express initiative of the respective user.

As part of the calendar integration, depending on the selected calendar provider and the type of connection, in particular:

BookinX processes calendar data only to the extent necessary for the calendar integration activated by the user. Insofar as access tokens or comparable authentication data are required for the connection, these are stored in a protected manner.

The user can disconnect the calendar connection at any time. Authentication and access data stored by BookinX that are no longer required for the calendar connection are then deleted or rendered unusable.

The calendar connection is voluntary. Insofar as the processing is based on consent, the legal basis is Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected.

Microsoft Outlook / Microsoft 365

Microsoft Graph is used to connect Microsoft Outlook or Microsoft 365. As part of the calendar integration, only the permissions required for the calendar functions provided are used.

The provider of the Microsoft services for users in the European Economic Area is in principle Microsoft Ireland Operations Limited. In the course of providing the services, personal data may be processed by Microsoft and companies affiliated with Microsoft.

Google Calendar

The Google Calendar API is used to connect Google Calendar. The connection is established after authorisation by the user and within the scope of the permissions required for the calendar integration.

In detail, the following applies to Google Calendar:

The provider of the Google services for users in the European Economic Area is in principle Google Ireland Limited. In the course of providing the services, personal data may be processed by Google and companies affiliated with Google.

Apple Calendar

BookinX also enables connection to Apple Calendar. Depending on the technical connection used, only the calendar and authentication data required for the calendar integration are processed.

In detail, the following applies to Apple Calendar:

Insofar as Apple services are used in this context, personal data may be processed by Apple Distribution International Ltd. or companies affiliated with Apple.

Data Transfers by Calendar Providers

When using external calendar providers, it cannot be ruled out that personal data are also processed outside the European Economic Area by the respective provider or companies affiliated with it. Further information on third-country transfers can be found in the section "Data Transfers to Third Countries" of this Privacy Policy.

7. Profile Information

Users can supplement their BookinX profile with additional information. This may include in particular:

Users can also generate a QR code with a digital contact card (vCard). The contact card contains the user's name, company, phone number and e-mail address and, if selected, a link to the booking page. The QR code is stored in the profile and displayed in the appointment preparation.

The user decides whether the public profile is visible to visitors.

This profile information serves the individual design of the booking page and may be publicly visible there to visitors and booking persons. Users decide for themselves whether to provide this voluntary information and can change or remove it at any time. The processing takes place to provide and display the booking profile configured by the user. The legal basis is Art. 6(1)(b) GDPR, insofar as the processing is necessary to provide the BookinX function chosen by the user.

Insofar as the processing of voluntary profile information is based on consent, the legal basis is Art. 6(1)(a) GDPR. Consent given may be withdrawn at any time with effect for the future.

8. Sending of E-mails

BookinX sends transactional e-mails, in particular in connection with:

netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, is used as a service provider for the technical sending of e-mails.

In the course of sending e-mails, the following personal data in particular may be processed:

The content of e-mails is processed by the mail server used only to the extent necessary for the technical transmission and delivery of the respective message. BookinX additionally keeps its own mail delivery log. This contains in particular the recipient address, the subject, the time of sending and technical delivery information. The content of the respective e-mail is not stored in the BookinX delivery log.

Insofar as sending e-mails is necessary for the performance of a contractual relationship or an appointment booking, the processing takes place on the basis of Art. 6(1)(b) GDPR. Insofar as BookinX acts as a processor with regard to booking data, the processing takes place on the basis of the Data Processing Agreement concluded with the respective customer and the customer's documented instructions.

Technical sending and delivery information is processed on the basis of Art. 6(1)(f) GDPR. The legitimate interest lies in particular in ensuring reliable e-mail delivery, error analysis and the security and stability of the service.

Personal data are processed in connection with sending e-mails only for as long as necessary for the respective purpose or as required by statutory retention obligations.

9. Hosting

BookinX is operated on server infrastructure of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. As part of hosting, the personal data required to provide BookinX as well as technical log data are processed. The latter serve in particular secure and stable operation, error diagnosis and the detection and defence against attacks and abuse.

Insofar as necessary to provide the service, the processing takes place on the basis of Art. 6(1)(b) GDPR and, for security and logging purposes, on the basis of legitimate interest pursuant to Art. 6(1)(f) GDPR. A Data Processing Agreement pursuant to Art. 28 GDPR is in place with netcup.

10. Video Conferences

BookinX can optionally support conducting or linking video conferences. Depending on the configuration, the following services in particular may be used for this purpose:

To set up video conferences, BookinX uses an internal component on the same servers. In the process, the e-mail address of the participating person, the start and end of the appointment and the conference link are processed in order to send the invitation and provide the room. The e-mail address and conference link are stored encrypted (AES-256-GCM). No transfer to third parties takes place, except in the case of Microsoft Teams (see 10.1).

10.1 Microsoft Teams

BookinX optionally enables the use of Microsoft Teams for video appointments. Depending on the function selected, a Teams appointment can be created via the Microsoft connection or an existing Teams link can be used for an appointment. In the process, the data required to create, assign and conduct the appointment may be transferred to or processed by Microsoft. The use of Microsoft Teams is optional. The privacy terms of the respective Microsoft service additionally apply to processing by Microsoft.

10.2 Xorbit Meeting

For video conferences, BookinX provides its own Jitsi Meet instance operated at meet.x-orbit.app. Conference rooms are provided for booked appointments and are accessible via the respective meeting link. A recording takes place only if the organising person expressly starts it as part of the optional transcript function (see 10.3). During a video conference, the connection and communication data required for technical provision are processed, in particular for the transmission of video and audio and for establishing and maintaining the connection. BookinX does not use any analytics or advertising tracking services within Xorbit Meeting. The processing takes place solely to provide the video conference function.

10.3 Recording, Transcript and Summary

BookinX optionally offers a transcript function for video conferences in Xorbit Meeting. The recording can only be started and stopped by the organising person of an appointment via the „Transkript aufnehmen“ (Record transcript) button. The organising person is obliged to inform all participants before the recording begins and, where necessary, to obtain their consent. While recording is in progress, all participants in the conference see the notice „Dieses Gespräch wird für ein Transkript aufgezeichnet.“ (This conversation is being recorded for a transcript.)

Procedure and data processed:

The transcript function processes the data on behalf of the respective BookinX customer (see 2.2). The legal basis on the customer's side is usually the consent of the participants (Art. 6(1)(a) GDPR) or a legitimate interest (Art. 6(1)(f) GDPR); the customer as controller is responsible for this.

11. Cookies and Web Analytics

BookinX uses technically necessary cookies, in particular a session cookie for secure login and use of the administration area. Display and user settings may also be stored in the local browser storage. For statistical analysis, we use the self-hosted web analytics software Matomo at stats.x-orbit.app. Matomo is activated only after express consent via the cookie banner. Without consent, Matomo is not loaded and no analytics data are transmitted.

Page views and selected usage events are recorded, for example the selection of an appointment or the completion of a booking. IP addresses are anonymised, „Do Not Track“ is respected and raw data are deleted after 180 days. No use for personalised advertising takes place. Consent is stored in the cookie bookinx_consent for up to 12 months and can be changed or withdrawn at any time via „Cookie-Einstellungen“ (Cookie settings) in the footer. The legal basis for web analytics is Art. 6(1)(a) GDPR.

12. Advertising and Marketing

BookinX may process personal data of its own customers and prospects for advertising and marketing purposes insofar as there is a legal basis for this. Insofar as consent is required, the processing takes place only after it has been given. Consent given may be withdrawn at any time with effect for the future. Booking data that BookinX processes as a processor for its customers are not used by BookinX for its own advertising or marketing purposes.

13. Recipients and Processors

Personal data are only transferred insofar as this is necessary to provide BookinX, there is a legal obligation, or another legal basis under the GDPR applies.

The recipients used or potential recipients include in particular:

Microsoft, Google and Apple are involved only insofar as the respective function is used by the user. BookinX does not sell personal data.

14. Data Transfers to Third Countries

When using external services, in particular those of Microsoft, Google or Apple, personal data may be processed outside the European Economic Area (EEA). A transfer to third countries takes place only in compliance with the requirements of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision of the European Commission or appropriate safeguards pursuant to Art. 46 GDPR.

Insofar as providers participate in and are certified under the EU-U.S. Data Privacy Framework, the transfer of data to the USA can be based on the corresponding adequacy decision of the European Commission. Where this is not the case, appropriate safeguards, in particular Standard Contractual Clauses of the European Commission, are relied upon where necessary.

15. Storage Period and Deletion

Personal data are stored only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

Conference Data

The e-mail address of the participating person stored for a video conference is automatically deleted 30 days after the end of the appointment. The conference link is deleted together with the associated booking.

Recordings, Transcripts and Summaries

The video file is deleted immediately after the end of the recording, the audio recording as soon as the transcript has been stored. The transcript, summary and speaker information are automatically deleted 30 days after the end of the recording or of the appointment, whichever occurs later.

Appointment Preparation Data

Agenda additions and meeting objectives are stored and deleted together with the respective booking. Views of the appointment preparation page are stored for a maximum of 365 days for display to the BookinX customer.

Booking Data

Booking data are in principle stored for the duration of the contractual relationship with the respective BookinX customer and deleted no later than six months after the end of the contract, unless statutory retention obligations or documented instructions of the controller prevent this. Within the scope of data processing on behalf, customers may request the deletion or return of the personal data processed on their behalf in accordance with the Data Processing Agreement.

Unconfirmed Registrations

Unconfirmed registrations are deleted after 24 hours.

Rate-Limit Data

IP addresses stored for rate limits are deleted or removed from the system used for this purpose after 24 hours.

Session Data

In the BookinX administration area, a session ends after 30 minutes of inactivity, but no later than 12 hours after login. Activity extends only the inactivity period.

A session in Xorbit ends no later than 12 hours after login. When the password is changed, all existing sessions of the account concerned are terminated immediately.

Data of expired or terminated sessions are deleted no later than seven days after expiry or termination.

Audit Logs

Audit logs are in principle stored for 12 months. This also includes the change log that administrators of a BookinX customer can view under „Einstellungen > Protokoll“ (Settings > Log). It records who changed which setting, appointment type, person or availability and when, but not the changed content itself. Longer storage takes place only insofar as this is necessary to investigate a specific security incident or to establish, exercise or defend legal claims.

Contract and Billing Data

For contract and billing purposes, in particular the company name, billing address, country, VAT identification number (UID-Nummer), billing e-mail address, accounting contact person, number of licences, billing period and invoice amounts are processed. The legal basis is Art. 6(1)(b) and (c) GDPR. Invoices and other tax-relevant documents are stored in accordance with the statutory retention obligations, in particular for seven years pursuant to § 132 BAO (Austrian Federal Fiscal Code, Bundesabgabenordnung), and then deleted, unless there is another legal basis for further storage.

Backups

Personal data may also be temporarily contained in backup copies. Backups serve solely to secure and restore the systems and are not used for any other purposes. Deleted data may continue to be contained in backups until the respective backup copy is overwritten or deleted in the regular cycle.

16. Data Security

BookinX takes appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure and other unlawful processing.

These include in particular:

The security measures are regularly reviewed and adjusted as necessary, taking into account the risk and the state of the art.

17. Obligation to Provide Personal Data

Certain personal data are required so that a BookinX account can be set up, a contract can be performed or an appointment can be booked. If required data are not provided, the function concerned may not be usable or the requested contract or appointment may not be carried out. Voluntary information is treated as such and is in principle not required for the use of the other functions.

18. Data Subject Rights

Subject to the statutory requirements, data subjects have in particular the following rights:

Where processing is based on consent pursuant to Art. 6(1)(a) GDPR, this consent may be withdrawn at any time with effect for the future. The withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal. Requests concerning processing activities for which BookinX itself is the controller can be sent to: robert@x-orbit.app

For data that BookinX processes merely on behalf of a customer, the respective BookinX customer is in principle the controller under data protection law. Such requests should therefore primarily be addressed to that customer. BookinX supports the controller in fulfilling its legal obligations.

19. Objection to Processing Based on Legitimate Interests

Insofar as personal data are processed on the basis of Art. 6(1)(f) GDPR, there is a right, in accordance with Art. 21 GDPR, to object to the processing at any time on grounds relating to the particular situation of the data subject. BookinX will then no longer process the personal data concerned unless compelling legitimate grounds for the processing can be demonstrated which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

20. Right to Lodge a Complaint with the Data Protection Authority

Pursuant to Art. 77 GDPR, data subjects have the right to lodge a complaint with a data protection supervisory authority if they consider that the processing of their personal data infringes the GDPR.

In Austria, the competent authority is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)

Barichgasse 40–42

1030 Wien

Austria

E-mail: dsb@dsb.gv.at

Phone: +43 1 52 152-0

The right to contact another supervisory authority competent under the GDPR remains unaffected.

21. Automated Decision-Making and Profiling

BookinX does not make any decisions based solely on automated processing within the meaning of Art. 22 GDPR that produce legal effects concerning a data subject or similarly significantly affect them. No profiling for advertising, creditworthiness or comparable decision-making purposes takes place. The summary of transcripts (see 10.3) is a working aid for the organising person; no decisions about persons are derived from it.

22. Changes to this Privacy Policy

This Privacy Policy will be adapted if the functions of BookinX, the service providers used, the data processing operations or the legal requirements change. The current version is to be made accessible via BookinX. In the event of material changes that directly affect registered users, information may additionally be provided within the service or by e-mail.

As of: 2 October 2026