Privacy policy

BookBook (bookbook.co.uk) is booking and client-management software for salons. This policy explains what personal data we handle, why, and what your rights are under UK GDPR. It is written for two groups: salon owners and staff who hold a BookBook account, and salon clients who book appointments through a salon's BookBook page.

Who is responsible for your data

For account holders (salon owners and staff) and for visitors to this website, BookBook is the data controller. For the clients of a salon, the salon is the data controller and BookBook processes that data on the salon's instructions. Questions about a salon's use of your data should go to the salon first; you can also contact us through the form on our home page.

What we collect and why

Salon accounts

• Name, email address, phone number and password (stored hashed), to create and secure your account.
• Salon details: business name, locations, services, prices, staff and working hours, to run your booking page.
• Billing details for your subscription. Card payments are handled by our payment provider; we do not store full card numbers.
• Usage and error logs, to keep the service working and to fix problems.

Salon clients

• Name, email address and phone number, to make the booking, send confirmations and reminders, and let you manage the appointment.
• Appointment history, notes and preferences the salon records.
• Answers to the salon's intake forms, which may include health information such as allergies or patch-test results. The salon asks for this to deliver the service safely; it is stored in your client record and shown only to the salon's staff.
• Payments and deposits, handled by the payment provider.

Legal bases

We rely on contract (providing the booking service you or your salon asked for), legitimate interests (security, service improvement, preventing abuse) and consent (optional cookies, marketing messages). Health information in intake forms is collected on the basis of the client's explicit consent given to the salon.

Messages we send

Booking confirmations, reminders, reschedule and review requests are service messages tied to an appointment. Marketing messages are sent only where you have agreed, and every one has a way to opt out.

Cookies and similar technologies

• Necessary: sign-in tokens, your language preference, and a session record used to complete a booking. These are needed for the site to work and are not used for advertising.
• Advertising measurement (optional): we may use Google's tag to see whether our own Google ads bring salon owners to BookBook. It runs in a cookieless mode until you press Accept in the cookie notice. If you decline, no advertising cookies are set. You can change your choice by clearing the site data in your browser.

Who we share data with

Hosting and infrastructure providers, email and SMS delivery services, and our payment provider, each under a contract that limits them to acting on our instructions. We do not sell personal data. Salon client data is never shared with other salons.

Where data is stored

Our servers are located in Europe. Where a provider processes data outside the UK, we rely on the UK's adequacy regulations or standard contractual clauses.

How long we keep data

• Account data: for as long as the account is open, then deleted or anonymised within 90 days of closure, except records we must keep for tax purposes (up to 6 years).
• Salon client records: for as long as the salon keeps them. Salons can delete client records at any time, and can export all their data before closing an account.
• Logs: up to 12 months.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and take your data elsewhere. For salon client data, contact the salon; if you cannot reach them, contact us and we will help. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Security

Data is encrypted in transit, passwords are hashed, access is limited to staff who need it, and we keep backups so that a fault does not lose your bookings.

Changes and contact

We will post any changes on this page with a new date. To contact us about privacy, use the form on the home page.