Privacy Policy

1. Who we are

Take Bookings Now is a trading name of Take Orders Now LTD, a company registered in England and Wales under company number 16869591. Take Orders Now LTD is the data controller referred to in this policy.

We provide online booking software to businesses. This policy explains how we handle personal data.

There are two distinct relationships to be clear about:

• Businesses that subscribe to us. We are the data controller for their account data.
• The customers of those businesses. The business is the data controller; we are a data processor acting on their instructions.

2. Data we hold about subscribing businesses

• Account details: name, email address, telephone number, password (hashed)
• Business details: trading name, address, contact details, opening hours
• Billing details: subscription price, payment history, invoices
• Technical data: IP address, browser type, login timestamps
• Security data: two-factor authentication settings, audit records

3. Data we process on behalf of businesses

When a business uses the Service, we store the customer records and appointment details they enter or that their customers submit — typically name, contact details, appointment history, and any notes the business adds.

We process this only to provide the Service. We do not use it for our own purposes, do not sell it, and do not share it with other businesses.

4. Website analytics and security logging

Whenever anyone loads a page — our own site, a business's booking page, or the portals — we keep a short technical record of that visit:

• The IP address the request came from
• The browser, operating system and device type the browser reports
• The page visited, and the page it was reached from
• An approximate location (country, and town where our network provider supplies one) worked out from the IP address
• The time of the visit, and how long the page took us to serve

We do this to run and protect the Service: to see that it is working, to understand which pages are used, and to spot abuse. Our lawful basis is our legitimate interests in operating and securing the platform.

Location comes from information our content delivery network (Cloudflare) already adds to requests passing through it. No IP address is sent to any third-party lookup service to work out where a visitor is.

This record is visible only to us. It is not shared with the businesses whose pages were visited, is never used for advertising, profiling or automated decision-making, and is not sold or shared with anyone.

We delete these records automatically after 90 days.

For this log we are the data controller — including for visits to a business's booking page — because the log exists for our own operational purposes rather than the business's.

5. Why we process data

• To provide and operate the Service (performance of a contract)
• To take payment for subscriptions and add-ons (performance of a contract)
• To keep accounts secure and detect misuse (legitimate interests)
• To run, protect and improve the website, as described in section 4 (legitimate interests)
• To meet legal and accounting obligations (legal obligation)
• To send service-related emails such as booking confirmations and reminders (performance of a contract)

We do not send marketing emails without consent.

6. Sharing

We share data only with the providers needed to run the Service — payment processing, email delivery, SMS delivery and hosting — and only what each needs. We do not sell personal data to anyone.

7. Security

Data is encrypted in transit. Passwords are hashed and never recoverable. Sensitive credentials, including payment provider keys, are encrypted at rest. Each business's data is logically separated, and access is scoped so one business cannot read another's records.

8. Retention

We keep account data for as long as the account is open, and for a reasonable period afterwards to meet legal and accounting obligations. Data processed on behalf of a business is retained according to that business's instructions.

Website analytics and security records (section 4) are deleted automatically 90 days after the visit.

9. Your rights

You have the right to access, correct, erase, restrict, port, or object to the processing of your personal data, and to complain to the Information Commissioner's Office.

If you are the customer of a business using Take Bookings Now, please contact that business first — they control your data. We will help them respond.

10. Contact

[email protected]