Introduction
This Privacy Policy explains how GridBook collects, uses, and protects personal information when using our scheduling platform for independent professionals.
By using the platform, you agree to the collection and use of information in accordance with this policy.
Who We Are
GridBook provides the scheduling platform described in this policy. For the personal data of account holders (service providers), GridBook is the data controller. For booking data that a service provider collects from their own customers, the service provider is the controller and GridBook acts as a data processor on their behalf.
For any data-protection query, or to exercise your rights, contact us at support@gridbook.co.uk.
Information We Collect
When a customer books an appointment, we may collect:
- Full name
- Nickname or preferred name
- Email address
- Phone number
- Appointment and booking details
We may also collect limited technical information such as:
- IP address
- Browser type
- Device information
- Session and usage data
How We Use Information
We use personal information to:
- Manage appointment bookings
- Send booking confirmations and notifications
- Allow service providers to manage appointments
- Improve platform functionality
- Prevent fraud or misuse
- Maintain platform security
Lawful Basis for Processing
Under UK GDPR, we rely on the following lawful bases:
- Performance of a contract — to create, manage, and confirm the bookings you request.
- Legitimate interests — to operate, secure, and improve the platform and to prevent fraud or misuse, balanced against your rights and freedoms.
- Legal obligation — where we must retain or disclose information to comply with the law.
- Consent — where we ask for it (for example, optional communications). You can withdraw consent at any time.
Professional Responsibility
Professionals using the platform are responsible for how they manage and communicate with their customers.
GridBook acts as a platform provider and data processor for booking information stored within the system.
Data Sharing
We do not sell personal information.
We may share limited data with trusted third-party providers used to operate the platform, including:
- Hosting providers
- Database providers
- Email delivery services
- Calendar integration providers
International Transfers
Some of the providers we use to operate the platform (for example, hosting, database, and email-delivery services) may process data outside the UK or European Economic Area. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an adequacy decision.
Data Retention
We retain booking data only as long as reasonably necessary for operational, legal, and security purposes.
Service providers can delete their account at any time from account settings. Doing so immediately takes the public booking page offline and stops new bookings. For 30 days afterward, the account is recoverable — signing back in restores everything exactly as it was. If the account is not restored within that window, it and all associated data (including services, availability, and booking records) are permanently and automatically deleted and cannot be recovered. You can also request deletion of your information sooner by contacting us.
Customers booking through GridBook don't have an account — instead, every booking confirmation includes a personal management link. From that link, you can download a copy of the personal information held about that booking, or permanently delete it. Deleting your data replaces your name, email, phone number, and any notes with placeholder values immediately, with no waiting period — this can't be undone. The appointment record itself (date, time, service) stays with the provider for their business records, but they'll no longer be able to identify or contact you about it.
Security
We use reasonable technical and organizational measures to protect personal information from unauthorized access, misuse, or disclosure.
However, no online platform can guarantee absolute security.
Your Rights
Depending on your location, you may have the right to:
- Access your data
- Correct inaccurate data
- Request deletion
- Object to certain processing activities
- Request a copy of your data in a portable format
- Withdraw consent where processing is based on consent
Requests can be made by contacting us.
If you believe your data has been handled improperly, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
Contact
For privacy-related requests or questions, contact:
Updates
We may update this Privacy Policy periodically. Continued use of the platform constitutes acceptance of any updates.