Privacy policy

Who we are

ClickBook provides booking software to independent pubs and restaurants. We are based in Cornwall, United Kingdom. You can reach us at hello@clickbook.co.uk.

Two different relationships

This matters, because it decides who answers your request.

• If you booked a table at a venue that uses ClickBook, the venue is the data controller. They decide what to collect and why; we process it for them, on their instructions, as their processor. Ask the venue first — and if you would rather come to us, we will pass it on and help them answer.
• If you run a venue, or you booked a demo with us, we are the controller for your own business contact details and account.

What a venue collects when you book

Through the booking page, a venue may collect:

• your name, phone number and, if you give one, your email address;
• the date, time, party size and any seating preference;
• anything you choose to tell them — the occasion, whether you need a high chair, whether you are bringing a dog, and any note you add;
• allergies and dietary requirements, if you tell them;
• whether you turned up, so the venue knows its own regulars.

Allergies are health data, and we treat them that way

Information about an allergy is special category data under Article 9 of the UK GDPR. It is never required: leave the field blank and your booking works exactly the same. Where you do give it, you are giving it so the kitchen can keep you safe, and it is used for that and nothing else — never for marketing, never to build a profile, and never shared outside the venue you booked with and us as their software provider. Under Article 9(2)(a) the lawful basis is your explicit consent, given by typing it in, and you can ask the venue to delete it at any time.

Why we hold it (lawful bases)

• To honour your booking — necessary for the contract between you and the venue, including the confirmation, reminders and any change or cancellation.
• Allergies and dietary needs — your explicit consent, as above.
• Asking how your visit went, and win-back messages — the venue’s legitimate interests in running and improving its business. Every one of these carries a way to opt out, and opting out is honoured for good.
• Keeping the service secure and working — our legitimate interests in preventing abuse and diagnosing faults.

Who else sees it

We use a small number of suppliers, and only to run the service:

• Neon — the database the booking is stored in.
• Vercel — hosting, and privacy-friendly page analytics that set no advertising cookies and do not track you across other sites.
• Resend — sends confirmation and reminder emails.
• Twilio — sends text messages, where a venue uses the waitlist or reminders by text.
• Stripe — where a venue takes a card hold or deposit. Card details go straight to Stripe and never reach us.

We do not sell personal data, and we do not share it with advertising networks. Suppliers act on our instructions under contract. Where data is processed outside the UK, it is covered by UK adequacy regulations or the International Data Transfer Addendum.

How long it is kept

• Bookings and guest records: for as long as the venue uses ClickBook, so they can recognise a returning guest. A venue can delete a guest at any time, and does so on request.
• If a venue leaves ClickBook, their data is deleted within 90 days of the account closing, once they have exported it.
• Demo enquiries: two years from the last contact, unless you ask us to remove them sooner.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting anything done before. Email hello@clickbook.co.uk and we will respond within one month.

If you are not happy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, so we can put it right.

Cookies

We use a cookie to keep venue staff signed in, which the service cannot work without. Our page analytics are aggregated and set no advertising or cross-site tracking cookies, so there is no consent banner to click past.

Changes

If we change how we use personal data we will update this page and change the date at the top. Anything material, we will tell venues about directly rather than leaving it here to be found.