Terms for the Bookhavn salon pilot
1. Parties
The agreement is between the salon creating an account and Bookhavn’s operator.
The operator’s legal details have not yet been completed. No paid agreement will be entered into before its identity is published.
2. The service
Bookhavn provides online booking, calendars, customers, services and staff management for smaller salons. The pilot includes help moving relevant data from an existing system or spreadsheet.
The salon is responsible for accurate information, lawful customer communications and deciding who has access to the account.
3. Trial, pricing and payment
Creating a salon starts a free trial of 30 days with full access. The trial requires no payment card and does not automatically renew as a paid subscription.
The subscription is a fixed amount per business, regardless of staff count: 299 DKK excl. VAT per month. Amounts exclude VAT.
When the trial expires, the salon’s data remains available and paid modules are disabled until a subscription is activated. A paid subscription can only begin after separate acceptance of the price and payment terms.
4. Beta status and operation
Bookhavn is a beta version. There is no uptime or response-time guarantee, and features may change during the pilot. Scheduled maintenance and faults may make the service unavailable.
Bookhavn maintains operational logs and uses the documented backup arrangements, but does not guarantee against data loss beyond what can actually be recovered from available backups. The salon should retain its original export during migration.
5. Liability
The parties are liable under the general rules of Danish law. Bookhavn is not liable for indirect loss, business interruption or lost profits. During the free pilot, any aggregate liability is limited to documented direct losses, unless that limitation is unlawful.
6. Termination and data
Either party may end the pilot in writing without notice. Before termination, the salon can download customer information using the export feature. After termination, data is returned or deleted at the salon’s choice unless the law requires retention.
7. Personal data
The salon is the controller of its customers’ data and Bookhavn is the processor. The data processing agreement below forms part of the pilot terms. See also the privacy policy.
8. Governing law
The agreement is governed by Danish law. Disputes will first be addressed through dialogue and may subsequently be brought before the Danish courts.
Data processing agreement for the Bookhavn pilot
Last updated 25 July 2026.
This agreement supplements the pilot terms. The salon is the controller and Bookhavn’s legal operator is the processor. The operator’s name, Danish business registration number (CVR) and address must be completed in Bookhavn’s public company information before a salon is onboarded.
1. Subject matter and duration
Bookhavn processes personal data to provide online booking, calendars, customer records, services, staff management, data export and the agreed migration assistance. Processing continues while the pilot or subscription agreement is active and until the data has been returned or deleted.
2. Data subjects and personal data
Data subjects are the salon’s customers, account users and staff. Data may include names, contact details, addresses, birthdays, booking and service history, notes, marketing and reminder preferences, consent history, sales metadata and necessary login, security and operational information.
Danish personal identification numbers (CPR numbers) and treatment records are disabled during the pilot. The salon must not send or enter health information or CPR numbers.
3. Instructions and confidentiality
The processor may process data only under this agreement, the pilot terms and documented instructions from the salon, unless EU or Danish law requires otherwise. Anyone with access to the data must be bound by confidentiality.
The processor provides reasonable assistance with access, rectification, export, restriction, anonymisation and deletion. The built-in GDPR features allow administrators to export JSON, anonymise and delete data.
4. Security measures
The verified technical and organisational measures are:
- authenticated administration pages and server-side checks of the user’s business and administrator role;
- tenant isolation using
businessIdin customer, booking and export queries; - TLS through Caddy and Cloudflare on the public preview;
- secrets supplied as environment variables rather than embedded in source code;
- Postgres on a private Docker network with a persistent volume;
- operational logs and a documented procedure for backup, restoration and incident investigation;
- clinical API routes and CPR writes disabled by default;
- analytics and marketing telemetry forcibly disabled during the pilot.
5. Subprocessors
The salon approves the following subprocessors for the pilot environment:
| Provider | Purpose | Processing country |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting in nbg1 | Germany |
| Resend | System email delivery through SMTP | USA |
| Cloudflare | DNS, proxy, access protection and traffic filtering | USA/EU |
The processor must ensure a valid transfer basis for transfers outside the EU/EEA and notify the salon before material changes to this list. Stripe, Twilio and PostHog are not active subprocessors during the pilot.
6. Personal data breaches
The processor notifies the salon without undue delay after becoming aware of a breach. The notification describes, to the extent information is available, the incident, affected data and data subjects, likely consequences and remediation.
7. Termination, deletion and return
On termination, the salon may request a data export. Personal data is then deleted or anonymised at the salon’s choice, unless retention is required by law. Temporary GDPR export requests expire after seven days.
8. Audit
The processor makes relevant information about the described measures available and accepts one reasonable audit per year with advance notice. Additional audits may take place following a documented security breach. An audit must not compromise other customers’ data or the security of the service.
9. Contact and governing law
Enquiries should be sent to the support address shown on Bookhavn’s contact page. This agreement is governed by Danish law.