

Cookie Policy

BookinClass – Privacy Policy

Effective Date: 01/03/2026

This Privacy Policy explains how BookinClass Ltd collects, uses, stores and shares your personal data when you use www.bookinclass.co.uk and any BookinClass-branded subdomains (the “Site”).

Data Controller: BookinClass Ltd (the “Supplier”, “BookinClass”, “we”, “us”, “our”)
Company number: [INSERT]
Registered office: [INSERT]
Support email: support@bookinclass.co.uk

1. Who we are

BookinClass Ltd operates an online booking, membership and payment platform that connects parents, carers and consumers (“End-Users”) with activity providers, clubs, schools, childcare providers and venues (“Providers”).

For questions about this Privacy Policy or how we handle your data, please contact us at support@bookinclass.co.uk.

2. What personal data we collect

If you are an End-User (parent / carer / consumer)

We may collect:

Account information: name, email address, password (hashed), phone number;
Booking information: sessions, clubs or activities booked, dates, times, attendance;
Payment information: transaction records and partial card details (full card data is handled directly by our payment processor Stripe — we do not store full card numbers);
Children’s details: names, ages, and where provided by you, medical information, allergies, SEND needs, and emergency contact details for the purposes of safeguarding and service delivery;
Communications: messages sent to us via support or email;
Technical data: IP address, browser type, device information and pages visited, collected as part of normal website operation.

If you are a Provider

We may collect:

Organisation name, contact name, email address, phone number;
Registered address and company/charity number where applicable;
Bank account and payment processing details (via Stripe);
Listings, session data, policies and documents you upload to the platform;
Communications and support interactions.

3. How and why we use your personal data

We process your personal data for the following purposes and on the following lawful bases under UK GDPR:

To provide the platform and fulfil bookings

Lawful basis: Performance of a contract (Article 6(1)(b))
We use your data to create and manage your account, process bookings and payments, and share necessary details with the relevant Provider so they can deliver the booked service.

To comply with our legal obligations

Lawful basis: Legal obligation (Article 6(1)(c))
We may process data to comply with financial, tax, safeguarding and other legal requirements.

To operate and improve the platform

Lawful basis: Legitimate interests (Article 6(1)(f))
We use technical and usage data to maintain platform security, prevent fraud, resolve disputes and improve our service. Our legitimate interest is in operating a safe and effective platform. This processing does not override your rights and interests.

To send you marketing communications

Lawful basis: Consent (Article 6(1)(a))
Where you have opted in, we may send you marketing emails about BookinClass features, updates and relevant offers. You can withdraw your consent at any time — see Section 8.

4. Children’s personal data

BookinClass is a platform used by parents and carers to book activities for children. We take children’s privacy seriously.

Only adults aged 18 or over may create accounts and make bookings.
Children’s personal data (including names, ages, medical/SEND information and emergency contacts) is collected from the parent or carer booking on their behalf.
This data is shared with the relevant Provider solely for the purposes of delivering the booked service, maintaining attendance registers, and managing safeguarding obligations.
Providers are independently responsible for how they process children’s data in their own systems and must have appropriate safeguarding and data protection measures in place.
Where special category data (such as health or SEND information) is provided, we process it on the basis of explicit consent given by the parent or carer, or where necessary for reasons of substantial public interest (safeguarding) under UK GDPR Article 9.

5. Sharing your personal data

We share personal data only as necessary and as described below:

With Providers

When you make a booking, we share your booking details (and where applicable, children’s details provided by you) with the Provider delivering that service. Providers act as independent data controllers for the data they receive and are responsible for their own privacy practices and compliance.

With payment processors

We use Stripe to process payments. Stripe receives payment card data and transaction information directly. Please refer to Stripe’s Privacy Policy for details of how they handle your data.

With authorities

We may disclose personal data to law enforcement, regulatory authorities or courts where required by law or to protect the rights, safety or property of BookinClass, our users or the public.

Business transfers

In the event of a merger, acquisition or sale of all or part of our business, personal data may be transferred to the relevant third party. We will notify you of any such change via the Site or by email.

We do not sell your personal data to third parties.

6. Third-party processors

We use the following third-party processors who may process personal data on our behalf:

Stripe – payment processing
20i – platform and data hosting (UK-based)

Transactional and marketing emails are sent directly from the BookinClass platform and are not processed by any third-party email provider.

All processors are required to process data only on our instructions and in compliance with applicable data protection law.

7. Cookies

We use strictly necessary cookies to operate the Site. These are essential for functions such as keeping you logged in and maintaining your session, and cannot be disabled.

We do not currently use analytics or tracking cookies. If this changes in the future, we will update this Privacy Policy and obtain any consents required by law before doing so.

You can control cookies through your browser settings at any time.

8. Marketing communications

We will only send you marketing emails if you have given us your explicit consent to do so (for example, by ticking an opt-in box during registration or at checkout).

You can withdraw your consent and unsubscribe from marketing emails at any time by:

clicking the “unsubscribe” link in any marketing email we send; or
contacting us at support@bookinclass.co.uk.

Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it. We will continue to send you transactional emails related to your account and bookings as these are necessary for the performance of your contract with us.

9. International transfers

Your personal data is hosted in the UK by 20i and does not leave the UK as part of our core platform operations. Stripe processes payment data in accordance with its own international transfer mechanisms — please see Stripe’s Privacy Policy for details.

10. How long we keep your data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our general retention periods are:

Account data and booking/transaction records: 7 years from the date of the transaction or account closure, in accordance with HMRC requirements;
Children’s data (including medical/SEND information): for the duration of the booked activity plus any period required for safeguarding or legal compliance;
Marketing consent records: until you withdraw consent, plus a reasonable period thereafter to evidence compliance.

When data is no longer required, it is securely deleted or anonymised.

11. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access: you can request a copy of the personal data we hold about you;
Right to rectification: you can ask us to correct inaccurate or incomplete data;
Right to erasure: you can ask us to delete your data in certain circumstances (the “right to be forgotten”);
Right to restriction: you can ask us to restrict how we process your data in certain circumstances;
Right to data portability: you can ask us to provide your data in a structured, commonly used and machine-readable format;
Right to object: you can object to processing based on legitimate interests or for direct marketing purposes;
Right to withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at support@bookinclass.co.uk. We will respond within one calendar month. We may need to verify your identity before processing your request.

Some rights are not absolute and may be subject to exemptions under UK data protection law. Where we are unable to fulfil a request, we will explain why.

12. How to complain

If you have a concern about how we handle your personal data, please contact us in the first instance at support@bookinclass.co.uk and we will do our best to resolve it.

If you remain unhappy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk
Helpline: 0303 123 1113

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal obligations. Where changes are material, we will notify you via the Site or by email where practicable. The effective date at the top of this page will always reflect when the policy was last updated.

We encourage you to review this Privacy Policy periodically.