Privacy and Cookies Statement

This explains what [Registered legal entity] does with personal data when you use BookInn, whether you run a restaurant on it or booked a table through one.

Who is responsible for your data

When you book a table, the restaurant is the controller of your booking: it decides what to do with it, and its own privacy notice applies alongside this one. [Registered legal entity] is the processor, handling that data on the restaurant’s instructions.

For accounts, billing and the running of BookInn itself, [Registered legal entity] is the controller.

What we collect

• Booking details — your name, email address, phone number, party size, the date and time, and anything you write in the requests box, such as an allergy or that it is a birthday.
• Account details — for restaurant staff, a name, work email address, role and the record of what was changed and by whom.
• Technical data — IP address, browser and the pages requested, recorded to keep the service secure and working.
• Billing data — the plan, invoices and payment status. Card details are handled by our payment provider and never reach our servers.

Why we use it, and on what basis

• To take and honour your booking — necessary to perform the arrangement you asked for.
• To send confirmations, reminders and changes — the same basis. These are service messages, not marketing.
• To keep the service secure and prevent abuse — our legitimate interest in running it safely.
• To understand and improve how the booking flow is used — your consent, given through cookie settings.
• To meet accounting and legal obligations — legal obligation.

Special category data, such as an allergy you mention in a request, is used only to serve you on the night and is visible only to the restaurant.

Who we share it with

With the restaurant you booked with, and with the providers that run the service on our behalf — hosting, email delivery, error monitoring and payment processing. Each is bound to use the data only for that purpose. We do not sell personal data.

[List the sub-processors here, with the country each operates in.]

International transfers

Where data leaves [Jurisdiction], it is protected by [transfer mechanism, e.g. standard contractual clauses or an adequacy decision].

How long we keep it

• Bookings: [retention period] after the reservation date.
• Guest records held by a restaurant: until that restaurant deletes them, or [period] after its account closes.
• Accounts: while the account is open, then [period].
• Invoices and tax records: [statutory period].
• Security logs: [period].

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict how it is used, and withdraw a consent you gave. Ask the restaurant for anything relating to a booking, or write to [privacy@your-domain] and we will pass it on and help. You may also complain to [Supervisory authority].

Cookies

A cookie is a small file a site stores in your browser. BookInn groups the ones it uses into three kinds, and only the first is set without asking.

• Strictly necessary. Signing in, keeping a booking in progress and protecting forms from abuse. The site does not work without these, so they cannot be turned off.
• Analytics. Counts which pages are used and where a booking is abandoned, so the flow can be improved. Never used to identify you.
• Marketing. Measures whether an advert or an email led to a booking, and tailors what you are shown elsewhere.

Your choice is stored in a cookie of its own, bookinn_consent, kept for a year so you are not asked again on every visit. Change it whenever you like:

Cookie settings

Clearing cookies in your browser also clears the record of your choice, and you will be asked again.

Children

BookInn is not intended for children. We do not knowingly collect data from anyone under [age], beyond a child’s name appearing in a party size or a request.

Changes to this statement

Any change is posted here with a new date at the top. Where a change is material we will say so before it takes effect.

Contact

[privacy@your-domain], or [Registered legal entity], [Registered office address]. Our data protection contact is [name or role].