Data processing terms
1. Roles
You (the business) are the controller of your customers' and staff's personal data on your booking site. BookedTik ([BookedTik owner's legal name or company name] of [registered address][, company number …]) is your processor.
2. What we process
| Whose data | What data | Why |
|---|---|---|
| Your customers | Name, email, phone number, password (stored scrambled by Google), profile photo if they add one, bookings, booking notes, deposit and refund records (no card numbers), promotions used, reminder settings | To take, change, remind and manage bookings and deposits for you |
| Your staff | Name, email, phone, photo, working hours, breaks, holidays | To show staff on your site and work out free times |
We keep it for as long as you use BookedTik, and delete it as described in section 8.
3. Our promises
- We only process this data to run your booking site and on your documented instructions (these terms and how you set up and use BookedTik), unless the law requires otherwise — in which case we'll tell you first if we're allowed to.
- Everyone at BookedTik who can see the data is bound by confidentiality.
- We keep it secure (section 4) and keep each business's data separate from every other business's.
- We help you answer your customers' requests (to see, correct or delete their data) — most can be done in the app yourself; for anything else, write to us.
- We help you with security, breach notification and data protection impact assessments where you need our information.
- We tell you without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach affecting your data, with the information you need to report it.
- We give you the information you need to show you're following the law, and allow reasonable audits (normally by written questions, at most once a year unless there has been a breach).
4. Security
- All connections use HTTPS (the padlock). Booking and account data is stored by Google Cloud in London (europe-west2); pictures (logos, staff and profile photos) are stored by Google in the USA (South Carolina). Everything is encrypted when stored.
- Each business has its own separate login space; database rules stop one business — or a customer — from reading another's data. These rules are tested automatically on every change.
- Card details are entered straight into Stripe's secure form and never reach BookedTik.
- Access to BookedTik's own systems is limited to the BookedTik owner, with confirmed sign-in, and admin actions are logged.
5. Sub-processors
You agree that we use these companies to run BookedTik. Each is bound by data protection terms at least as protective as these.
| Company | What for | Where |
|---|---|---|
| Google (Firebase / Google Cloud) | Website hosting, database, logins and phone checks, app crash reports, phone notifications, server code | Booking and account data stored in London (UK); pictures stored in the USA; server code runs in the USA (Iowa) |
| Resend | Sending emails (booking confirmations, reminders, account emails) | Sent from the EU (Ireland); a US company |
| Cloudflare | Web addresses and secure connections for bookedtik.com and businesses' own addresses | Worldwide network |
| Stripe | BookedTik's monthly plan payments | UK / EU / USA |
Deposits are taken by your own Stripe account, under your own agreement with Stripe; for those, Stripe is your provider, not our sub-processor.
We'll give at least 30 days' notice (by email or in the app) before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you can end your plan without penalty.
6. International transfers
Where data is handled outside the UK or EEA (for example in the USA), we rely on the UK Government's and the European Commission's approved safeguards — adequacy decisions (including the UK–US "data bridge" and the EU–US Data Privacy Framework where the company is certified) or the standard contractual clauses with the UK addendum.
7. Your instructions
If we think an instruction from you breaks data protection law, we'll tell you.
8. At the end
You can download a copy of your data at any time from your app. When your plan ends, your data is kept for 12 months while your site is paused (so you can restart), with emails 30 and 7 days before deletion; then we delete it, unless the law requires us to keep some of it. You can ask us to delete it sooner.