Short version: we store the booking details a merchant's customers enter at checkout (name, contact details, the time booked) so the merchant can run their diary and send reminders. Data lives in London, we do not sell it, we do not use it for our own marketing, and we delete it when a merchant leaves or a customer asks the merchant to erase it.
1. Who is responsible
Booking Slot is operated by DadLink Technologies Limited, company number 16161444, registered office Handforth, Cheshire, United Kingdom. This policy sits under the umbrella privacy policy at dadlinktechnologies.co.uk/privacy. Where the two differ, this product policy applies to Booking Slot.
2. Merchants, customers and visitors
Three groups of people are covered here and our role differs for each.
- Merchants install the app on their Shopify store. For a merchant's own details (store name, owner contact, billing plan) we are the controller.
- Customers of a merchant make bookings. For customer data we are a processor acting on the merchant's instructions. The merchant is the controller and the merchant's own privacy policy governs how customer data is used beyond the booking. Customers with questions about their data should contact the merchant first.
- Visitors to booking-slot.com. For website analytics and enquiries we are the controller.
3. What we collect
From merchants
- Shopify store domain, store name, timezone, currency and plan, and the store owner's name and email as provided by Shopify.
- Services, staff and resource names, working hours and time off you enter in the app.
- Your chosen Booking Slot plan, SMS allowance and top-up purchases (amounts only; no card details, which stay with Shopify).
- Support emails you send us.
From customers, on behalf of merchants
- Name, email address and mobile number entered at Shopify checkout or by staff at POS.
- The service booked, the date and time, the staff member or resource, and the Shopify order reference.
- Booking status history: held, confirmed, rescheduled, cancelled, completed or no-show, with timestamps.
- The manage-booking token used in confirmation links, and reminder delivery status.
We do not collect payment card details, passwords, health information or other special category data. Merchants must not enter such data into free-text fields.
From website visitors
- Standard server logs: IP address, browser type, pages visited, referring page.
- Anything you send through the contact page or by email.
4. Why we use it
| Purpose | Data | Lawful basis |
|---|---|---|
| Showing availability and preventing double bookings | Services, resources, time off, existing bookings | Contract with the merchant |
| Creating, confirming and managing bookings | Customer name, contact details, order reference, times | Processor on the merchant's instructions |
| Sending confirmations and reminders | Customer email and mobile number, booking details | Processor on the merchant's instructions |
| Billing and plan limits | Store identity, plan, usage counts | Contract with the merchant |
| Support and fault fixing | Whatever is needed to reproduce the issue | Contract and legitimate interests |
| Security, abuse prevention and legal compliance | Logs, store identity | Legitimate interests and legal obligation |
| Website operation | Server logs | Legitimate interests |
We do not use customer data for our own marketing, profiling or advertising, and we do not sell personal data to anyone.
5. Data from Shopify
The app requests the minimum Shopify permissions it needs: reading and writing products (to link services and read product details), reading orders (to confirm bookings when paid and release them when cancelled or refunded) and reading customers (to attach the right customer to a booking). We receive order and customer data only through Shopify's approved webhooks and APIs under Shopify's protected customer data requirements.
Shopify's own privacy policy governs the data Shopify holds. We honour Shopify's mandatory data requests: when a customer asks a merchant for their data or its erasure, Shopify sends us a request and we respond within 30 days; when a store uninstalls, Shopify sends a shop redaction request 48 hours later and we delete the store's data.
6. Who we share it with
We use a small number of sub-processors to run the service. Each is bound by contract to protect the data and use it only for our instructions.
| Sub-processor | What for | Location |
|---|---|---|
| Google Cloud (Firebase, Cloud Run, Firestore) | Hosting, database and app servers | London, UK (europe-west2) |
| Shopify Inc. | The platform the app runs inside, billing | Canada, US and EU |
| Team Connect (DadLink Technologies Limited) | Sending SMS and email reminders | UK |
| Twilio | Underlying SMS carrier used by Team Connect | US and EU |
| SendGrid | Underlying email delivery used by Team Connect | US and EU |
| Google Calendar | Only if a merchant turns on calendar sync | Global |
We may also disclose data where the law requires it, to enforce our terms, or in a sale or reorganisation of our business, in which case this policy will continue to apply. We will update this list before adding a new sub-processor and merchants can object by email.
7. Where it is stored
Merchant and customer data is stored in Google Cloud's London region. Some sub-processors above operate outside the UK. Where personal data leaves the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on the UK's adequacy regulations, whichever applies.
8. How long we keep it
- Bookings and customer details: for as long as the merchant has the app installed, so the merchant's history and reporting work. Merchants can delete individual bookings at any time.
- After uninstall: everything is kept for 48 hours so a reinstall restores the store, then deleted in full when Shopify sends the redaction request. If the request is not received we delete anyway within 30 days.
- Expired holds: deleted automatically shortly after they expire.
- Reminder delivery records: 90 days.
- Billing records: 6 years, as required for UK tax and accounting.
- Server logs: 30 days.
- Support emails: 2 years after the matter is closed.
9. Security
Data is encrypted in transit and at rest. Access to production systems is restricted to the people who need it, protected by strong authentication and logged. Each merchant's data is separated by store and can only be reached through that store's authenticated Shopify session or the signed app proxy requests from that store's own storefront. Manage-booking links use single-purpose random tokens. Secrets are held in the hosting platform's environment configuration, never in code. If we discover a breach affecting personal data we will tell affected merchants without undue delay and notify the ICO where required.
10. Your rights
Under UK GDPR you can ask to access, correct, erase, restrict or receive a copy of your personal data, and object to processing based on legitimate interests. You can also complain to the Information Commissioner's Office at ico.org.uk.
If you are a merchant, email us and we will respond within one month.
If you are a customer of a merchant, contact the merchant, who controls your data. If they ask us to erase or supply your data we will do so within 30 days. If you contact us directly we will pass your request to the merchant and help them fulfil it.
11. Cookies
The booking-slot.com website sets no advertising or tracking cookies. The Shopify admin app uses a session cookie that is strictly necessary for keeping you signed in inside the Shopify admin. The storefront picker does not set cookies of its own; the slot hold is tied to the customer's Shopify cart. Full cookie details are in the umbrella policy at dadlinktechnologies.co.uk/cookies.
12. Data processing terms for merchants
Where we process customer data on your behalf, this section is our data processing agreement with you under Article 28 UK GDPR.
- We process customer data only to provide the app as described in these documents and on your documented instructions, which include your settings in the app.
- We keep the data confidential and ensure anyone with access is bound by confidentiality.
- We apply the security measures in section 9.
- We use only the sub-processors listed in section 6 and will notify you before changes.
- We help you respond to data subject requests and, where relevant, with your impact assessments and ICO consultations.
- We delete customer data at the end of the service as set out in section 8 unless UK law requires us to keep it.
- We make available the information you reasonably need to demonstrate compliance and will tell you promptly if we think an instruction breaks data protection law.
13. Changes
We will post any changes here with a new date at the top. For material changes affecting merchants we will also give notice in the app or by email at least 30 days before they take effect.
14. Contact
DadLink Technologies Limited, trading as Booking Slot
Company number 16161444, registered in England and Wales
Registered office: Handforth, Cheshire, United Kingdom
Privacy enquiries: privacy@booking-slot.com
General: hello@booking-slot.com