Privacy policy

This Privacy Policy explains how BookBreathe collects, uses, stores and protects personal information when you use our websites, applications and services.

BookBreathe is a trading name of Flam Labs Ltd, a company registered in England and Wales under company number 17480585, whose registered office is at Primrose Cottage, Eversley Centre, Hook, Hampshire, RG27 0NF, United Kingdom.

In this policy, "BookBreathe", "we", "us" and "our" refer to Flam Labs Ltd.

If you have any questions about this policy or how we use personal information, you can contact us at privacy@flamlabs.com.

1. Who this policy applies to

This policy applies to:

• people who create or use a BookBreathe account;
• employees, contractors and team members invited to a BookBreathe business account;
• visitors to our website;
• people who contact us directly; and
• customers or prospective customers whose information is processed through BookBreathe by a business using our Service.

BookBreathe is primarily a business-to-business service.

2. Our role when processing personal data

There are two main situations in which BookBreathe processes personal data.

Information about BookBreathe users

Where we collect personal information about people who create accounts, pay for BookBreathe, contact us or use our website, we act as the data controller.

This means we determine why and how that information is processed.

Information about your customers

Businesses using BookBreathe may collect and manage personal information about their own customers or prospective customers through the Service.

For example, this may include:

• customer names;
• email addresses;
• telephone numbers;
• enquiry details;
• messages;
• booking information;
• uploaded files;
• quotes;
• payment information; and
• other information submitted through an enquiry form.

In these circumstances, the business using BookBreathe will generally be the data controller, and BookBreathe will act as a data processor on that business's behalf.

Our processing of this information is governed by our Terms of Use and, where applicable, our Data Processing Agreement.

3. Information we collect

Depending on how you use BookBreathe, we may collect the following information.

Account information

This may include:

• your name;
• email address;
• password credentials in encrypted or hashed form;
• business name;
• business contact details;
• business address;
• account role;
• account preferences; and
• information about other people you invite to your account.

Business information

You may provide information about your business, including:

• services;
• prices;
• branding;
• contact information;
• enquiry forms;
• booking terms;
• availability information; and
• other business settings.

Customer and enquiry information

When your customers use BookBreathe, the information processed may include:

• names;
• email addresses;
• telephone numbers;
• enquiry responses;
• event or booking information;
• messages;
• notes;
• uploaded files;
• quotes;
• payment records; and
• booking history.

The exact information collected depends on how the business using BookBreathe configures its enquiry forms and Service.

Payment information

Payments may be processed by Stripe.

We generally do not receive or store full payment card numbers.

Stripe may provide us with information such as:

• payment status;
• payment amount;
• transaction identifiers;
• card type;
• limited card details such as the last four digits;
• connected Stripe account information; and
• information relating to refunds, disputes or chargebacks.

Stripe processes payment information under its own privacy terms.

Technical information

When you use BookBreathe, we may automatically collect information including:

• IP address;
• browser type;
• device type;
• operating system;
• pages accessed;
• timestamps;
• login activity;
• security events;
• error logs; and
• general usage information.

We use this information to operate, secure and improve the Service.

Communications

If you contact us, we may retain information contained in your correspondence with us, including support requests and emails.

4. How we use personal information

We may use personal information to:

• provide and operate BookBreathe;
• create and administer accounts;
• authenticate users;
• process enquiries, messages, quotes and bookings;
• process or facilitate payments;
• provide customer support;
• send transactional emails and notifications;
• manage subscriptions and billing;
• prevent fraud and abuse;
• protect the security of BookBreathe;
• diagnose errors and software bugs;
• maintain logs and backups;
• improve the performance and usability of the Service;
• comply with legal obligations;
• enforce our Terms of Use; and
• establish, exercise or defend legal claims.

Where analytics are enabled, we may also use aggregated website usage information to understand how visitors use our website and improve it.

5. Our lawful bases

Under UK data protection law, we must have a lawful basis for processing personal data. The appropriate lawful basis depends on the reason we are using the information.

We generally rely on the following.

Contract

We process information where it is necessary to provide BookBreathe and fulfil our contractual obligations to you.

For example:

• creating your account;
• providing the Service;
• processing subscriptions;
• providing support; and
• administering your business account.

Legitimate interests

We may process information where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights.

These interests may include:

• securing BookBreathe;
• preventing fraud;
• improving the Service;
• monitoring reliability;
• responding to support requests;
• maintaining records;
• protecting our legal rights; and
• understanding how our Service is used.

Legal obligation

We may process information where required to comply with applicable laws, regulations, tax obligations, court orders or lawful requests.

Consent

Where required, we may rely on consent.

For example, we would normally rely on consent for non-essential analytics cookies such as Google Analytics.

You may withdraw consent at any time.

6. Google Analytics

We may use Google Analytics to understand how visitors use our website.

Google Analytics may collect information such as:

• pages viewed;
• approximate location;
• device type;
• browser information;
• referral source;
• interactions with the website; and
• general usage information.

Where required by law, Google Analytics will only be enabled after you have given consent through our cookie controls.

You can withdraw or change your consent at any time.

If we use Google Analytics, information may be processed by Google in countries outside the UK.

For more information about how Google processes information, please refer to Google's privacy documentation.

7. Cookies

BookBreathe may use cookies and similar technologies.

Some cookies are strictly necessary for the Service to function.

These may be used for things such as:

• logging you in;
• maintaining your session;
• remembering security settings;
• preventing fraud; and
• keeping the Service secure.

We may also use optional analytics cookies, such as those used by Google Analytics.

Where required, optional cookies will not be placed until you have provided consent.

You can change your cookie preferences at any time through our cookie controls.

8. Who we share information with

We do not sell personal information.

We may share information with trusted service providers where necessary to operate BookBreathe.

These may include providers of:

• website and application hosting;
• databases;
• cloud infrastructure;
• email delivery;
• file storage;
• payment processing;
• monitoring and error reporting;
• analytics;
• security services; and
• customer support tools.

Examples may include Stripe for payment processing and Google if Google Analytics is enabled.

These providers are only permitted to process information as necessary to provide their services to us and are subject to their own contractual and legal obligations.

We may also disclose information where reasonably necessary:

• to comply with the law;
• to respond to a court order or lawful authority;
• to investigate fraud or security incidents;
• to protect BookBreathe, our users or others;
• to enforce our agreements; or
• in connection with a merger, acquisition, restructuring or sale of our business.

9. International transfers

Some companies that provide services to BookBreathe may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that appropriate safeguards are in place as required by applicable data protection law.

These safeguards may include:

• UK adequacy regulations;
• approved contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another legally recognised transfer mechanism.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Retention periods vary depending on the type of information.

For example, we may retain:

• account information for the duration of your account;
• transaction and financial records for periods required by tax and accounting law;
• security and system logs for a limited period;
• support communications where reasonably necessary;
• backups for a limited period after data is removed from the live Service; and
• information required to establish or defend legal claims.

When an account is deleted, information may remain within backups for a limited period before being automatically removed.

Where BookBreathe processes customer information on behalf of a business, retention may also depend on instructions given by that business.

11. Security

We take reasonable technical and organisational measures designed to protect personal information.

These may include:

• encryption in transit;
• password hashing;
• access controls;
• authentication controls;
• secure hosting;
• logging and monitoring;
• private file storage;
• backups;
• software updates; and
• restrictions on internal access to personal information.

However, no internet-based service or storage system can be guaranteed to be completely secure.

You are also responsible for protecting your BookBreathe account, passwords, devices and authentication credentials.

12. Your data protection rights

Depending on the circumstances, UK data protection law gives you rights including the right to:

• request access to personal information we hold about you;
• ask us to correct inaccurate information;
• ask us to delete your information;
• ask us to restrict how your information is used;
• object to certain types of processing;
• request transfer of your information in certain circumstances;
• withdraw consent where we rely on consent; and
• complain about how your information has been handled.

These rights are not absolute and may depend on the circumstances.

To exercise your rights, contact us at privacy@flamlabs.com.

We may need to verify your identity before responding to a request.

13. Requests concerning information held by a BookBreathe business

If you are a customer of a business using BookBreathe and wish to exercise rights relating to information that business holds about you, you should normally contact that business directly.

For example, if you submitted an enquiry through a photographer, makeup artist or other BookBreathe user, that business will generally be responsible for deciding how your personal information is used.

Where appropriate, BookBreathe will assist businesses in responding to legitimate data protection requests.

14. Children

BookBreathe is intended for use by businesses and professionals.

We do not knowingly offer BookBreathe accounts directly to children.

Businesses using BookBreathe are responsible for ensuring they have an appropriate lawful basis where they collect information relating to children through their own enquiry forms or customer relationships.

15. Automated decision-making

We do not currently use personal information to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

If this changes, we will update this Privacy Policy where required.

16. Marketing

We may contact BookBreathe users about matters relating to their account or the operation of the Service.

These are service communications and may include:

• security notifications;
• payment information;
• account changes;
• important product changes; and
• other operational messages.

If we send optional marketing communications, you will be able to unsubscribe from them.

We do not use customer data submitted to BookBreathe by businesses to independently market BookBreathe to those customers.

17. Changes to this policy

We may update this Privacy Policy from time to time as BookBreathe evolves or where laws, technologies or our processing activities change.

When we make material changes, we may notify BookBreathe users through the Service, by email or by another appropriate method.

The latest version will always show the date on which it was last updated.

18. Complaints

If you have concerns about how we handle personal information, please contact us first at privacy@flamlabs.com.

You also have the right to complain to the UK data protection regulator:

Information Commissioner's Office (ICO)

You can find information about making a complaint on the ICO website.

19. Contact

For privacy questions or requests, contact: