Privacy

Bookables is a booking platform for service businesses of every kind, and for the people who book them. This policy covers three kinds of people, because our responsibilities are different for each:

• Businesses: the owners and team members who run a business on Bookables.
• Customers: people with their own Bookables account, used to book services, see their bookings and manage the businesses they book with.
• Customer records: people who do not have a Bookables account, whose details a business has entered so that it can manage their bookings.

Our responsibilities differ between the three, which we explain in the roles section below. In this policy, “personal information” has the meaning given in the Privacy Act 1988 (Cth), and includes “personal data” as defined in the laws of the other countries we operate in.

Bookables is operated by Bookables Pty Ltd (ABN 66 157 655 346), a company incorporated in Australia with its registered office at 50 Bridge St, Sydney NSW 2000, Australia. For the purposes of the Privacy Act, and as the controller under the GDPR and UK GDPR where they apply, Bookables Pty Ltd is the entity responsible for the personal information described in this policy, except where we are handling a customer record on a business’s behalf.

You can contact us about privacy via our contact page.

If you hold a Bookables account, whether you run a business or book services for yourself, we collect and handle your information directly and are responsible for it under this policy. You can ask us for access or correction yourself, and you do not need to go through anyone else.

If you are a customer record without an account, the business that entered your details decides why and how that information is used. We hold and process it on that business’s behalf and under its instructions in order to provide the Service to them, and we do not use it for our own marketing. If you want to access or correct it, contact the business you booked with, and we will support them in responding. You are welcome to contact us and we will help you work out who holds your details.

A customer record becomes a customer when the person creates a Bookables account with the same verified email address. From that point the first paragraph applies to them and we are responsible for their information directly. How that link is made is explained in how your account connects to businesses below.

You may find that a business already holds your details in Bookables before you have signed in. Here is exactly how that happens.

When you book with a business, or when a business you deal with adds you as a customer, they create a record of you that includes your contact details. If the email address on that record matches the email address you have verified on your own Bookables account, we link the two automatically. That is what lets a booking made with a business show up in your account, so you can see it and manage it yourself.

We only ever match on an email address that the account holder has verified, never on an unverified sign-up or a pending change of email, so a business cannot reach into your account by typing in an address that is not yours.

Because you may book with several businesses, we hold a view of your bookings across all of them, and we use it to serve you. A business only ever sees its own records of you. It cannot see your bookings or messages with any other business.

Account and profile information

• your name, email address and, if you add it, your mobile number. Bookables has no passwords: you sign in with a code we email you, or with Google;
• if you sign in with Google, the basic profile information (name and email address) Google shares with us;
• business details such as the business name, trade, services, prices, opening hours, location and service areas;
• team members a business invites, and their roles and permissions.

Customer and booking data a business enters

• its customers’ names, contact details and addresses;
• booking, job, enquiry, quote, invoice and receipt records, and the notes or messages the business adds;
• payments the business records as received, by cash or bank transfer. Bookables does not take or hold payments and never collects card details.

Your household

• where you hold a personal Bookables account, the people, pets, homes, vehicles and other things you save so that you can book for them, including children where a booking is made for them. We call this your household. It is shared only with a business you book with, and only the entries that booking is for.

Your bookings across businesses

• where you hold a personal Bookables account, the bookings, enquiries and messages you have made through Bookables with every business, and the list of businesses linked to your account.

Conversations

• messages you send through the Service, to a business or to us.

Billing information

• for a business on a paid plan, its plan, its bookings or live bookables, which is what its bill is made from;
• payment card details for a plan are collected and stored by our payment processor and are not stored on our servers. We receive limited information such as the last four digits of the card and its status.

Technical and usage information

• authentication and session data needed to keep you signed in;
• device and log information such as IP address, browser type and actions taken in the Service, used to operate, secure and improve it;
• a record of what happened on each booking, enquiry, listing and account, with who did it and when, which is how the Service shows history and settles disputes;
• location and mapping data, such as addresses you enter that are geocoded to coordinates and shown on maps.

No health information

Bookables does not ask for, and its forms do not have a place for, health information. A business may need to know things that affect its work, such as an allergy or access needs. It asks you for those itself, and they are its records, not ours.

We collect personal information directly from you where reasonable and practical, for example when you create an account, enter customer and booking details, or contact us. Where you provide us with information about another person, you confirm you are entitled to do so.

We collect, hold and use personal information for the following purposes:

• to create and administer your account;
• to provide the Service, including bookings, scheduling, enquiries, quotes, invoices, mapping of service areas and customer records;
• to show a business’s listing to people looking for what it does, in the market it works in;
• to send transactional messages such as booking confirmations, reminders, receipts, sign-in codes and account notifications;
• to bill a business for its plan;
• to provide support and respond to your enquiries;
• to keep the Service secure, prevent fraud and abuse, and diagnose problems;
• to link a business’s record of you to your own Bookables account, using your verified email address, so that you can see and manage your bookings;
• to check a claim on a listing, or a request to remove one, as set out in our listings and claims policy;
• to market Bookables and the kinds of services available on it to account holders who agreed to receive it;
• to improve and develop the Service; and
• to comply with our legal and regulatory obligations.

We will only use or disclose personal information for the purpose for which it was collected, for a related secondary purpose you would reasonably expect, where you have consented, or where we are otherwise permitted or required to do so by law. Where the GDPR or UK GDPR applies, our lawful bases are performance of our contract with you, our legitimate interests in running and securing the Service, your consent where we ask for it, and compliance with law.

We send marketing only to people who hold a Bookables account and who agreed to receive it. If your details were entered by a business and you have never held an account with us, we do not market to you at all.

Where you do hold an account, we may send you information about Bookables, its features, and the kinds of services available on it. We only send commercial electronic messages in accordance with the Spam Act 2003 (Cth) and the equivalent law where you are: messages identify us as the sender and include a simple way to unsubscribe.

You can opt out at any time from your account settings, by using the unsubscribe link, or by contacting us via our contact page. Opting out of marketing does not stop essential transactional messages about your account or bookings.

We do not sell personal information. We share it only with trusted service providers who help us run Bookables, and only as needed to provide the Service. These include providers for cloud hosting and databases, authentication and sign-in, payment processing for plans, maps and geocoding, and email and SMS delivery. Each is bound by contract to protect your information and to use it only for the purposes we permit.

A business you book with sees what it needs for your booking: your name, contact details, the household entries the booking is for, and your messages with it. We are happy to tell you which providers we currently rely on. If you would like the current list, contact us via our contact page.

We may also disclose personal information where required or authorised by law, to enforce our terms, or in connection with a corporate transaction such as a sale of our business, in which case we will take steps to ensure your information remains protected.

Bookables operates in several countries, and our service providers store or process information in Australia, the United States, the European Union and the United Kingdom. Before disclosing personal information overseas, we take reasonable steps to ensure each provider handles it consistently with the Australian Privacy Principles, including through contractual protections. Where the GDPR or UK GDPR applies, transfers out of the EEA or UK are made under standard contractual clauses or another lawful mechanism. By using the Service, you acknowledge that your information may be stored and processed in these places for these purposes.

We keep personal information for as long as your account is active and for as long as we need it for the purposes set out in this policy. When you delete your account, we remove your name and contact details from our systems. The record of what happened on a booking is kept, with your name and words removed, because the business you booked with needs it as a record of work it carried out, and because we are required to keep certain records for longer to meet legal, tax, accounting or security obligations.

When a business deletes itself, its data can be exported first, and its listing goes back to being unclaimed. Where we hold a customer record on a business’s behalf, we retain and delete that information in line with the business’s instructions and our agreement with them.

We take reasonable technical and organisational steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include encryption of data in transit, access controls, row-level security in our database so each business can only see its own data, and sign-in by one-time code rather than passwords, so there is no password of yours for anyone to steal. No system is completely secure, but we work to protect your information and to respond promptly to any incident.

We maintain procedures to detect, assess and respond to data breaches. If a breach involving personal information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth), and the relevant authority in any other country whose law requires it.

Under the Privacy Act and the APPs you may:

• request access to the personal information we hold about you;
• ask us to correct information that is inaccurate, out of date, incomplete or misleading;
• ask how we handle your information and opt out of direct marketing;
• delete your account yourself from your account settings, or ask us to; and
• make a complaint if you believe we have breached the APPs.

Where the GDPR or UK GDPR applies you also have the rights to restrict or object to processing, to data portability, and to lodge a complaint with your local supervisory authority.

To make a request or a complaint, contact us via our contact page. We will respond within a reasonable time, generally within 30 days. If you do not hold a Bookables account and your details were entered by a business that uses Bookables, please contact that business in the first instance, as they are responsible for your information. If you hold an account of any kind, come straight to us. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, though we would welcome the chance to resolve your concern first.

Australian law is the primary basis on which we handle personal information. Bookables also operates in the United Kingdom, Ireland, New Zealand, the United States and Canada, and is available elsewhere. Where we handle personal data about individuals in the European Union or the United Kingdom, the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to that data and we comply with it, as set out through this policy. Where we handle personal information about individuals in New Zealand, Canada or the United States, we comply with the Privacy Act 2020 (NZ), PIPEDA and the state privacy laws of the United States to the extent they apply.

We use a small number of cookies and similar technologies that are necessary to run the Service, such as keeping you signed in and remembering your country and theme. For full details, see our Cookie Policy.

Bookables accounts are not intended for children, and we do not knowingly collect personal information directly from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

Bookings are often made for children, for example enrolling a child in a class. Where a parent or guardian adds a child to their household, we hold those details on their instruction and share them with the business so the business can carry out the booking. We do not market to a child, and we do not create an account for one.

We may update this Privacy Policy from time to time. If we make a material change we will take reasonable steps to let you know, for example by email or by a notice within the Service. The “Last updated” date at the top of this page shows when it was last revised.

If you have any questions about this policy or how we handle your information, contact us via our contact page or by writing to Bookables Pty Ltd, 50 Bridge St, Sydney NSW 2000, Australia.