BOOKO PLATFORM

1. Introduction

Booko Ltd ("Booko", "we", "us", "the Company"), registered in England & Wales (company number 16562915), is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your personal data when you use our mobile application or any related services (collectively, the "Platform").

The Platform serves two categories of participant:

• Users (diners/consumers) – individuals who search for, request, and book restaurant reservations.
• Merchants (venues/restaurants) – hospitality businesses that list their venues, respond to booking requests, publish promotional offers, and fulfil reservations.

This Privacy Policy applies equally to both Users and Merchants. Where a provision applies only to one category, this is stated explicitly.

This Privacy Policy should be read alongside our Terms and Conditions, which govern your use of the Platform.

We process personal data in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

2. Data Controller and Responsibilities

3. Data We Collect

3.1 Information You Provide

All participants:

• Account Information: Full name, email address, phone number, and password (encrypted).

Users:

• Profile Information: Dietary preferences, allergies, accessibility requirements, and special occasion details.
• Booking Data: Date, time, party size, cuisine preferences, budget range, location preferences, occasion type, and any notes provided to the Merchant.

Merchants:

• Business Information: Trading name, legal entity name, business description, venue address, operating hours, cuisine types, venue capacity, vibe tags, photographs, and business registration details.
• Billing Information: A billing card is stored securely via Stripe for weekly Performance Fee charges. Booko does not receive or store full card numbers.

Both:

• Communications: Messages, support enquiries, and feedback you send to us or to Merchants/Users through the Platform.

3.2 Information Collected Automatically

• Device Information: Device type, model, operating system, unique device identifiers, and app version.
• Usage Data: Pages and features accessed, interaction patterns, session duration, and navigation paths within the Platform.
• Location Data: Where you grant permission, we collect precise or approximate location data to identify nearby Merchants and verify service area eligibility. You may revoke location permissions at any time via your device settings.
• Push Notification Tokens: Firebase Cloud Messaging (FCM) device tokens, used solely to deliver push notifications.
• Authentication Data: Login timestamps, session identifiers, and authentication event logs.

3.3 Information from Third Parties

• Payment Data (via Stripe): We receive limited payment information from Stripe, including the last four digits of the card number, card brand, and expiry date. We never receive, process, or store full payment card numbers, CVVs, or PINs. All payment card data is handled exclusively by Stripe in accordance with PCI DSS standards.
• Google Account Data (Users only): Where you sign in via Google OAuth, we receive your name and email address from your Google account. We do not receive your Google password.
• Stripe Connect Data (Merchants only): Stripe provides us with limited account status information (e.g., verification status). Identity documents, bank account details, and tax identification numbers are collected and held exclusively by Stripe; Booko does not receive or store this information.

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

5. How We Use Your Data

We use your personal data to:

• Provide the Platform: Operate, maintain, and deliver the core booking marketplace service, including matching Users with Merchants, facilitating the bidding process, and managing Deal Drops.
• Process Payments: Facilitate card authorisations, process captures, releases, and refunds via Stripe (for Users), and manage the weekly Performance Fee billing cycle (for Merchants).
• Communicate with You: Send essential transactional notifications (booking confirmations, cancellations, payment alerts, and security notices) via push notification and email. These cannot be disabled.
• Optional Communications: Send promotional messages, new Deal Drop alerts, booking reminders, and feature updates where you have opted in. You may adjust these preferences at any time via the notification settings in the Platform.
• Merchant Verification: Verify Merchant identity and eligibility through our administration review process and via Stripe Connect.
• Improve the Platform: Analyse usage patterns, monitor performance, and identify areas for improvement.
• Ensure Security: Detect, investigate, and prevent fraud, abuse, and other harmful activity.
• Legal Compliance: Comply with applicable laws, regulations, and legal processes.

6. How We Share Your Data

6.1 Between Users and Merchants

When a booking is confirmed, we share limited User information with the relevant Merchant to enable fulfilment of the reservation: your name, phone number, party size, booking date and time, and any notes or dietary requirements you have provided. The Merchant receives this data as an independent data controller (see Section 2.2). Booko does not control how a Merchant uses your data once it has been shared for the purpose of fulfilling the booking.

6.2 With Service Providers

We share data with trusted third-party service providers who act as data processors on our behalf:

6.3 With Law Enforcement and Regulators

We may disclose your personal data where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of Booko, our users, or the public.

6.4 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your data.

6.5 Aggregated and Anonymised Data

We may share aggregated or anonymised data (which cannot reasonably be used to identify you) with third parties for analytical, research, or commercial purposes.

6.6 What We Do Not Share

Booko does not sell your personal data to third parties. Booko does not share your data with advertising networks. Booko does not engage in cross-app tracking.

7. International Data Transfers

Your personal data may be transferred to, and processed in, countries outside the United Kingdom. Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with UK GDPR, including:

• Adequacy decisions: Transfers to countries recognised by the UK government as providing an adequate level of data protection.
• Standard Contractual Clauses (SCCs): Where adequacy decisions are not available, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Our primary infrastructure providers (Supabase, Stripe, Firebase, and Resend) maintain data processing operations in the United States and the European Economic Area.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption: All data is encrypted at rest (AES-256) and in transit (TLS/HTTPS).
• Access Controls: Row-level security (RLS) policies ensure that users can only access their own data. Merchant data is isolated at the database level.
• Authentication: Passwords are stored using bcrypt hashing. JWT tokens are used for session management with automatic expiry and refresh.
• Payment Security: Full payment card data is handled exclusively by Stripe (PCI DSS Level 1 certified). Booko never receives or stores card numbers.
• Rate Limiting: Authentication attempts are rate-limited to prevent brute-force attacks.
• Audit Logging: Key system events (including payment transactions and account changes) are logged for audit and compliance purposes.

No method of electronic transmission or storage is completely secure. Whilst we strive to protect your personal data, we cannot guarantee absolute security.

9. Data Retention

Upon account deletion, all personally identifiable information is anonymised in accordance with UK GDPR (email, name, phone number, and business details are replaced with anonymised placeholders). Anonymised records may be retained for statistical and legal purposes.

10. Your Rights

Under UK GDPR, both Users and Merchants have the following rights in respect of their personal data:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of your personal data (subject to legal retention obligations and any outstanding bookings or billing obligations).
• Right to Restriction of Processing (Art. 18): Request that we restrict the processing of your data in certain circumstances.
• Right to Data Portability (Art. 20): Request a copy of your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Rights Related to Automated Decision-Making (Art. 22): The Platform does not engage in solely automated decision-making that produces legal effects concerning you.

How to Exercise Your Rights:

• Account Deletion (Users): Available directly via the account settings in the Platform. Deletion is processed automatically, including GDPR-compliant anonymisation of all personal data.
• Account Deletion (Merchants): Available via account settings during sign-up. Once verified, Merchants with active bookings or outstanding billing must contact support to arrange account closure.
• Other Requests: Email us at support@booko.email with the subject line "Data Rights Request". We will respond within one calendar month in accordance with UK GDPR.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk.

11. Children's Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete such data promptly.

12. Cookies and Tracking Technologies

The Booko mobile application does not use browser cookies. We use device-level identifiers and Firebase Cloud Messaging tokens solely for the purpose of delivering push notifications and maintaining authenticated sessions. We do not engage in cross-app tracking or sell data to advertising networks.

13. Notification Preferences

14. Third-Party Links and Services

The Platform may contain links to or integrate with third-party websites and services (including Stripe, Google, and Firebase). We are not responsible for the privacy practices, content, or data handling of any third-party service. We encourage you to review the privacy policies of any third-party service you interact with.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated Privacy Policy in the Platform and, where appropriate, by email. The version date at the top of this page indicates when the policy was last revised. Your continued use of the Platform after any update constitutes acceptance of the revised Privacy Policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For data protection enquiries, please use the subject line "Data Protection Enquiry".