Privacy Policy.

1. Who we are

Activity Zone Bookings is a UK-based business that provides online booking systems for small businesses. For the purposes of UK data protection law, we are the data controller responsible for any personal data we collect through this website and our related services. You can contact us about any privacy matter by emailing info@activityzonebookings.co.uk.

2. What information we collect

When you use our website or services, we may collect the following categories of information. We have kept this list narrow on purpose because we only ask for what we genuinely need.

Information you give us directly. When you submit the contact form, you share your name, business name, email address, optionally a phone number, and the details of your enquiry. When you become a customer, you additionally share your business address, invoicing details, and any information needed to set up your booking system.

Information collected automatically. When you visit our website, our servers log your IP address, browser type, the pages you visit, and the approximate time of your visit. This is standard technical logging that helps us diagnose problems and measure site usage.

Google Analytics. We use Google Analytics to understand how visitors use our site, which helps us improve the content and design. Google Analytics collects information about your visit including pages viewed, time on site, and general geographic location derived from your IP address. The data is aggregated and we do not use it to identify individual visitors. Google acts as a data processor for this purpose. You can opt out of Google Analytics by installing Google's browser opt-out add-on available at tools.google.com/dlpage/gaoptout.

Security information from Cloudflare Turnstile. Our contact form uses Cloudflare Turnstile to protect against automated abuse. Cloudflare processes limited information about your browser and behaviour to decide whether you are a human visitor. More details are available in Cloudflare's privacy policy.

3. Why we collect it, and the legal basis

UK data protection law requires us to have a lawful reason for each type of processing we carry out. For each category of data above, the relevant legal basis is as follows.

Contact form submissions are processed on the basis of your consent and our legitimate interest in responding to business enquiries. We use the information only to reply to you and, if you become a customer, to set up your system. We do not add you to a mailing list or use your details for unrelated marketing.

Customer account and invoicing data is processed on the basis of contractual necessity. We need this information to provide the service you have engaged us for and to meet our legal obligations around invoicing and tax records.

Server logs and security information are processed on the basis of our legitimate interest in keeping the website secure and functional. The volume of this data is small and it is not used to build profiles of individual visitors.

4. How long we keep information

Contact form enquiries that do not result in a customer relationship are kept for up to twelve months and then deleted. Customer records are retained for the duration of our business relationship with you, and then for seven years afterwards to meet HMRC record-keeping requirements for invoices and business correspondence. Server logs are rotated automatically and retained for no more than thirty days.

5. Who we share information with

We do not sell your personal data to anyone, ever. We do share limited information with the following service providers where it is necessary to run our business.

Our hosting provider stores the server infrastructure that runs our website and your booking system. They do not access your data in the normal course of their operations but they could in principle do so for support or security purposes. Our hosting is provided by a UK-based company and all data is stored in the UK.

Cloudflare provides the Turnstile bot-protection service on our contact form and may process limited technical information for that purpose.

Google provides the Google Analytics service we use to understand how visitors use our site. Google processes visit data including IP addresses and pages viewed for this purpose.

Our email provider delivers the emails you send us and the replies we send back. Email content is processed by our mail provider in the normal course of delivery.

Our payment processor, Stripe, handles any payments you make to us for our services. Stripe acts as a separate data controller for payment information. Their privacy policy governs how they handle the card details and transaction information you provide to them.

We will also disclose information if we are required to by law, such as in response to a lawful request from a public authority.

6. Where your data is stored

Your data is primarily stored within the UK. Some of our service providers, such as Cloudflare, operate globally and may process data outside the UK or the European Economic Area. Where this happens, we rely on the safeguards provided by those providers, such as standard contractual clauses or adequacy decisions recognised by the UK government.

7. Your rights over your own data

Under UK data protection law, you have a number of rights over the personal data we hold about you. You can ask us to confirm what data we have, to provide you with a copy of it, to correct anything that is inaccurate, to delete it, to restrict how we use it, to object to certain kinds of processing, and to transfer it to another service provider in a portable format.

To exercise any of these rights, please email us at info@activityzonebookings.co.uk. We will respond within one calendar month, which is the statutory deadline. There is no fee for most requests. We may occasionally need to verify your identity before processing a request if the information is sensitive.

If you are unhappy with how we have handled a privacy matter, you have the right to make a complaint to the Information Commissioner's Office, which is the UK's independent regulator for data protection. The ICO can be reached at ico.org.uk. We would appreciate the chance to address any concerns directly first, but your right to complain to the ICO stands regardless.

8. Cookies and similar technologies

Our website uses a small number of cookies. These include a session cookie that protects the contact form against cross-site attacks, cookies set by Cloudflare Turnstile for bot protection, and cookies set by Google Analytics to help us understand site usage. The Google Analytics cookies typically expire after two years and do not identify you personally.

You can disable or block cookies entirely in your browser settings if you prefer, though doing so may prevent the contact form from working. If you want to opt out of Google Analytics specifically without disabling all cookies, Google provides a browser add-on at tools.google.com/dlpage/gaoptout that prevents the tracking without affecting other site functionality.

9. Changes to this policy

We may update this privacy policy occasionally to reflect changes in our practices, our service providers, or the law. When we make material changes, we will update the 'last updated' date at the top of the policy, and for significant changes we will notify existing customers by email.

10. Getting in touch

For any privacy-related question or request, please email info@activityzonebookings.co.uk. We read every message and respond within one UK working day.