Privacy notice

1. Who is responsible

Golf Consult AS (organisation number 922 561 095), Nicolas vei 15, 4515 Mandal, Norway, operates bukk.io. Contact support@bukk.io about privacy or to exercise your rights.

We determine how personal platform accounts, security and our own customer relationships are managed. For tenant lists, access permissions and bookings managed on an organisation’s instructions, that organisation normally determines the purposes and we act as its processor. The relevant building or employer is responsible for explaining its own use of these records. Roles depend on the actual activity, not just an account label.

2. Information and sources

You provide mobile number, name, email and any profile changes. An administrator may provide your contact details, company and building access when inviting you. Bookings can contain room, time, participants or customer details, optional notes, selected extras, billing information, prices and payment status.

We process authentication and recovery records, permissions, security events, IP-derived abuse-prevention identifiers and technical request information. Hosting and security providers also receive network and device information needed to deliver their services. Public room descriptions, prices, building contact information and images are visible to anyone.

When you purchase a subscription, Paddle provides subscription and transaction identifiers, status and relevant customer or billing details. Subscription card details are entered into Paddle’s checkout rather than bukk.io forms.

3. Purposes and legal bases

We use account and contact information to provide requested account services, authenticate users, respond to support requests and manage business customer relationships. For a contract with an individual the basis may be GDPR Article 6(1)(b); for business representatives and service administration we rely on the legitimate interests described below, Article 6(1)(f).

Our legitimate interests are operating a reliable booking service, managing customer relationships, preventing abuse and protecting accounts. Processing must be necessary and proportionate, and we consider the rights of affected people. Applicable accounting or other legal duties may require processing under Article 6(1)(c).

Where we act as processor, the building customer determines and documents the legal basis. Optional marketing or non-essential tracking would require a separate assessment and, where required, an optional consent. Accepting service terms is not blanket consent to personal-data processing.

We do not use booking notes to train an AI model or carry out automated decisions producing legal or similarly significant effects. Your own connected agent can process information it receives under the permissions you grant, subject to that provider’s terms.

4. Recipients and external services

Authorised building administrators and, where relevant, company administrators can see information needed for their roles. Suppliers can receive order details when a booking includes their services. Other tenants do not receive your private profile merely because they share a building.

We use Vercel for application hosting, Neon for the database, Twilio for mobile verification and messages, Cloudflare Turnstile for abuse protection, Vercel Blob for uploaded room images and Resend for transactional email. These services receive the information needed for their functions, as described in the supplier register.

Explore requests map resources from OpenFreeMap. Room images may be loaded from Vercel Blob. These providers receive request information such as your IP address when their content loads. The browser-storage page explains these requests.

Building-selected payment and accounting providers, such as Vipps and PowerOffice, process the room-booking information needed for the selected transaction. They are distinct from the Paddle subscription integration. Paddle acts as an independent controller for its own checkout and payment activities, under its privacy notice and data-sharing terms.

• Cookies and browser storage
• Paddle privacy notice
• Supplier register

5. Locations and transfers

The current primary application and database region is Frankfurt, Germany. This does not mean every support, CDN, messaging or security operation takes place in the EEA. Provider processing and access may occur elsewhere.

Some of our providers are based in the United States and use international infrastructure or support teams. Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and any necessary supplementary measures. The supplier register links to each provider’s processing and transfer information. Contact support@bukk.io for information about the safeguards applicable to your data or a copy, with confidential information redacted where necessary. No EU-only processing guarantee is made.

6. Retention and deletion

Account data is kept while the account and its services are needed. Self-service deletion removes identifying profile and membership details, revokes access and agent connections, cancels future bookings where possible and clears personal booking notes and queued notifications. An unresolved booking cancellation or sole-administrator role may need to be addressed first.

Deletion is not a promise that every record disappears immediately. Historical transaction, payment, supplier and invoice records may remain where necessary for the organisation’s records, applicable legal duties or resolving a dispute. External providers and backups have separate retention rules. Removing access to one building does not erase the account or records required by that building.

The retention notice explains the purposes and criteria used for different records, account deletion and assisted export. Expiry of a sign-in code or token prevents its use but does not by itself erase its database record. Periodic history cleanup is not currently automatic; requests concerning retained information are handled through support.

• Retention schedule

7. Your choices and rights

You may ask for access, correction, deletion, restriction, portability where applicable, or object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. These rights have conditions and exceptions under the GDPR.

Use Settings to update your details, leave a building, revoke an agent or start account deletion. For a copy of your information, guest-booking enquiries or requests that cannot be completed in the app, contact support@bukk.io. We may need proportionate identity verification. We will route requests concerning a building’s records to the responsible organisation where appropriate.

Requests should normally be answered within one month; an extension permitted by law must be explained. You may complain to the Norwegian Data Protection Authority or the supervisory authority where you live or work. Required account details are needed to provide sign-in and booking services; optional notes need not be supplied.

• Norwegian Data Protection Authority