LEGAL PAGES

Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains how BoBook collects, uses, stores and protects personal data when you use bobook.eu, submit a Travel Planning Request, create an account, purchase a paid BoBook service, contact us, or use a Travel Plan or itinerary.

The data controller is:

Northbase Digital OÜ
Järvevana tee 9
11314 Tallinn
Estonia
Registry code: 17514950
Email: info@bobook.eu

1. Who this Policy applies to

This Policy applies to visitors to bobook.eu, people who submit Travel Planning Requests, BoBook customers, registered account holders, people who contact BoBook, and people whose information is included in a Travel Planning Request by the person organising the trip.

The BoBook service is intended to be ordered and managed by adults. A customer may provide limited information about other travellers, including children, where this is reasonably necessary to prepare the requested travel plan.

2. Personal data we may collect

2.1 Travel Planning Request data

When you submit a Travel Planning Request, we may collect information such as:

your name;
email address;
contact details you choose to provide;
destination and travel dates;
number and composition of travellers;
travel preferences and travel style;
budget information;
accommodation, transport, activity and dining preferences;
special requests or notes you choose to provide;
the BoBook service plan you request;
request reference and service status.

Please avoid sending sensitive personal information unless it is genuinely necessary for the requested travel-planning service. If you voluntarily provide information concerning accessibility, dietary requirements, health-related travel needs or similar sensitive matters, we will use it only as necessary to provide the service and in accordance with applicable data-protection law.

2.2 Account data

If you create a BoBook account, we may process:

name;
email address;
account identifier;
authentication and account-status information;
Travel Plans and itineraries linked to your account;
package, entitlement and usage information;
account security and password-reset records.

Passwords are handled through the WordPress authentication system and should not be stored by BoBook in readable form.

2.3 Payment information

For Personal and Premium services, payments are currently processed through Revolut Hosted Checkout.

BoBook may receive and store payment-related information such as:

payment or order reference;
selected BoBook service plan;
amount and currency;
payment status;
payment timestamps;
limited transaction information required for reconciliation, refunds and accounting.

BoBook does not ask you to provide full payment-card details through the Travel Planning Request form and does not store full card numbers or CVV codes on its own website.

2.4 Travel Plan, Research and itinerary data

To provide the BoBook service, we may process:

Research Items prepared for your trip;
options you select or remove;
estimated prices and selected travel options;
Travel Plan content;
itinerary content;
notes and preferences relevant to the requested service;
share-link and publication status information required to provide secure access.

2.5 Contact and support data

If you contact BoBook by email, contact form or another support channel, we may process:

your name;
email address;
message;
request or Travel Plan reference;
the subject of your enquiry;
our correspondence with you.

2.6 Technical and security data

When you use the website, our systems may process limited technical information necessary to operate and protect the service, such as:

IP address;
browser and device information;
date and time of requests;
security and error logs;
authentication events;
cookie-consent choices;
technical identifiers required for secure sessions and site operation.

2.7 Cookie and similar technology data

BoBook uses cookies and similar technologies. Necessary cookies may be used without optional consent where permitted by law because they are required for core website functions.

Non-essential cookies, such as analytics or marketing/affiliate technologies, will be handled according to your choices where consent is required.

More information is provided in our Cookie Policy.

3. Why we process personal data and our legal bases

We process personal data only where there is a lawful basis for doing so.

3.1 Performance of a contract or steps requested before entering a contract

We may process data because it is necessary to provide a service you requested, including to receive and manage a Travel Planning Request, prepare Research, Travel Plans and itineraries, create or link your customer account, provide access to purchased or requested services, manage payments and refunds, and respond to service-related questions.

3.2 Legal obligations

We may process information where necessary to comply with legal obligations, including accounting, tax, consumer-protection and legal record-keeping requirements.

3.3 Legitimate interests

Where appropriate, we may rely on legitimate interests to protect BoBook and customers against fraud and abuse, maintain service reliability, diagnose technical problems, keep reasonable business and support records, establish or defend legal claims, and improve service operation where consent is not required.

3.4 Consent

We may rely on your consent where required, including for certain non-essential cookies or similar technologies and, where applicable, for processing information that requires explicit consent.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

4. Artificial intelligence

BoBook may use artificial-intelligence services to assist with travel research, structuring information and preparing itinerary content.

Where AI tools are used, BoBook aims to provide only the information reasonably necessary for the requested task and to avoid sending unnecessary personal data.

AI-generated output may be reviewed, edited or supplemented before it is used in a BoBook service.

You should not include highly sensitive or confidential personal information in free-text fields unless it is genuinely necessary for your request.

5. Third-party service providers and recipients

We may share or make data available to service providers where necessary to operate BoBook. Depending on the feature used, these may include:

hosting and technical service providers — for website hosting, infrastructure, backups, email delivery and technical operation;
Revolut — for hosted payment processing, payment verification, refunds and related transaction administration;
travel-data and research providers — such as accommodation or travel-information providers used to research options for a Travel Plan;
AI service providers — where AI processing is used to assist with research or itinerary generation;
image/content providers — where external image services are used to select imagery for Travel Plans;
professional advisers and public authorities — where disclosure is required by law or reasonably necessary for legal, accounting or compliance purposes.

We do not sell personal data to advertisers.

When you choose to follow a link to an independent hotel, airline, booking platform, affiliate partner or other third-party provider, that third party may process your data under its own privacy policy. BoBook does not control the independent processing carried out on third-party websites.

6. Provider and affiliate links

A Travel Plan may contain links to external providers or affiliate partners.

BoBook does not automatically send the full contents of your Travel Planning Request to an external provider simply because a provider link is displayed.

If you click an external link, the third-party website may receive technical information normally transmitted when visiting a website and may use its own cookies or tracking technologies subject to applicable law and your choices.

More information about commercial links is provided in our Affiliate Disclosure.

7. International transfers

Some technology, payment, AI, research or support providers may process data outside Estonia or elsewhere outside the European Economic Area.

Where personal data is transferred to a country outside the EEA, BoBook will use an available lawful transfer mechanism where required, such as an adequacy decision, Standard Contractual Clauses, or another safeguard recognised under applicable data-protection law.

8. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

Retention depends on the type of information. In general:

Travel Planning Requests, Travel Plans and itineraries may be retained while the customer account or service relationship remains active and for a reasonable period afterwards;
payment and accounting records may be retained for the period required by applicable accounting and tax law;
support correspondence may be retained for a reasonable period needed to manage the enquiry and related legal obligations;
security and technical logs are retained only for a period reasonably necessary for security, troubleshooting and abuse prevention;
cookie-consent records are retained for the period needed to demonstrate and manage your consent choices.

Where we no longer need personal data, we will delete, anonymise or otherwise securely dispose of it, subject to legal retention requirements.

9. Account deletion and service records

You may contact BoBook to request deletion of your account and eligible personal data.

Deleting an account does not necessarily require deletion of information that BoBook must retain to comply with legal obligations, resolve disputes, prevent fraud, maintain necessary transaction records or establish legal claims.

10. Your data-protection rights

Subject to the conditions and limitations of applicable law, you may have the right to:

obtain information about how your personal data is processed;
request access to your personal data;
request correction of inaccurate or incomplete data;
request deletion of personal data;
request restriction of processing;
object to processing based on legitimate interests;
receive certain data in a portable format where the right to data portability applies;
withdraw consent at any time where processing is based on consent;
lodge a complaint with a competent data-protection authority.

To exercise your rights, contact info@bobook.eu.

We may need to verify your identity before fulfilling a request in order to protect your personal data from unauthorised disclosure.

11. Complaints to the supervisory authority

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent supervisory authority.

Our supervisory authority in Estonia is:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tallinn, Estonia
Website: www.aki.ee

You may also have the right to contact the data-protection authority in the EU/EEA country where you live or work, where applicable.

12. Automated decision-making

BoBook may use automated tools, including AI, to assist with research and content preparation.

BoBook does not currently use solely automated decision-making that produces legal effects or similarly significant effects on customers.

13. Security

BoBook uses reasonable technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, misuse, alteration or disclosure.

No internet-based system can be guaranteed to be completely secure. Customers are also responsible for protecting their account credentials and for sharing itinerary links only with intended recipients.

14. Shared itinerary links

BoBook may allow you to use a read-only share link for a published itinerary.

Anyone who receives a valid share link may be able to view the information made available through that link. You should therefore share it only with people you intend to give access to.

Share links do not provide permission to modify your Travel Plan or itinerary.

15. Children and traveller information

BoBook services are intended to be ordered by adults.

An adult organising a trip may provide limited information about child travellers where reasonably necessary for travel planning, such as age group or traveller count.

Please do not provide unnecessary identifying information about children.

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in BoBook services, legal requirements, technology or data-processing practices.

The current version will be published on bobook.eu with the updated revision date.

17. Contact

For questions about this Privacy Policy or the processing of your personal data, contact: