Privacy Policy

Effective date: 6 October 2026

1 Who we are

SomeBooking is operated by HELP TECHNOLOGIES LIMITED, registered in England and Wales under company number 16794762, trading as SomeBooking. SomeBooking is a product of Helplexa. Our registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We refer to that company as “we”, “us” or “SomeBooking”.

Contact us about privacy or a data protection complaint at [email protected], or by post at our registered office marked SomeBooking Privacy.

This notice covers our website, sign-in and account services, web application, mobile and tablet apps, public booking pages and related support. It is intended for business owners, staff and other authorised users, prospective customers, website visitors and people making bookings. It explains our roles, the information involved and how to exercise your rights.

2 Our role and the business you book with

We act as a controller when we decide why and how to use information for our own activities, such as administering SomeBooking accounts, charging subscriptions, managing customer relationships, securing the platform and meeting our legal obligations.

When a business uses SomeBooking to manage bookings, guests and staff access, that business normally decides the purposes of the relevant records and is the controller. We process those records on its behalf under our data processing agreement. A group can contain several legal businesses; their actual arrangements determine whether they are separate or joint controllers. Creating a group in the software does not settle that legal question.

If you book with a venue, read its privacy notice as well. It is responsible for explaining its booking, guest-contact, operational-note and marketing practices. Contact the venue about a booking record or refund. If you cannot identify the business, contact us and we will help route your request. We remain responsible for information we use for our own purposes and for our duties as a processor.

Stripe and Google have their own roles for payment processing and Google sign-in. Their processing is explained in their notices as well as the relevant sections below.

3 Information we collect and its sources

• Account and contact information includes your name, email address, business details, contact preferences, account identifiers, membership of businesses or locations, roles and permissions, and correspondence with us. We obtain this from you, an authorised administrator who invites you, or your chosen sign-in provider. Information identifying a user may be associated with more than one membership where the service supports this; access to business records still depends on permissions.
• Authentication information includes records needed to support email sign-in, verification and sessions, and Google sign-in identifiers and tokens where relevant. If you use Google sign-in, Google supplies the information shown on its authorisation screen, typically your account identifier, email address and basic profile information. We do not receive your Google password.
• Business and public-page content includes business and venue names, addresses, contact details, descriptions, branding, images, opening hours and booking settings entered by the business. Content published on public pages can be read by visitors and may appear in search engines. Do not place staff private contact details or guest records in public descriptions.
• Booking information is entered by guests or authorised staff and can include names, email addresses, phone numbers, booking date and time, venue, party size, booking status, special requests, attendance history, communications and payment status. A person arranging a booking may provide information about others in the party. The business should collect only what is necessary and explain its practices to those people.
• Allergy and accessibility information may reveal health information. We handle it on the business’s instructions where it is necessary and lawfully collected. It is not a required part of subscribing to SomeBooking. Please avoid entering unnecessary medical detail or information about another person without appropriate authority.
• Subscription and payment records can include billing name and address, tax details, invoices, subscription status, transaction identifiers, amount, currency, limited payment-method details such as card brand and last four digits, and payment, refund or dispute status. We receive relevant information from the payer, business and Stripe. The supported payment flow sends full card details to Stripe rather than ordinary booking fields.
• Technical information can include IP address, browser and operating-system details, app version, device identifiers used for sessions or push delivery, timestamps, log-in events, error reports and actions taken within the service. We obtain this through operating the website and apps and from relevant service providers.
• Support information includes messages and attachments you choose to send us, diagnostic details and records of how we resolve an issue. We may access relevant account or booking information where necessary and authorised to investigate a problem. Avoid sending full payment credentials or unnecessary sensitive guest information to support.

4 Why we use information as controller

The following explains our purposes and legal bases under UK and, where applicable, EU data-protection law. We identify the basis that fits the particular activity; we do not rely on every basis for every use.

Account creation, authentication and access administration: to provide the service requested. We rely on contract where you are personally our contracting customer, such as a sole trader. For an employee or company representative who is not personally party to the subscription, we rely on legitimate interests in delivering and administering the business service securely.

Subscription billing and customer administration: to process authorised charges, manage renewals, answer billing questions and maintain customer records. We rely on contract where applicable, otherwise legitimate interests in administering the customer relationship. We rely on legal obligation for records required by tax and accounting law.

Support and service communications: to answer enquiries, troubleshoot, notify customers of relevant incidents, and explain material service or contract changes. We rely on contract where applicable or legitimate interests in supporting customers and keeping them informed. These communications are separate from optional marketing.

Security and abuse prevention: to detect suspicious access, protect data, investigate incidents and enforce proportionate service rules. We rely on legitimate interests in operating a secure and reliable service, and legal obligation where applicable. We limit access and retention according to the risk and purpose.

Product reliability and improvement: to understand failures and improve usability and performance using necessary diagnostic information and, where implemented, usage analysis. We rely on legitimate interests where proportionate, with consent for device storage or access where required. We prefer aggregated or de-identified information and do not treat pseudonymous identifiers as automatically anonymous.

Marketing to business contacts: to send SomeBooking news or offers only where lawful. We use consent where required and may rely on legitimate interests where electronic-marketing rules permit it. Any soft opt-in must meet all applicable conditions. You can object or unsubscribe at any time.

Legal compliance and disputes: to answer binding requests, meet statutory duties, obtain professional advice and establish or defend legal claims. We rely on legal obligation for mandatory disclosures and legitimate interests for appropriate claims management. Special-category information is used only where an additional lawful condition applies.

Where we rely on legitimate interests, we consider whether the use is necessary and proportionate and balance it against the individual’s rights. You can ask us for more information and object as explained in section 12.

5 Booking records and sensitive information

For booking data processed on behalf of a business, the business determines and must explain its legal basis. This may include taking steps requested by a guest before a booking contract, performing that contract, legitimate operational interests, legal duties or consent as appropriate. Those are the business’s bases; we do not claim a subscription contract with a restaurant automatically provides a contractual basis for every use of its guests’ data.

Health-related notes require both an ordinary lawful basis and an additional condition for special-category data. Where a business relies on explicit consent, it must obtain a clear, specific statement, keep evidence and offer a way to withdraw it. Simply accepting general booking terms or this notice is not explicit consent to all health-data processing.

Only provide the detail necessary to explain a request. Discuss allergies and safety-critical needs directly with the venue. A booking note does not confirm that the venue can safely meet those needs. Contact the business if you want such a note corrected, removed or no longer used.

We do not use identifiable guest information for SomeBooking’s unrelated advertising, sale of guest lists or training general-purpose AI models.

6 Who can receive information

• The business and its authorised users: relevant staff can see booking and operational information according to their permissions. Group-level users may have access across businesses where the administrator grants it and sharing is lawful. Staff should ask their employer or account administrator about its access and audit practices. Paying a group invoice does not automatically grant access to every business’s guest data.
• Service providers: we use suppliers for hosting, storage, backups, email delivery, diagnostics, security, support and any enabled push notifications or analytics. They receive the information necessary for their roles under appropriate arrangements. You can request details of the subprocessors handling customer records by emailing [email protected].
• Stripe: it receives information needed for subscriptions or a business’s booking-payment flow and returns relevant payment and account status. Stripe also uses information for its own payment, verification, fraud-prevention and legal purposes. Its role can be controller or processor depending on the activity. See https://stripe.com/privacy. Businesses manage their guest-payment refunds and disputes directly with Stripe and their customers. SomeBooking handles only its own subscription billing queries.
• Google: choosing Google sign-in causes information to pass between Google and SomeBooking for authentication. Google’s own processing is explained at https://policies.google.com/privacy. We request only the permissions needed for the disclosed sign-in function. Email sign-in provides the alternative described in the service.
• App and device services: Apple, Google and any enabled push-delivery provider may process device and delivery information to distribute the app or deliver notifications. Their own services have separate terms and notices. You can manage notification permissions in your device settings.
• Professional advisers and authorities: we may disclose necessary information to legal advisers, accountants, insurers, courts, regulators or law-enforcement bodies where there is a lawful reason. We assess requests and do not disclose data merely because an unverified requester asks for it.
• Business transfers: relevant information may be disclosed confidentially during a genuine restructuring, financing or sale, subject to safeguards and a lawful basis. If responsibility for your information changes, we will provide appropriate notice. The receiving organisation remains subject to applicable data-protection duties.
• We do not sell personal data.

7 Offline mode and local information

Supported mobile and tablet apps can store previously synchronised records and pending changes on the device so authorised staff can work offline. This may include guest information. Those records may remain locally until synchronisation, logout, expiry or removal according to the implemented app behaviour.

The business controls who uses its devices and should secure them, restrict access and remove data when the device is reassigned or disposed of. Revoking a user’s server access cannot be assumed to instantly erase a disconnected device. A device owner should report loss or compromise promptly and follow the business’s device-management process.

When connectivity returns, supported local changes are sent to SomeBooking and synchronised. Conflicts and failed changes may need review. Local records can be outdated; this notice does not promise that every change is received or that every feature works offline.

8 Where information is handled

Authorised access and our suppliers’ processing may involve the UK, EEA and other countries. Where a transfer is restricted under applicable law, we use a valid mechanism such as an adequacy decision or appropriate contractual safeguards, with the assessments and supplementary protections required for that transfer. We do not rely merely on continued use of SomeBooking as consent to international transfers.

You can contact us for details of destinations and applicable safeguards and request a copy, with lawful redactions.

9 How long information is kept

We keep personal information for the period needed for its stated purpose, taking account of account activity, the business’s documented instructions, sensitivity, legal obligations, security needs and genuine disputes. We do not retain everything indefinitely because it might be useful later.

Account and membership information is kept while needed to provide and administer the relevant account. Removing one membership does not necessarily delete an identity needed for another active membership. Information no longer required is deleted or de-identified, subject to legal obligations and necessary records of disputes.

Booking records, guest notes and business audit records are retained on the relevant business’s documented instructions for as long as necessary for its lawful purposes. Sensitive notes should be removed when no longer needed. Contact the business about its retention choices or to request deletion.

Security logs and diagnostic records are kept for the period necessary to investigate faults, detect misuse and protect the service, taking account of the severity and duration of the relevant risk. Records relevant to an incident or legal claim may be retained until that matter is resolved and applicable legal requirements are met.

Support correspondence is retained as necessary to resolve the issue, provide related follow-up and manage any resulting complaint or claim. Unnecessary sensitive attachments are removed when no longer needed.

Subscription invoices and accounting records are retained for the period required by applicable tax and accounting law. This does not justify keeping unrelated guest information for the same period.

Where we send marketing, preferences and the minimum suppression information are retained as necessary to respect withdrawals and objections. Evidence of consent is kept as necessary to demonstrate compliance.

On account closure, return and deletion of business records follow the business’s instructions and our Terms and Conditions, subject to legal retention duties and applicable retrieval or switching rights. Cancelling paid renewal while remaining on a free plan is not account closure.

Backup copies are isolated from ordinary use until overwritten or deleted through the backup lifecycle. They remain protected, and applicable deletion instructions are reapplied if a backup is restored.

Offline copies and exports held on a business’s devices remain subject to its device and retention controls. Businesses must manage the copies they hold. A disconnected device cannot be assumed to have received a server-side deletion or access-revocation instruction.

10 Security

We use technical and organisational measures appropriate to the risks of the personal data we handle. These measures include access restrictions, secure authentication, encrypted transmission, protection of credentials, monitoring, patching and backup arrangements.

No system can guarantee absolute security. That does not remove our obligation to take appropriate precautions, respond to incidents or notify affected businesses, individuals or authorities where required. If you suspect unauthorised access, contact [email protected]. Do not send passwords, sign-in links or full card details with your report.

11 Cookies device storage and communications

Our websites and apps use storage and access technologies necessary for functions such as authentication, security and requested offline access. Other technologies may support preferences, analytics or third-party features if enabled. Rules can apply to local storage, app SDKs and similar technologies as well as browser cookies.

When website analytics is enabled, we use Google Analytics to measure page views and supported sign-in or registration interactions. This can involve analytics cookies, device or browser information and page information. Our analytics configuration disables Google signals and advertising personalisation. A website cookie-choice banner and in-site controls to refuse or withdraw optional analytics are not currently available. Browser settings may allow you to restrict cookies. We will update this notice when cookie-choice controls or tracking practices change.

We and businesses can send necessary booking and account communications through enabled channels. Promotional messages need a separate lawful basis and any required permission. Refusing optional marketing does not prevent a genuine booking. Device permission to receive push notifications is not blanket consent to advertising.

12 Your rights and choices

Depending on applicable law and the processing involved, you can ask to access your personal data, correct inaccurate data, delete it, restrict its use, or receive eligible data in a portable format. These rights have conditions and exceptions; for example, some accounting records must be retained. You can withdraw consent where we rely on it, without affecting the lawfulness of earlier processing.

YOUR RIGHT TO OBJECT You can object to processing based on legitimate interests for reasons connected with your situation. We will stop unless we can demonstrate grounds that legally override your interests or the processing is needed for legal claims. You can object to direct marketing at any time, and we will stop using your data for that purpose.

Contact [email protected] to exercise rights. We may request proportionate information to verify identity or clarify a request. We normally respond within one month, subject to lawful extensions or adjustments which we will explain. Requests are normally free; we charge or refuse only where the law permits and explain why. You do not need to pay a subscription to exercise rights.

For records a business controls, contact that business first where practical. If you contact us, we will help route the request and assist the business as required. We do not refuse our own controller obligations merely because you also have a relationship with a venue.

Mandatory data fields are identified in the interface. Without information needed to authenticate you, administer a subscription or process the requested booking, that function may not be available. Optional marketing and unnecessary sensitive information are not conditions of ordinary service access.

13 Automated decisions and children

We do not currently make solely automated decisions about individuals that have legal or similarly significant effects. Routine availability rules, booking status changes and payment checks may operate automatically; businesses remain responsible for their settings and decisions. Stripe may carry out its own fraud and payment assessments under its notice. If significant profiling or automated decision-making is introduced, we will assess it and provide required information and safeguards before use.

SomeBooking’s administration tools are intended for business use and its public booking service is not designed to be directed at children. An adult can arrange a booking that includes children, but should provide only necessary details. Businesses must handle any children’s data lawfully. If a child’s information has been included unnecessarily, contact the business or us so it can be addressed.

14 Complaints and changes

If you have a data protection complaint, contact [email protected] with a description of your concern. We will acknowledge it within 30 days, take appropriate steps to investigate without undue delay, keep you appropriately informed and communicate the outcome and relevant next steps.

You can complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113. You may also complain to the competent authority where you live, work or where an alleged infringement occurred, as applicable. You do not lose that right by contacting us, and we do not require you to waive it.

We will update this notice when our practices or legal requirements change and show the new date. We will bring material changes to your attention where appropriate and obtain fresh consent where required. A notice update does not automatically authorise an incompatible new use of previously collected data.