Privacy notice
Last updated: 4 October 2026
This notice explains how personal information is handled when you visit the Booked Solid website, use the enquiry form, contact the business, or engage Booked Solid for advertising services.
Who is responsible
Jan Wajda operates the Booked Solid website and is responsible for the personal information described in this notice. Mailing address: os. Dywizjonu 303 19d/10, 31-871 Kraków, Poland. Contact: lead.form@bookedsolid.xyz. The business is not yet registered; its final registered details will be added before the service launches.
Information we handle
- Website security logs: the hosting provider may process your IP address, requested page, date and time, browser/device information, referrer and security events to deliver and protect the site.
- Enquiry form: the form asks for your name, work email, business name and flooring services; website, service area and further details are optional. When you press “Send my enquiry”, these details are sent securely to a Supabase endpoint and stored in our enquiry database in Frankfurt, Germany, so we can review and respond. Access is restricted to authorized business administrators; visitors cannot read other enquiries. A random submission identifier helps prevent duplicate messages on retries. Please do not include sensitive personal information in your message.
- Form abuse prevention: the form endpoint processes your IP address and uses a keyed hash of it, together with submission times and your email address, to limit repeated submissions. The raw IP address is not stored in the enquiry table. Supabase and the website host may keep separate technical security logs.
- Other messages: if you email us directly, we receive the address, name, contents and attachments you choose to send.
- Client and payment information: if you become a client, we process business contact and account details, contract and billing records, and information needed to manage the agreed service. Stripe processes payments through its payment service; card details are submitted to Stripe, not entered into this website.
- Campaign information: when a client authorizes access to its Meta advertising account, we may view campaign performance and lead information submitted through that client’s ads or forms to manage and report on its campaigns. The client generally determines why those leads are collected and must give people the applicable collection notice. Where Booked Solid processes personal data on the client’s behalf, the parties must put the required data processing terms in place before that processing begins. Our access and use are limited to the agreed service and the client’s instructions.
Why we use information
- To operate and secure the website, based on our legitimate interests in maintaining a working and secure service.
- To respond to an enquiry and take steps requested before entering an agreement. Where you are the person considering a contract, the basis is taking steps at your request before entering a contract. Where you contact us on behalf of an organization, the basis is our legitimate interest in responding to and managing that business relationship.
- To keep required tax, accounting and business records, where the law requires it.
- To establish, exercise or defend legal claims, where necessary for our legitimate interests.
- We will send promotional email only where we have a lawful basis and any consent required by applicable law.
Who may receive information
Cloudflare handles website hosting and technical access/security logs. Supabase provides our form endpoint and enquiry database; see its Privacy Policy, Data Processing Addendum and subprocessor list. Direct emails and our replies are handled by the email providers involved. Client, billing and campaign information may be handled by business, payment, advertising, accounting and technical service providers needed for the agreed service. Stripe processes payment information under its own privacy terms; see Stripe’s Privacy Policy and Data Processing Agreement. Campaign and lead data may be accessed in a client’s Meta account and shared with the client or its chosen CRM as part of the service. We may also disclose information when the law requires it or to protect legal rights.
The enquiry database is located in Frankfurt, Germany. Provider operations, support and subprocessors may still involve processing outside the European Economic Area, including in the United States. Where GDPR transfer rules apply, the transfer must rely on an applicable adequacy decision or another valid safeguard, such as standard contractual clauses. Supabase describes its safeguards in the Data Processing Addendum above. Stripe describes its transfer arrangements in its Data Transfers Addendum.
How long information is kept
Form entries, submission identifiers and abuse-prevention hashes are removed from the active enquiry database by a daily cleanup once they are older than 12 months. Provider backups and logs follow the provider’s retention settings. If an enquiry continues by email, we normally keep that correspondence for up to 12 months after our last meaningful contact, unless it becomes a client record or a longer period is needed for legal claims. Contract, payment and tax records are kept for the periods required by law. Website security logs are retained for the period configured by the hosting provider and needed for security and troubleshooting. Campaign data is kept only as long as needed to provide the agreed service and meet legal obligations.
Your rights in the EEA
If GDPR applies, you may ask for access, correction, erasure, restriction or portability, and may object to processing based on legitimate interests. If processing relies on consent, you can withdraw it at any time; this does not affect earlier processing. You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO). To make a request, email lead.form@bookedsolid.xyz.
Rights under other local privacy laws
Privacy laws in some jurisdictions, including some U.S. states, may give you additional rights where their coverage rules apply. These can include rights to access, correct or delete personal information, obtain a copy, or opt out of certain sales, targeted advertising or profiling. The website does not use analytics or advertising pixels, and Booked Solid does not sell personal information through this website. You can send a request to the email above; if we deny a request where applicable law provides an appeal right, reply to our decision to request an appeal.
Cookies and similar technologies
The website uses one first-party cookie to remember your cookie choices for up to 180 days. It is set after you make a choice in the cookie banner. The current site does not use analytics cookies, advertising pixels or other optional tracking technologies. You can reopen the choices at any time using the “Cookie settings” link in the footer. See the Cookie policy for details.
Children and changes
Providing information is optional when browsing the website. If you choose to contact us, we need enough information to respond. We do not make decisions about people solely by automated means that produce legal or similarly significant effects. This business website is intended for adults acting in a business or professional capacity and is not directed to children. We may update this notice when our practices or legal requirements change. The current version and its update date will be posted here.