1. Who we are
Booko Ltd (“Booko”, “we”, “us”) is registered in England and Wales, company number 16562915. We operate the Booko venue-finding concierge at booko.deals and related services (the “Platform”). This policy explains how we handle personal information under the UK General Data Protection Regulation and the Data Protection Act 2018. For anything in this policy, email support@booko.email with the subject line “Data protection enquiry”.
This policy covers three groups: people planning events (“Organisers”), people who work at venues and receive or answer our enquiries (“Venue contacts”), and visitors browsing the Platform.
2. Our role
Booko is the controller of the personal information described in this policy. When an Organiser instructs us to send an enquiry, the venue that receives it becomes an independent controller of the information in that enquiry and of any conversation it goes on to have with the Organiser. Venues’ own privacy notices apply to how they use it.
3. Information we collect
Organisers. Your email address, used for passwordless sign-in; your event request (occasion, headcount, area, date or date range, start time, requested spaces and requirements, and any free-text description you write); the summary of your request that you approve for venues to read; the venues you select to contact; the enquiries sent on your behalf; the replies venues send, including attachments such as menus or brochures; your preferred-venue choice and cancellations; and a log of the actions you take on your enquiries. We do not collect passwords or payment card details, and we never take payments from Organisers.
Introductions, bookings and feedback. When you approve an introduction, we share the name, confirmed account email and optional phone number shown in your preview with that venue. We keep the approved email and consent record. Replies then go directly to you; further conversations outside Booko are not automatically collected. Confirming a venue records your event as booked with it. After the event we ask how it went, and store whether it went ahead, the star rating and comment you give, and any reason you give if it didn’t, with when you gave them. We keep next-step notes, booking references and outcomes recorded before 7 October 2026 with your event searches. Please do not enter bank or card details in comments or notes.
Venue contacts. Business contact details for venues, typically from venue websites, public directories, mapping providers and information venues give us: the venue’s name and address, event or reservations email addresses, phone numbers and booking links, and the names and job titles of staff where they appear in that information. When you reply to an enquiry we hold your reply, your email address, the message headers used to verify it, and any attachments. If you ask us to stop emailing an address, or an address bounces or reports our email as spam, we keep that address on a suppression list so we do not email it again.
Venue teams. If you manage a venue in the venue portal: your email address, the venue you claim and how you proved you work there (including the code we email to your venue’s checked address, which we store only in scrambled form, or the evidence you give us), your acceptance of the Venue Terms, your venue’s plan and its status, the booking values you confirm and the commission charged. Stripe handles plan payments and invoices; we receive the customer, subscription and invoice references and their status from Stripe, never full card numbers.
Venue requests. If you ask us to add a venue, we keep the venue’s name, address, postcode, website and number of spaces, your role there and, if you give it, your email address, which we use only to tell you when the venue is added. The address search uses Google Places, so Google receives what you type into it.
Signed-in searches. We record the searches you submit, their filters and submission times against your account. Authorised Booko staff can review this activity alongside your enquiries to support you and understand how the service is used. Searches made before signing in remain in your browser and are not added to this account history, although if you rerun one while signed in, it is recorded as a new search.
Stored in your browser. Your shortlist, shortlist notes, your three most recent searches and any enquiry you have started but not yet sent are kept in your browser’s local storage, not on our servers, whether or not you are signed in. They stay on that device after you sign out until you clear your browser storage. We receive the venues you choose only when you ask Booko to contact them.
Everyone. Technical information needed to run and secure the Platform, such as IP address, browser type, device type, pages requested and timestamps, held in server and security logs. When you sign in, a security check from Cloudflare Turnstile reads browser and device signals to tell people from automated traffic.
4. How we use it and our lawful bases
- Providing the service to Organisers (performance of a contract): signing you in, saving your request and shortlist, sending the enquiries you instruct, receiving and verifying replies, and showing you the results.
- Summarising your request for venues (performance of a contract): when you review an enquiry, we send your request wording and event details to our AI providers to draft a short summary for venues to read. You can edit, redraft or clear it before sending. Venues receive the summary you approve and a table of your event details, not your original wording. We keep a copy of each draft for 24 hours so the same request is not processed twice; expired copies are removed the next time a summary is drafted.
- Enquiry content checks (legitimate interests in preventing misuse): when you ask Booko to contact venues, we send your request, event details and summary to our AI providers to check for offensive, unsafe or irrelevant requests. We keep a one-way fingerprint of the enquiry and the check result, linked to your account, for up to 48 hours, reusing results for 24 hours; expired records are removed on the next check. The check record does not store your text. If the check cannot be completed, outreach pauses until you retry.
- Reading replies with automated tools (legitimate interests, and performance of a contract with the Organiser): we use software, including AI models operated by third-party providers, to extract commercial terms from venue replies and attachments and to write a short summary, so Organisers can compare venues. The output is labelled as AI-assisted and shown next to the original reply. No decision with legal or similarly significant effect on you is made solely by automated means.
- Contacting venues (legitimate interests of Booko and of the Organiser): sending enquiries to venues’ business contact addresses on an Organiser’s instruction, and compiling venue information so Organisers can find suitable spaces. Venues can ask us to stop at any time by replying STOP, using the unsubscribe link in our enquiry emails, or emailing us.
- Venue accounts, plans and commission (performance of a contract with the venue’s business, and legitimate interests in checking who may manage a listing): verifying that you work for a venue before you manage its listing, running your plan, asking you to confirm the value of bookings made through Booko, and invoicing plan fees and commission.
- Security, fraud prevention and abuse limits (legitimate interests): the sign-in security check, verifying that replies came from the venue we contacted, checking that a venue’s email domain can receive mail before we send, keeping a suppression list of addresses we must not email, rate-limiting enquiries and automated processing, limiting how often a signed-out visitor can suggest a venue or report a listing issue (we store a hashed form of the IP address with the submission and remove it after an hour), and keeping audit logs.
- Improving the Platform (legitimate interests): analysing how the service is used in aggregate and fixing problems.
- Legal obligations: keeping records we are required to keep and responding to lawful requests.
- Marketing (consent): we will only send you marketing emails if you have opted in, and you can opt out at any time.
6. International transfers
Some of our providers process information outside the United Kingdom, including in the European Economic Area and the United States. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to standard contractual clauses, together with the providers’ own security commitments.
7. How long we keep it
- Account details, enquiry history and signed-in search history: for as long as your account is open, then deleted within 30 days of your request to delete your account, usually straight away, except for the anonymised record below. Stored attachments, and the audit and delivery records about your account, are deleted at the same time.
- Enquiries, venue replies and attachments: kept while your account is open so you can refer back to them, then handled as above. Clearing a closed event search hides it from your workspace; it remains part of your enquiry history.
- Security, delivery and audit logs: up to 12 months.
- Records of the emails we sent to venues (the venue, its address, the date, whether it was an enquiry, cancellation or introduction, and a one-way fingerprint of its content): up to 6 years, including after you delete your account. This record does not contain your name, email address, phone number or wording.
- Venue business contact information: while the venue is listed and for as long as it remains accurate; removed on request.
- Venue account and billing records (plans, invoices, confirmed booking values and commission): 6 years from the end of the financial year they relate to, as UK tax and company law requires, including after a venue account closes.
- Requests to add a venue: up to 12 months after we decide on them.
- Suppressed email addresses: for as long as needed to make sure we do not email them again.
- Information in your browser’s local storage: until you clear it.
8. Security
Information is encrypted in transit and at rest. Access to the database is controlled row by row so that Organisers can see only the workspaces they belong to. Authorised Booko staff can view account, search and enquiry records to support the service. Sign-in uses one-time email links rather than passwords. Venue attachments are stored privately and served through short-lived links to signed-in members only. Service keys are kept server-side, actions on enquiries are audit-logged, and automated processing is rate-limited and budgeted. No system is perfectly secure; if you believe your account has been compromised, email us immediately.
9. Your rights
You have the right to ask for access to your personal information, to have it corrected or erased, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw consent where we rely on it. Organisers can delete their account from the account menu, or ask us to by emailing us from the address they sign in with. Deleting an account closes its open enquiries first: venues we emailed are sent a note that the organiser no longer needs them (if that note cannot be sent first time, we do not retry it), while venues you have been introduced to or booked are not contacted, so speak to them directly. Venue contacts can reply STOP to any enquiry to stop emails to that address, and can ask us to stop contacting a venue or to correct or remove venue information. For any request, email support@booko.email; we will respond within one month. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, though we would welcome the chance to help first.
10. Children
The Platform is for people aged 18 and over. We do not knowingly collect information from children, and we will delete any we discover.
12. Emails from Booko
We send Organisers service emails that are part of running their enquiries: sign-in links, a notice each time a venue replies, and a copy of any introduction they approve. Reply notices stop once an enquiry is closed. Venues receive enquiry emails, cancellation notes and introductions only when an Organiser instructs us to send them; enquiry emails and cancellation notes include a way to opt out. We do not currently send marketing emails. If we do in future, we will send them only with consent and always include an unsubscribe link.
13. Changes to this policy
We will post any changes here with a new last-updated date and, for material changes, tell Organisers through the Platform or by email. This version supersedes earlier Booko privacy policies, which described a restaurant booking and payments service that the Platform no longer provides.
14. Contact
Booko Ltd, registered in England and Wales, company number 16562915. Email support@booko.email. See also our Terms and Conditions.