Legal
Privacy and cookie policy
This Privacy and Cookie Policy explains how Elbah Group Limited trading as BeBooked (company number 15108393), trading as BeBooked (“BeBooked”, “we”, “us”), collects, uses, shares, and protects personal data when you use our marketing website and application (together, the “Services”). This Policy also explains how we use cookies and how you can control them.
1. Who We Are
Controller: Elbah Group Limited trading as BeBooked (company number 15108393)
Email: privacy@bebooked.co.uk
Address: 86–90 Paul Street, London, EC2A 4NE
2. What This Policy Covers
This Policy covers personal data we process when you:
- Visit or interact with our website;
- Create an account or use the App;
- Make or manage a booking through the Services;
- Receive notifications (where you or an account owner has added you as a contact);
- Contact us for support or sales.
It does not cover third-party websites or services you access via links or integrations: those have their own policies.
3. Personal Data We Collect
A. Data you provide
Account and profile:
- Name, email address;
- Login credentials (stored as hashed passwords);
- Roles, permissions, and team membership.
Business and booking configuration:
- Business name, address, and contact details;
- Service and resource definitions, schedules, and availability rules;
- Booking configurations, appointment history, and cancellation records.
End customer booking data (processed on behalf of business users):
- Customer account records created as part of the booking flow where the customer does not already have an account;
- Customer name, email address, and/or phone number;
- Booking details including date, time, service, and any notes;
- Communications related to bookings (confirmations, reminders, cancellations).
Billing and subscription:
- Billing name, billing email, company name (if provided);
- Invoices, plan details, payment status, and transaction identifiers.
Support and communications:
- Messages you send to us (support requests, forms, emails) and related metadata.
B. Data we collect automatically
- IP address, device and browser information;
- Access logs, security logs, timestamps, diagnostic and error logs;
- Bot-detection signals and challenge results when you submit a public form protected by Cloudflare Turnstile;
- Interactions with pages and features (where analytics are enabled and you consent).
C. Cookies and similar technologies
We use cookies and similar technologies as described in Section 12.
4. How We Use Personal Data and Our Legal Bases
We use personal data for the purposes below (with UK GDPR legal bases in brackets):
- Provide and operate the Services (Contract): create and manage accounts; provide booking and scheduling functionality; administer subscriptions and settings.
- Booking notifications to end customers (Contract / Legitimate interests): sending confirmations, reminders, and cancellations on behalf of business users.
- Support and service communications (Contract / Legitimate interests): respond to enquiries; provide troubleshooting and important service messages.
- Security, abuse prevention, and fraud detection (Legitimate interests / Legal obligation): protect accounts, public forms, and infrastructure; detect automated submissions; investigate suspicious activity.
- Improve and develop the Services (Legitimate interests; analytics cookies: Consent): analyse performance and reliability; improve user experience.
- Legal compliance (Legal obligation): tax, accounting, legal requests, and regulatory obligations.
- Marketing (Consent or Legitimate interests): send marketing emails where permitted; opt out at any time via unsubscribe links or by contacting us.
5. How We Share Personal Data
We may share personal data with:
- Service providers (processors/sub-processors) that help us operate and support the Services (e.g., hosting, email delivery, SMS delivery, support tooling, analytics where opted in);
- Payment processors to process subscriptions and payments;
- Business users who use BeBooked (where you are an end customer making a booking through their account);
- Authorities, regulators, or other parties where required by law or to protect rights, safety, and security;
- A buyer or successor in connection with a merger, acquisition, or sale of assets, subject to appropriate safeguards.
6. Sub-processors
We maintain a list of sub-processors used to deliver the Services, available on request at privacy@bebooked.co.uk and within the Data Processing Agreement provided to business customers. We will notify business customers of material sub-processor changes in accordance with our DPA.
7. International Transfers
If personal data is transferred outside the UK, we use appropriate safeguards (such as the UK IDTA or Addendum to the EU Standard Contractual Clauses) and carry out transfer risk assessments where required.
8. Data Retention
We retain personal data only as long as needed for the purposes in this Policy:
- Account data: while your account is active, plus 12 months after closure;
- Booking data: while the relevant business account is active, plus 12 months after closure;
- Billing records: 6 years;
- Logs: at least 6 months;
- Backups: rotated/overwritten every 7 days.
Deletion requests are handled subject to legal requirements and legitimate security and anti-fraud needs.
9. Your Rights
Depending on your circumstances, you may have the right to:
- Access your personal data;
- Correct inaccurate data;
- Request deletion;
- Restrict or object to processing;
- Data portability (where applicable);
- Withdraw consent (where consent is the legal basis).
To exercise your rights, email privacy@bebooked.co.uk. We may need to verify your identity. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk.
10. Security
We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and at rest, and security monitoring. You are responsible for keeping your login details confidential and using secure authentication practices.
11. Children
The Services are not intended for children under 16. We do not knowingly collect personal data from children under 16. If we learn we have collected such data, we will delete it. Parents or guardians should contact privacy@bebooked.co.uk.
12. Cookies and Similar Technologies
12.1 What are cookies?
Cookies are small text files placed on your device when you visit our website or use our App. Similar technologies (e.g., local storage and tags) may also be used.
12.2 Cookie consent and categories
The public marketing website does not currently set non-essential cookies. Where we enable analytics or experience cookies, we display a cookie consent banner before setting them. Those cookies are strictly opt-in. If you do not consent, we do not set them.
Cloudflare Turnstile (public forms): We use Cloudflare Turnstile to detect and prevent automated or abusive form submissions. Turnstile processes technical and browser signals and returns a short-lived verification token. We use it for security and abuse prevention based on our legitimate interests, not for advertising. Cloudflare’s privacy information is available at Cloudflare Privacy Policy.
- Strictly necessary cookies (no consent required): required for core functionality such as authentication, session management, security, and remembering cookie preferences.
- Analytics/experience cookies (consent required): used to understand how the Services are used and to improve them (e.g., Google Analytics and Microsoft Clarity, where you opt in).
12.3 Analytics tools (when you opt in)
Google Analytics (GA4) may use cookies including:
- _ga (typically 2 years): distinguishes users;
- _ga_<container-id> (typically 2 years): maintains session state.
Microsoft Clarity may use cookies including:
- _clck: stores a Clarity user ID and preferences;
- _clsk: links multiple page views into a single session.
We do not currently use Google Signals or Ads Features. If we enable advertising-related features in future, we will update this Policy before activating them.
12.4 Managing cookies
Where a cookie banner or preferences tool is available, you can use it to manage your choices. You can also adjust your browser settings. Disabling strictly necessary cookies may affect login and session functionality.
13. Changes to This Policy
We may update this Policy from time to time. We will post the updated version with a revised Last updated date. Material changes may be notified via in-app notice or email.
14. Contact
For privacy-related questions or to exercise your rights:
Email: privacy@bebooked.co.uk
Post: Elbah Group Limited trading as BeBooked, 86–90 Paul Street, London, EC2A 4NE