Legal

Terms and conditions

Last updated: 27 September 2026

This English version is a courtesy translation. In the event of any discrepancy, the Spanish version shall prevail.

1. Purpose

These terms and conditions govern the subscription to and use of the BookingForNow service (hereinafter, “the Platform”), owned by David Suárez Marra, with tax ID (NIF/CIF) 53504952Y. By creating an account, the user declares that they have read these terms and expressly accepts them by ticking the corresponding box on the sign-up form.

2. Description of the service

BookingForNow is a software-as-a-service (SaaS) solution for managing online appointments and bookings, for professionals and businesses in any sector that work by appointment. It includes a calendar, client records, an online booking page, reminders (depending on the plan) and management of the business’s activity. The service is provided “as is” and may evolve with new features or improvements.

3. Plans and prices

The Platform offers the Free (€0), Starter (€29/month or €290/year) and Pro (€79/month or €790/year) plans, with different limits and features. Prices are stated and charged in euros (EUR), regardless of the currency the business sets for its own services, and any applicable taxes will be added to them. The current details of each plan are published on the pricing page of this website.

4. Trial period

When an account is created, a 14-day trial period is offered with the features of the Pro plan, with no card required. During the trial, as on the Free plan, the booking page, the appointment portal and the emails to the business’s clients show the line “Bookings powered by BookingForNow”; in addition, after booking and in the appointment portal, its clients see an invitation to create their own booking page, and the appointment they add to their calendar includes a line with a link to the Platform. None of this appears on the Starter and Pro plans. At the end of the trial period, the account moves to the Free plan unless a subscription plan is purchased.

5. Payments and renewal

Subscription payments are processed through Stripe. The subscription renews automatically for periods equal to the one purchased, unless cancelled beforehand. Amounts are charged in advance to the payment method associated with the account.

6. Cancellation

You can cancel the subscription at any time from your account (Settings → Billing & subscription). Cancellation takes effect at the end of the period already billed; unless otherwise provided by law, amounts already paid are non-refundable.

7. Service availability

The Platform is provided on a reasonable-effort (best-effort) basis. We do not guarantee uninterrupted availability and may carry out maintenance work that temporarily affects the service.

8. User obligations

The user is responsible for the lawful use of the Platform, for the accuracy of the data they enter and for compliance with the applicable regulations regarding the data of their own clients and staff, for which they act as the data controller. The Platform processes that data as a processor under section 9. The processing for which the Platform is the controller is described in our Privacy policy.

9. Data processing agreement

This section is the data processing agreement required by Article 28(3) of Regulation (EU) 2016/679 (GDPR). For the personal data that the business records on the Platform, the user, or the business on whose behalf they subscribe, acts as the controller (“the controller”) and David Suárez Marra, owner of the Platform, as the processor (“the processor”). It forms part of these terms and is accepted with them when the account is created.

9.1. Subject matter, duration, nature and purpose

The processor processes, on behalf of the controller, the personal data that the controller enters on the Platform or that is collected through its booking page, for the sole purpose of providing the calendar and booking service described in section 2. The processing is automated and consists of hosting, recording, organising, consulting, modifying, exporting and erasing that data, and of sending, on the controller’s behalf, the service emails to its clients (appointment confirmations and, depending on the plan, reminders). The agreement lasts as long as the contract: while the account exists, on any plan, and it ends when the account is closed, which the controller may request at any time by writing to soporte@bookingfornow.com.

9.2. Types of data and categories of data subjects

  • Data subjects: the business’s clients (and the contact persons the controller links to them) and its staff (the professionals in the calendar and the account’s users).
  • Identification and contact data: first name and surname, phone number, email address and postal address and, if the controller records them, identity document number, date of birth and a family contact.
  • Appointment and management data: date, time, service, professional and status of each appointment, session packs and invoices.
  • Content the controller chooses to enter: clinical or progress notes on each client, other notes, tags, attached documents and signed consent forms.
  • Technical connection data: the IP address and browser of whoever books online, of whoever signs a consent form and of the account’s users, and the email address or phone number of whoever books online. They are kept for security and to evidence each booking and each signature: with the signed consent form and in the audit log, which is deleted after 3 years.

The Platform allows clinical or progress notes to be kept, but it does not replace a full medical records system. If the controller chooses to record health data or other special categories of data (Art. 9 GDPR), for example in clinical notes, attached documents or consent forms, it is the controller’s responsibility to have a legal basis that allows it and to comply with any additional obligations that apply to it, including keeping clinical records for the period required by law.

9.3. Obligations and rights of the controller

The controller warrants that it has a legal basis to process the data it enters and to entrust its processing, that it informs its clients and staff accordingly and that its instructions comply with the law. It handles data subjects’ requests with the Platform’s tools and the processor’s assistance described in section 9.4. It has the right to give instructions on the processing, to receive the information and carry out the audits provided for in that section, to object to new sub-processors and to have its data erased or returned when the agreement ends.

9.4. Obligations of the processor

The processor undertakes to:

  1. Process the data only on documented instructions from the controller, which are these terms and those the controller gives when configuring and using the Platform, including with regard to international transfers. It will not use the data for its own purposes or disclose it to third parties, except to the sub-processors in section 9.5 or where required by Union or Spanish law; in that case, it will inform the controller beforehand, unless the law prohibits it. If it considers that an instruction infringes data protection law, it will inform the controller immediately. The aggregate measurement of visits described in section 4 of the Privacy policy, which the Platform carries out as controller on all its pages, including the booking page, without cookies or persistent identifiers, falls outside this agreement.
  2. Ensure that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
  3. Implement the technical and organisational measures appropriate to the risk required by Art. 32 GDPR, including: encrypted communications (HTTPS), access with username, password and role-based permissions, separation of each business’s data, rate limits against abuse, encrypted daily backups and a log of the changes made to the account.
  4. Engage sub-processors only under the conditions of section 9.5.
  5. Assist the controller in responding to data subjects’ requests. The Platform allows the controller to consult, correct, export and anonymise its clients’ data; anonymisation does not extend to the technical connection data in section 9.2, which is kept as stated there. If a data subject contacts the processor, the processor will forward the request to the controller without delay and will not handle it itself.
  6. Assist the controller, with the information available to it, in complying with the obligations of Arts. 32 to 36 GDPR: security of processing, notification and communication of personal data breaches, data protection impact assessment and prior consultation.
  7. Notify the controller, without undue delay and by email to the account’s address, of any personal data breach affecting its data that it becomes aware of, with the information available to document it and, where applicable, report it to the supervisory authority and to the data subjects.
  8. When the agreement ends, erase or return the data, at the controller’s choice, and delete existing copies, unless a legal provision requires them to be kept. Before closing the account, the controller can export its client list from the Platform and, on request, the processor will provide a copy of its other data in a structured, commonly used format. Backups are deleted when the retention periods stated in the Privacy policy expire.
  9. Make available to the controller the information necessary to demonstrate compliance with these obligations, and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by it, with reasonable notice and without compromising the security or confidentiality of the data of other clients of the Platform.

9.5. Sub-processors

The controller gives a general authorisation for the processor to engage other processors (sub-processors). The current list is as follows:

  • Supabase — database and authentication (hosting of account and appointment data).
  • Vercel — hosting of the web application.
  • Resend — sending of the service emails, such as appointment confirmations and reminders.
  • Cloudflare — content delivery network (CDN) and anti-bot verification (Turnstile) on the booking forms.

Stripe, which processes the subscription payment, only processes the business’s account data, for which the Platform is the controller, and plays no part in this agreement. Some sub-processors may process data outside the European Economic Area; in that case, the transfer is covered by the GDPR safeguards stated in the Privacy policy, mainly the European Commission’s Standard Contractual Clauses. Each sub-processor is bound, through its data processing agreement, by data protection obligations in accordance with Art. 28(4) GDPR, and the processor remains liable to the controller for their performance.

Before adding or replacing a sub-processor, the processor will update this list and notify the controller by email with reasonable notice. If the controller objects on reasonable data protection grounds, it may terminate the contract and request the closure of the account before the change takes effect.

10. Limitation of liability

To the maximum extent permitted by law, the Platform shall not be liable for indirect damages, loss of profits or loss of data arising from the use of, or inability to use, the service. Nothing in these terms excludes liability that cannot be limited by law.

11. Changes

We may amend these terms to adapt them to legal changes or changes to the service. Material changes will be notified with reasonable notice; continued use after they come into force implies their acceptance.

12. Governing law and jurisdiction

These terms are governed by Spanish law. For the resolution of any dispute, the parties submit to the courts and tribunals that have jurisdiction under the applicable regulations, without prejudice to the rights of consumers.

13. Contact

For any query about these terms, you can write to us at soporte@bookingfornow.com.