These terms govern the use of the Tidy-Book software-as-a-service (SaaS) platform for managing bookings, memberships and sports-venue operations. They apply exclusively to professionals/businesses.
1. Who we are
TidyBook is the name of the software service for managing bookings, memberships and operations through tidy-book.com and related applications. The âProviderâ is the service provider identified in the Specific Commercial Terms.
Contact: [email protected] (support), [email protected] (contract) and [email protected] (data).
2. Scope - B2B contractual relationship
These Terms of Service are the general contractual terms for business and professional Customers. The Customer initially accepts them through a signed activation agreement or express electronic acceptance by a person authorised to bind its business. Merely visiting the website does not constitute that acceptance.
The Specific Commercial Terms record party details, package/limits, price, billing model, commitment duration, payment schedule and deadlines, specific renewal/non-renewal rules, agreed functions and express departures. In a conflict, precedence is: mandatory law; the DPA for personal-data processing; express commercial terms and special departures for their particular subject; these general Terms as validly amended. Section 19 cannot bypass express special terms or section 18A rights.
This version applies to Customers who initially accept it or sign an agreement expressly incorporating it. Customers with an earlier agreement retain their previous contractual framework and priority rules until they sign a replacement agreement, from its agreed Transition Date. Publication, an informational email or continued use under the earlier agreement does not migrate them to this framework.
End Users purchase the Customer's services and do not enter into this B2B subscription with the Provider. The Customer supplies the sales terms, privacy information and other legally required information for its own services. The Greek version of these Terms prevails over the English translation.
3. Definitions
- "Service": The Tidy-Book platform (web application, APIs, mobile applications) and features.
- "Customer Account": The business account and the staff/administrator users.
- "Customer Data": Personal data and content the Customer enters or manages for its own services, including end-user, staff and instructor data and, where enabled, transaction and receipt data.
- "Sub-processors": Third-party providers that the Provider uses for the Service.
4. Account creation - Security
The Customer designates one or more administrators and is responsible for the accuracy of the information, the security of the credentials and managing access for its users. The Provider stores passwords only with secure hashing and applies technical/organizational security measures. No system guarantees absolute security.
5. Roles and responsibilities regarding personal data (GDPR)
For personal data of end users, staff and instructors entered by the Customer to organise its own services, the Customer acts as Controller and the Provider as Processor under the DPA. For data processed for the Provider's own purposes of managing the relationship, billing its own service, support, security and abuse prevention, the Provider acts as a separate Controller. The role depends on each processing purpose, rather than solely on the person's status.
The Customer ensures lawful collection and use of data it controls, supplies the required information and handles rights requests. The Provider supplies the assistance required by the DPA and law and retains its own obligations. The Privacy Policy and Cookie Policy explain processing; they do not replace the DPA or constitute blanket consent.
The Provider selects infrastructure, hosting operators and processing locations and may change them to meet the Serviceâs needs. No permanent country, region or data centre is agreed unless expressly recorded as a special departure. Routine server or configuration changes within approved infrastructure require no separate notice where they do not change a subprocessor, applicable data safeguards or an express agreement. Adding or replacing a subprocessor follows the DPAâs advance-notice and objection procedure; changes to international transfers comply with lawful instructions and safeguards. The published infrastructure notice states the actual jurisdiction at the relevant time and is updated when it changes; it does not guarantee a permanent location.
6. Use of the Service - Acceptable use
The Customer uses the Service only for lawful purposes, protects credentials and controls user access. Illegal content, infringement of third-party rights, circumvention of security controls and unauthorised access are prohibited. The Customer is responsible for the accuracy of the information it enters and its own business's compliance with applicable law.
Where the Customer's own domain is used, the Customer maintains its registration and renewal, authorises DNS changes and pays third-party costs not expressly included in the subscription. It grants only necessary access and promptly reports changes. The Provider is not responsible for interruptions caused by domain expiry, Customer error or a third-party service outside its control, subject to its own fault and section 16.
7. Standard service â Custom development
The Service is a standard product with its documented and expressly agreed functions. Custom development or adaptations require a separate written agreement. The absence of custom development does not limit the obligation to deliver agreed core functions with reasonable care. Sections 8 and 15 apply.
The Provider may change or withdraw free additional features or features expressly labelled beta/preview and offer them as optional paid features, with at least 30 daysâ email notice. Urgent changes required by law, security or a third-party service withdrawal are notified as soon as possible. No automatic new charge arises without acceptance. A material reduction of expressly agreed core paid functions follows section 19 and termination/refund rights; relabelling alone does not turn them into free features.
8. Availability - Maintenance - Incident handling
The Provider uses commercially reasonable efforts to operate the Service and restore interruptions. Unless a separate service-level agreement (SLA) is expressly agreed in writing, there is no agreed uptime percentage, uninterrupted operation, 24/7 support, standby staff or guaranteed response/recovery time. Maintenance, updates, errors, equipment failures, networks and third-party services may cause interruptions. Advance maintenance notice is given where feasible; urgent maintenance or data protection measures may be taken immediately.
Support is provided through the listed email addresses within a reasonable time, taking account of severity, complexity and actual ability to respond. The Customer maintains a practical alternative way to handle bookings, collections, communications and lawful fiscal issuance so that its business does not depend exclusively on continuous Service availability.
Force majeure and non-culpable impediments: neither party owes damages for delay or inability to perform to the extent it proves that an event beyond its reasonable control, for which it is not at fault, could not reasonably be prevented or overcome. Where these conditions are met, examples include natural disasters, war, public-authority actions, general power/network outages, unavoidable failures or attacks, and sudden serious illness, hospitalisation, accident or incapacity of the Provider objectively preventing necessary work. The Provider may suspend affected work for the duration of the actual impediment. Notice is given as soon as objectively possible and reasonable measures are taken to mitigate consequences.
If continued service becomes unfeasible, section 18 governs termination, proportionate refunds of unearned prepayments and preservation of retrieval rights. Refunding fees for an unprovided service is not compensation for lost profits. Illness, an attack or a third-party failure does not automatically excuse the Providerâs own fault, statutory security duties or subprocessor responsibility that cannot be excluded. Section 16 applies.
9. Mobile apps (Android/iOS) - Specifics
The mobile apps are distributed through the Apple App Store/Google Play. Updates/fixes may be delayed due to build, testing and store-approval processes. The Provider may discontinue support for older versions. Functionality may differ between web and mobile.
10. Payments - Stripe, on-site payments and receipts/myDATA
The Customer may accept payments through an independent provider such as Stripe or on site. Tidy-Book supplies the technical integration and does not itself provide payment, settlement or banking services. It does not store full card details. The Customer is responsible for its payment-provider account, accurate information, required verification, settlement configuration, refunds, disputes and chargebacks.
The Provider is not responsible for fees, delays, account restrictions or failures attributable to the independent payment provider or the Customer. This does not exclude responsibility for its own technical errors or other fault, subject to section 16.
The ERP retail service-receipt feature with direct myDATA transmission is intended only for businesses whose accountant has confirmed in writing that this issuance method is lawful, without a fiscal device or licensed e-invoicing provider, for all fee categories issued through TidyBook: sessions/bookings, subscriptions and tournament entries. Confirmation covers the same VAT rate and classification displayed in settings for all these categories, required purchaser details and any POS-interconnection requirement.
Approval is single; partial activation by category is not available. If the business or any category does not qualify, the Customer does not activate the feature and issues by another lawful method outside TidyBook. Production issuance is activated by the legal representative or a person they authorise, through express acceptance of all settings-page criteria. The Customer keeps the accountantâs written confirmation and deactivates the feature if a change in activities, services, tax configuration or law means any criterion is no longer met.
The Customer is the issuer, in its own name and using its own myDATA credentials. The Provider supplies the software and technical transmission; this feature is not a licensed e-invoicing-provider service and does not issue B2B invoices. The Customerâs duty to ensure lawful issuance does not release the Provider from its own obligations or responsibility for its own error.
Availability or approval does not certify tax eligibility. The Customer/accountant checks displayed issuance/transmission status, AADE acceptance, VAT/classification settings and failures. It reports errors promptly and uses lawful resubmission or alternative issuance procedures within statutory deadlines with its accountantâs guidance. Penalties caused by its own incorrect information/settings or failure to take these steps remain its responsibility to that extent. The Provider uses reasonable professional care to implement supported specifications and notify known failures. It adapts supported functionality by a mandatory deadline where final specifications, access and necessary third-party services are made available with reasonable implementation time; otherwise it notifies the Customer and uses reasonable efforts as soon as technically feasible, temporarily suspending the feature where necessary. Direct ERP transmission does not replace another mandatory lawful issuance method and successful transmission alone does not prove lawful issuance. Liability for the Providerâs own fault is assessed under section 16.
11. Backups - Restoration
A daily backup process uses Hetzner and an additional internal TidyBook process, with rolling retention of thirty (30) days: each new daily copy replaces the copy from 30 days earlier. Daily frequency describes the process and is not a guarantee that every backup completes successfully. Restricted access, reasonable monitoring and attempts to restore from a suitable available copy are applied.
A backup or restore may fail, be incomplete, contain corrupted data or omit the most recent changes. Zero data loss, complete integrity of every copy, successful recovery and a particular recovery time are not guaranteed unless separately expressly agreed in writing. A failed backup or restore alone does not prove fault or breach. Liability depends on the actual obligations and circumstances and is subject to section 16 and the DPA.
The Customer keeps independent copies of critical original information and its fiscal archive at intervals appropriate to their importance, and requests exports where needed under section 18A. It does not treat rolling backups as a permanent archive or its own independent copy. Loss caused or increased by its own actions, deletion, incorrect information or failure to take reasonable mitigation measures is considered in accordance with law. The Providerâs appropriate security/resilience duties are not transferred to the Customer.
12. Deletion of accounts and data - "GDPR Deletion"
Account deletion removes or de-identifies active profile information and stops operational access. Deleting a profile does not delete necessary payment and fiscal records. These are retained with restricted access for seven (7) years after completion of the transaction or the last related fiscal action, whichever is later, and longer only where required by law or for specific pending legal proceedings. Only information necessary for the lawful purpose is retained; identifying information remains personal data. On contract termination, the DPAâs return-or-deletion choice applies. Continued archiving on the Customerâs behalf requires a separate instruction, unless the Provider has a specific legal retention obligation of its own.
Where optional account closure offers a thirty (30) day withdrawal period, this relates to the closure feature and is not a mandatory waiting period for a GDPR erasure request. Rights requests are handled without undue delay, with information within one month and a lawful extension where the conditions apply. Return, erasure, backup access and lawful retention are governed by the DPA, Privacy Policy and law.
13. Intellectual property
The Provider retains intellectual property rights in the Service. The Customer receives a non-exclusive, non-transferable licence during the subscription for its own business and end-user use through available pages/applications. It retains rights in its own content and data. Resale, subletting, unauthorised availability to other businesses, copying protected software/material or using access to copy the Service or create competing software is prohibited. Reverse engineering/decompilation is prohibited to the extent allowed by law; statutory interoperability and portability rights remain.
For non-confidential improvement suggestions voluntarily supplied, the Customer grants the Provider a perpetual, worldwide, non-exclusive licence to use and adapt them without payment, to the extent it holds the necessary rights. This licence excludes personal data, membersâ data and confidential content and does not transfer ownership of Customer data.
The Provider may use genuinely anonymous, aggregated statistics to improve the service without reasonably identifying individuals or revealing a particular Customerâs confidential information. Pseudonymised information remains personal data. Any preceding processing of personal data, including anonymisation, requires the lawful basis/instruction and information that actually apply; this paragraph is not general permission to reuse membersâ data.
14. Confidentiality
Each party protects the otherâs non-public confidential information and uses it only for the cooperation. Exceptions cover information lawfully already known, public without breach, lawfully obtained from a third party or independently developed. Necessary disclosure to bound advisers or as required by law/competent authority is allowed, with advance notice where lawful and practicable. The duty continues after termination while information remains confidential; trade secrets remain protected while they retain that status.
15. Service delivery and warranties
The Service is standard software with documented and expressly agreed functions. There is no guarantee of error-free operation, compatibility with every device or third-party service, a particular commercial outcome, increased revenue or fitness for a special purpose not agreed in writing. The Provider uses reasonable care for agreed core functions and correcting errors. A reported incident is addressed according to severity and technical feasibility; reporting alone does not establish a guaranteed resolution time.
Optional AI assistance through Google Gemini supplies informational answers about using the platform. Answers may be inaccurate, incomplete or fabricated and do not replace an accountant, lawyer, professional advice or official documentation. It is for authorised staff aged 18 or over only. The Customer checks answers before acting and does not submit passwords, card details, health data or unnecessary personal data. Its questions and submitted history are sent to Google to generate an answer; this is not permission for TidyBook to train models on membersâ data.
The Customer remains responsible for its own actions and services, relationships with members/staff, submitted information and decisions. Software or AI assistance does not certify tax, professional or business compliance. Express obligations, the DPA and rights that cannot lawfully be excluded remain.
16. Limitation of liability
To the fullest extent permitted by law, for each successive twelve (12) month period from activation of the Service, including the free trial, the Providerâs total monetary liability to each Customer arising from or connected with the contract/Service, for all claims and regardless of legal basis, does not exceed net subscription fees, excluding VAT, paid or payable for the twelve (12) months before the first causative event assigned to that period. If the relationship is less than twelve months old at that event, including during a free trial, the basis is the agreed annual fee or twelve times the agreed monthly plan fee. Other subscription periods are annualised accordingly. The basis therefore does not become zero simply because the trial is free or the first instalment has not yet been paid.
There is one aggregate limit for all claims together in the same twelve-month period, including claims arising from different or unrelated incidents. Each claim is assigned to the period of its causative event, regardless of when it is asserted. Claims arising from the same or related incidents are all assigned to the period of the first related causative event, even if consequences continue into a later period. No separate limit arises per incident, user, fiscal document, record or claim type. It also applies to contractual DPA claims and indemnity or recourse claims between Provider and Customer, including those connected with GDPR article 82, only to the extent such limitation is lawful.
Where lawful to exclude, indirect or consequential loss, lost profits/revenue, lost bookings or business opportunities, business interruption and reputational loss are not compensated. The Provider does not give a separate guarantee to cover Customer fines, penalties, refunds or third-party claims. Direct loss caused by the Providerâs own fault is assessed under the law and lawful limits of this section.
The Customer reports incidents promptly, provides necessary information, checks critical records/transmissions and takes reasonable steps to prevent or mitigate loss. Its contributory fault or failure to mitigate is considered under Greek Civil Code article 300. These duties do not extinguish a lawful claim merely because notification was delayed.
Exclusions and limits do not apply to intent, gross negligence or other cases where prohibited, particularly under Greek Civil Code article 332, including unlawful ordinary-negligence exemptions in terms not individually negotiated and harm to personality rights. Data subjectsâ rights against any controller/processor, supervisory authoritiesâ powers and mandatory GDPR article 82 liability/recourse are not restricted. An invalid individual exclusion does not invalidate other lawful limits or create liability without its legal conditions.
17. Indemnity
The Customer compensates direct, proven loss and reasonable defence costs from third-party claims only to the extent directly connected with its culpable contractual breach, unlawful content it supplied, unlawful processing for which it is Controller, or its own services to end customers for which it bears legal responsibility. Loss attributable to the Providerâs fault or breach is excluded. This duty does not extend the Customerâs liability beyond those causes.
The Provider promptly notifies the claim and reasonably cooperates. The Customer may conduct the defence with suitable counsel without prejudicing the Providerâs rights. No settlement imposing an obligation on the Customer is agreed without its consent, which is not unreasonably withheld. Both parties reasonably mitigate loss.
18. Term - Termination - Suspension
The trial, term, renewal, ordinary non-renewal and financial obligations for the current period are set out in the Specific Commercial Terms. Merely stopping use does not cancel obligations already undertaken, subject to sections 18A and 19 and mandatory rights. During an agreed free trial, the Customer may leave without a subscription fee for that trial.
The Provider may terminate without Customer fault for technical or business reasons on thirty (30) days' written notice. Prepaid fees for time after termination are refunded proportionately and instalments for that time are not due. Termination for non-payment or a remediable material breach requires written notice and ten (10) days to remedy. Immediate termination is permitted for illegal use, serious security risk or an irremediable material breach. Temporary suspension for the same reasons must be necessary and proportionate, with notice and an opportunity to remedy where feasible. Sudden serious incapacity under section 8 objectively making continuation impossible permits termination on the shortest objectively feasible notice, without guaranteeing an impossible notice period. Proportionate refunds of unearned prepayments, no post-termination instalments and statutory security/retrieval obligations remain. The Provider ceasing operations does not by itself create a claim for lost profits; claims are assessed under section 16.
The Customer may terminate for a material Provider breach not cured within thirty (30) days of written notice, with a proportionate prepaid-fee refund and release from instalments for time after termination. Shorter or immediate statutory termination rights remain available.
Operational use ends on termination. An export or return procedure provides at least thirty (30) calendar days for retrieval after termination and, for switching, after section 18Aâs transitional period. Access for export or exercise of rights is not acceptance of new terms. Return, erasure and specific lawful retention follow section 18A and the DPA.
The Customer consents in advance to transfer of the contract to a company controlled by the Provider or a lawful successor to the business, provided the successor assumes contractual obligations and the DPA in writing. At least 30 daysâ email notice identifies the successor and its contact details. Transfer alone does not increase price or reduce agreed rights and does not release earlier liability that cannot be excluded. Changes to terms or processing/subprocessors follow section 19 and the DPAâs respective procedures. Relevant exit rights remain where there is a material adverse change. Other transfer by the Customer requires prior written consent, subject to mandatory law.
18A. Switching and data portability
18A.1 The Customer may at any time request by email to [email protected] or [email protected] a switch to another provider, porting of all its exportable data and digital assets to its own infrastructure, or erasure only. The agreed notice period for initiating the process is two (2) months after receipt of the request, unless the Provider accepts a shorter period or a mandatory right requires one. This does not delay a separate GDPR rights request or restrict a fee-free exit during the free trial. By its end, the Customer states its choice and, for switching, the necessary details of the destination provider. The parties cooperate in good faith for secure, timely completion.
18A.2 A transitional period of up to thirty (30) calendar days follows the notice period. The contract continues and the Provider gives reasonable assistance to the Customer and authorised third parties, continues agreed functions with due care for business continuity, discloses known risks and maintains a high level of security during transfer and retrieval. It supports the exit strategy with relevant information. The Customer may extend the transitional period once for a period it considers appropriate. If thirty days is technically unfeasible, the Provider gives reasons within fourteen (14) working days of the request and specifies an alternative transitional period of up to seven (7) months, with service continuity.
18A.3 The categories of exportable data and digital assets are: Customer business, location and service details and settings; accounts, members, staff, instructors and guardian relationships; forms, declarations and contacts managed by the Customer; schedules, templates, sessions, assignments, bookings, attendance and standing places; plans, subscriptions, entitlements and balances; payments, refunds, transactions, fiscal documents, issuance/transmission details and AADE identifiers; tournaments, entries, teams, matches and results; Customer access records, notifications and communications; reports, history, activity records and necessary metadata relating to the Customer; content, images and files it supplied or is entitled to use independently of the contract. Data actually held for the Customer and not already lawfully erased is supplied in a structured, commonly used and machine-readable format.
18A.4 No category of the Customerâs exportable data is excluded on trade-secret grounds. The softwareâs source code, the Providerâs internal security secrets and other Customersâ data are not the Customerâs data for export. Separating them cannot impede or delay switching or exclude data or metadata the Customer is entitled to receive.
18A.5 The Provider notifies completion. The contract ends on successful switching or, where erasure only was chosen, at the end of the notice period. A retrieval period of at least thirty (30) calendar days follows the transitional period. After its expiry and successful switching, exportable data and assets are fully erased, including copies under the DPA, except for specific mandatory retention disclosed to the Customer. An erasure election and GDPR rights are honoured without an unnecessary waiting period.
18A.6 No export, switching or data-egress charge is agreed. Such charges are prohibited from 12 January 2027. Agreed subscription fees are due for service until termination. For an annual commitment only the separate, pre-specified proportionate early-termination compensation in section 6.1 of the signed agreement applies, with its breakdown, deductions and exceptions. Future subscription fees for unprovided service or double charging of the same remainder do not arise. Prepayments are credited and any excess refunded. No fee is imposed for exercising data-protection rights and exportable data is not withheld as a collection measure.
18A.7 Exports are arranged by contacting TidyBook at [email protected] or [email protected]. Secure delivery, available formats and assistance are described in the export procedure. Current hosting jurisdictions and relevant safeguards appear in the infrastructure notice and are supplied before contracting. Mandatory rights under Regulation (EU) 2023/2854 remain.
19. Changes to terms
19.1 The Provider may update the general Terms for reasonable service, security or legal needs. This does not change accrued rights retrospectively or alter specific commercial terms. Prices change only through the mechanism agreed in the private agreement; other special departures require both partiesâ acceptance.
19.2 Notice is emailed to the designated Contract Contact and includes the new text or a stable dated link, a short summary, effective date and objection/non-renewal instructions. Posting alone is insufficient. The Customer keeps the contactâs email and authority current.
19.3 Ordinary, non-material changes require at least thirty (30) daysâ notice. Material adverse changes apply at renewal, with at least sixty (60) daysâ notice before annual renewal or thirty (30) days before monthly/other renewal. Late notice postpones application to a renewal meeting that period. In doubt a change is treated as material.
19.4 Changes during a period or on shorter notice are allowed only to the extent required by law/an authority or an immediate security risk. The reason is notified beforehand or as soon as possible. A materially affected Customer may leave without an early-termination charge, with a proportionate prepaid-fee refund and no post-termination instalments. Where notice was shorter than thirty days, it has thirty days from receipt to object.
19.5 Following timely notice, renewal without objection constitutes the acceptance agreed in advance for the new version. An objection by renewal means non-renewal unless otherwise agreed, even after the usual non-renewal deadline. An ordinary in-term update requires express acceptance or personal operational use by the Contract Contact/legal representative after the effective date without objection. Other staff, end users, automation and access solely for export/rights do not count. Without acceptance the previous version remains; applying an update at renewal requires fresh timely notice. Use pending exit does not undo an objection. Notices may go to [email protected] or [email protected]. If the previous version cannot be continued, the Provider may terminate on thirty daysâ notice with section 18âs refunds.
19.6 The Provider keeps dated versions and evidence of notice, delivery and acceptance. A Customerâs applicable version need not be the latest posted version. The DPA and subprocessor changes follow their own procedure. Privacy/cookie policies provide information; continued use does not supply consent where consent is required.
20. Governing law - Jurisdiction
Greek law applies. For B2B contractual disputes the parties agree to the courts having subject-matter jurisdiction for the Providerâs registered seat in Aigio, where an agreement on territorial jurisdiction is permitted. Mandatory jurisdiction rules and supervisory authoritiesâ competence remain.
21. Contact
For support: [email protected]. For personal data: [email protected].