Privacy policy
Effective from [Effective date]
This policy explains how BookPet uses personal data when you visit bookpet.co.uk, sign up for or use BookPet, or get in touch with us. We’ve tried to write it in plain English. If anything is unclear, email hello@bookpet.co.uk.
1. Who we are
BookPet is a service provided by [Company legal name] (“BookPet”, “we”, “us”), a company registered in England and Wales with company number [Company number], whose registered office is at [Registered address]. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].
For the personal data described in this policy, we are the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who this policy covers
- Visitors to bookpet.co.uk.
- Business users: people who sign up for BookPet, sign in to a BookPet dashboard, or are named on a business account (for example the owner, or staff members when staff logins are available).
- People who contact us, for example about done-for-you setup.
3. If you booked with a pet business that uses BookPet
When you fill in a booking form for a boarder, daycare or groomer that uses BookPet, that business is the controller of your information. It decides what to ask, how long to keep it and what to do with it. We store and process it for them, on their instructions, as their processor, under the data processing terms in our terms of service.
Please read the business’s own privacy notice, and contact them first if you want to see, correct or delete your information. If you contact us, we will pass your request to the business and help them respond. We don’t use your booking information for our own marketing, and we don’t sell it.
4. What we collect and why
| Information | What we use it for | Lawful basis |
|---|---|---|
| Account details: your name, email address, business name, phone number, address or area, website, licence number, issuing council and licence expiry, logo and brand settings. | To create and run your account and booking page, show your details on your booking page, and send you service emails (such as sign-in codes and booking notifications). | Contract (Article 6(1)(b)). |
| Bank details you enter for deposits (account name, sort code, account number). | To show them to your customers in approval emails so they can pay you. We don’t use them for anything else. | Contract. |
| Sign-in and security data: one-time sign-in codes (stored only in a scrambled, hashed form and valid for 10 minutes), session identifiers, salted hashes of IP addresses, a log of important account actions (such as sign-ins, approvals, exports and deletions). | To keep your account secure, prevent abuse and fraud, investigate problems, and show you who has accessed your account. | Legitimate interests (Article 6(1)(f)) in keeping the service and its users secure. |
| Billing details: your plan, billing name and address, VAT number if you give one, and payment history. Card details are collected and held by Stripe, not by us. | To take payment for your subscription, send invoices and receipts, and keep accounting records. | Contract; legal obligation (Article 6(1)(c)) for tax and accounting records. |
| Usage information: which features are used, error reports and email delivery status (with recipient addresses stored only as hashes). | To keep the service working, fix faults and improve BookPet. | Legitimate interests in running and improving the service. |
| Messages you send us: emails, support requests and done-for-you enquiries. | To reply, provide support and, for done-for-you work, prepare a quote and carry out the work. | Legitimate interests in answering enquiries; contract where we’re providing a service to you. |
| Website visit data: technical information your browser sends (such as IP address, browser type and the page requested), handled by our hosting provider. | To deliver the website securely and protect it from attacks. We don’t use advertising or tracking cookies. If we measure visits, we use cookieless analytics that don’t identify you. | Legitimate interests in running a secure website. |
| Product news: your email address, if you’re a customer or you ask to hear from us. | To tell you about new BookPet features and offers. Every email has an unsubscribe link. | Legitimate interests, and the “soft opt-in” for existing customers under the Privacy and Electronic Communications Regulations (PECR); or your consent. |
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who we share it with
We share personal data only where we need to:
- Our sub-processors and service providers, who host the service, send emails, protect against bots and take payments. They are listed on our sub-processors page. Stripe also acts as an independent controller for some purposes, such as fraud prevention and meeting its own legal obligations; see Stripe’s privacy policy.
- Professional advisers, such as our accountants, lawyers and insurers, under a duty of confidentiality.
- Authorities, such as HMRC, the police or a court, where the law requires it.
- A buyer or successor, if BookPet or our business is sold or reorganised, under equivalent protections. We’d tell you beforehand.
We never sell personal data.
6. International transfers
Our main providers, Cloudflare and Stripe, operate worldwide, and some of the data we hold may be processed outside the UK, including in the European Economic Area and the United States. [Confirm data location: we create our database and file storage with EU location settings where available.]
Where personal data leaves the UK, we rely on UK adequacy regulations (for example for the EEA, or for US organisations certified under the UK Extension to the EU–US Data Privacy Framework) or on appropriate safeguards such as the International Data Transfer Addendum to the EU Standard Contractual Clauses, which are included in our providers’ data processing agreements. You can ask us for more detail.
7. How long we keep it
| Information | How long |
|---|---|
| Account details and your business’s data | While your account is open. When you ask us to close it, we keep it for a 30-day grace period (so you can change your mind), then delete it permanently. Copies in our backups are overwritten within a further 35 days. |
| Accounts that never subscribe | [Period, e.g. deleted 12 months after the trial ends, with a reminder email first] |
| Sign-in codes | 10 minutes, or until used. |
| Sign-in sessions | Up to 30 days after your last activity, or until you sign out. |
| Security and audit logs | [Period, e.g. 12 months] |
| Billing and invoice records | 6 years from the end of the financial year they relate to, to meet UK tax law. |
| Support emails and enquiries | [Period, e.g. 2 years after our last contact] |
| Hosting provider request logs | As set by Cloudflare, typically a short period. [Confirm] |
8. How we keep it safe
We use measures appropriate to the risk, including: encryption in transit (HTTPS) on every page; sign-in by one-time code so there are no passwords to steal; session tokens and sign-in codes stored only as hashes; strict separation so one business can never see another’s data; rate limits and bot protection; daily backups; and an audit log of sensitive actions. If BookPet staff ever need to view your account to help you, that access is logged and shown to you.
No system is perfectly secure. If a personal data breach is likely to put you at risk, we will tell you and, where required, the ICO within 72 hours of becoming aware of it.
9. Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data (a subject access request);
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to our use of your data where we rely on legitimate interests, including for marketing (you can always unsubscribe);
- receive data you gave us in a portable format, or have it sent to another provider;
- withdraw consent at any time, where we rely on consent.
Some rights have conditions, for example we may need to keep billing records to meet the law. You can export most of your data yourself from your dashboard. To use any of these rights, email hello@bookpet.co.uk. We’ll reply within one month and won’t usually charge. We may need to check your identity first.
10. Children
BookPet is a service for businesses and isn’t intended for anyone under 18. We don’t knowingly collect data about children for our own purposes.
11. Changes to this policy
We’ll update this policy when the way we use personal data changes. If the changes are significant, we’ll email account holders before they take effect. The date at the top shows when it last changed.
12. Contact and complaints
Questions or concerns: email hello@bookpet.co.uk or write to us at [Registered address].
If you’re unhappy with how we’ve handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.