Privacy Notice

Capsule Technologies Ltd, Business House Suite 7, Triq l-arcisqof Pietru Pace, Victoria, Gozo, VCT 2504, Malta, is controller for Booqiva account, subscription, website, security and support data. Contact support@booqiva.com for privacy matters.

For personal data that a rental company enters about its customers, workers and partners, that company is normally the controller and Booqiva acts as processor under the DPA.

• Account identity, contact details, roles, authentication and security events.
• Workspace configuration, locations, inventory, bookings, customers, documents and operational audit logs.
• Subscription customer IDs, invoice status and limited payment metadata from Stripe; not full card numbers.
• Support messages, service communications and product feedback.
• Technical logs, device/browser information, approximate network data and consent preferences.
• Where enabled by a customer: time-clock location and selfie evidence, subject to the customer's workforce notice and retention settings.

• Perform the subscription contract and provide requested platform features.
• Meet legal, accounting, security and fraud-prevention obligations.
• Operate, secure, support and improve the service under legitimate interests balanced against user rights.
• Send optional marketing or activate non-essential analytics only where valid consent is required and obtained.

For subscription invoicing we process the customer's legal name, registered address, country, company registration number, VAT number, billing contact and Stripe customer and invoice references. We use this information to perform the contract, apply tax rules, verify intra-EU VAT status where relevant, maintain accounting records and prevent billing fraud.

We disclose only what is necessary to authorised staff, the customer organisation and the providers in our Sub-processor List. Providers may process data outside the EEA. Where required, we rely on adequacy decisions, Standard Contractual Clauses and supplementary safeguards.

Account and contract records are retained while the account is active and for the applicable statutory limitation period. Security and audit logs use documented, purpose-limited schedules. Financial documents follow configured legal retention. Attendance selfies and precise location evidence must use short customer-configured periods and are not used for facial recognition.

Backups expire on a rolling schedule. Deletion may be delayed where law, disputes, fraud prevention or security preservation requires it.

Subject to applicable law, individuals may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier processing. Contact support@booqiva.com. We may need to verify identity.

If Booqiva processes data only for a customer, we will direct the request to that customer. Individuals may complain to Malta's Information and Data Protection Commissioner or their local supervisory authority.

Strictly necessary technologies support login, security and saved consent. Optional analytics or marketing technologies remain disabled until the relevant choice. See the Cookie Policy. Transactional service messages cannot always be opted out of while an account remains active.

We use access controls, encryption in transit, managed storage, monitoring, backups and tenant isolation. No system is completely secure, so suspected incidents should be reported promptly. Booqiva does not use solely automated decisions producing legal or similarly significant effects on platform users.

Booqiva is a business service and is not directed to children. We may update this notice for material service, provider or legal changes. Material changes are communicated and, where required, renewed consent or acknowledgement is collected.