Privacy Policy

This privacy policy applies to Getabooking Ltd (trading as getabooking.co.uk)

1. Information We Collect

We collect information you provide directly to us:

• Account Information: Name, email address, business details
• Business Content: Service descriptions, images, pricing, availability
• Customer Booking Data: Names, contact details, booking preferences (processed on behalf of service providers)
• Custom Booking Information: Additional information requested by service providers through custom booking fields, which may include dietary requirements, preferences, notes, or other service-specific details as defined by the service provider
• Payment Information: Processed securely by Stripe (we do not store payment card details)
• Usage Data: How you interact with our platform, IP addresses, browser information

2. How We Use Your Information

We use collected information to:

• Provide and maintain our booking platform service
• Process bookings and facilitate communication between businesses and customers
• Send service-related communications and updates
• Improve our platform and develop new features
• Ensure platform security and prevent fraud
• Comply with legal obligations

3. Legal Basis for Processing (GDPR)

We process personal data based on:

• Contract Performance: To provide our booking platform service
• Legitimate Interest: To improve our service and ensure security
• Consent: For marketing communications (where applicable)
• Legal Obligation: To comply with applicable laws

4. Information Sharing

We may share information with:

• Service Providers: AWS, Stripe, and other technical service providers
• Business Customers: Customer booking details are shared with the relevant service provider
• Legal Requirements: When required by law or to protect our rights

We do not sell personal data to third parties.

4a. Data Processing on Behalf of Service Providers

When you make a booking, the service provider acts as the Data Controller for your booking information, and GetaBooking acts as the Data Processor.

• Custom Fields: Service providers may create custom fields to collect information specific to their services. We store and process this data solely on their behalf and instructions
• Your Rights: For questions about specific data requested in custom fields, contact the service provider directly
• Our Role: We do not use custom field data for our own marketing or profiling purposes

Service providers are responsible for the data they request through custom fields.

5. Data Security

We implement enterprise-grade security measures to protect your data:

• AWS Infrastructure: Hosted on Amazon Web Services with multiple security layers including physical security, network security, and access controls
• Data Encryption: All data is encrypted in transit (HTTPS/TLS) and at rest using AWS encryption services
• Multi-Factor Authentication: AWS infrastructure protected by multi-factor authentication and role-based access controls
• Regular Security Updates: Automated security patches and monitoring across all systems
• Database Security: Encrypted databases with restricted access, regular automated backups, and Point-in-Time Recovery (PITR) allowing restoration to any moment within the last 35 days
• Network Security: AWS Virtual Private Cloud (VPC) with firewall protection and intrusion detection

While we implement industry-leading security measures, no internet transmission is completely secure, and we cannot guarantee absolute security. AWS maintains SOC 2, ISO 27001, and other security certifications.

6. Data Retention

We retain personal data for as long as necessary to provide our services and comply with legal obligations. Account data is retained while your account is active. Booking data may be retained for up to 7 years for business and tax purposes.

7. Your Rights (GDPR)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a structured format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Where processing is based on consent

To exercise these rights, contact us at admin@getabooking.co.uk

8. Cookies and Data Storage

We do not use cookies for essential platform operation. Instead, we use browser localStorage to store authentication tokens and user preferences locally on your device.

We use analytics cookies (Google Analytics) to improve our website experience. You can control analytics cookie settings through your browser preferences or our consent banner.

9. Traffic Source Analytics

We collect IP addresses and HTTP referrer information to understand where our traffic originates (e.g. whether visitors arrive via a search engine, social media, or a direct link). This helps us and our business customers understand how people find their booking pages.

• This data is only collected when you accept cookies via the consent banner
• IP addresses are used for traffic source identification and are not used to build individual user profiles
• The legal basis for this processing is consent (provided via the cookie consent banner)

If you do not wish for this data to be collected, simply reject cookies when prompted by the consent banner.

10. International Transfers

Your data may be processed in countries outside the UK/EU where our service providers operate. We ensure appropriate safeguards are in place for such transfers.

11. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect personal data from children under 16.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through our platform.

13. Financial Relationship Disclaimer

GetaBooking Ltd is not responsible for the financial or contractual relationship between customers and businesses using our platform. All payments, refunds, and financial disputes are handled directly between customers and the individual businesses.

14. Contact Information

For privacy-related questions or to exercise your rights, contact the Data Controller:

• GETABOOKING LTD
• Email: admin@getabooking.co.uk
• ICO Registration: ZC056548
• You also have the right to lodge a complaint with the Information Commissioner's Office (ICO)

15. Google API Disclosure

GetaBooking's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use Google Data:

• Google Calendar Access: We only access your Google Calendar to sync your availability, display your existing appointments (to prevent double-bookings), and add new bookings made through your GetaBooking storefront.
• Data Storage: We do not store your full calendar history. We only process data necessary for the current booking period.
• Data Sharing: We do not share or sell your Google user data to third parties, and we do not use it for serving advertisements or for any purposes other than the booking services described above.