Data protection and UK GDPR

This page explains our approach to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It sits alongside our privacy policy, which lists exactly what we collect. This is general information, not legal advice.

Our roles

• Controller for the details of business owners who sign up (email, business details, payment records).
• Processor for the bookings and client details a business owner enters or collects through their booking page. The business owner is the controller of that data and decides what to do with it. We only store and process it to run the service.

What we promise business owners (processor commitments)

• We only use your clients’ data to provide Bookable to you, and never for our own marketing or to sell.
• Everyone who can access the data is bound by confidentiality.
• We keep the data secure (see below) and tell you without undue delay if we find a breach that affects you.
• We help you answer your clients’ requests to see, correct or delete their data. You can delete bookings and your whole account in the app.
• When you delete your account we delete your business, bookings and clients, except payment records we must keep for accounts and tax.
• We only use the sub-processor listed below, and will update this page if that changes.

Security

• Everything is sent over encrypted HTTPS connections.
• Passwords are never stored. We keep a salted, hashed version, strengthened with a secret key kept outside the database.
• Each owner can only see their own bookings and clients. Our admin area shows business and payment information, not client names or phone numbers.
• Admin access needs a private access code, with limits on repeated attempts.
• Sign-in attempts and booking requests are rate limited, and the temporary anti-abuse records (including IP addresses) are deleted automatically within about 24 hours.
• The database can be backed up and restored to an earlier point in time if something goes wrong.
• No card or bank details are stored.

Where data is stored

Bookable is hosted on Cloudflare, which provides our servers and database. Cloudflare may process data in the UK, the European Economic Area and other countries, using recognised safeguards for transfers outside the UK. Cloudflare is our hosting provider. Telegram is used only to send private alerts to the owner, with a masked email address, never client data.

Lawful bases

• Providing the service you signed up for: contract.
• Security and preventing abuse: legitimate interests.
• Keeping payment records: legal obligation (accounts and tax).

Your rights

You can ask us to see, correct or delete your personal data, restrict or object to its use, or receive a copy. Clients of a business should contact that business first, as it decides how the data is used, and we will help. We reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Breaches

If a personal data breach puts people at risk, we will tell the affected business owners without undue delay and report it to the ICO within 72 hours where the law requires.

Contact

websitebuilds01@gmail.com

Common questions