Privacy,
properly explained.

01 · Scope and roles

Who this policy covers

This policy applies when you use the PayCal mobile application, visit paycal.co.uk, use a PayCal booking, payment, invoice, form, cancellation or rescheduling page, contact our support team, or otherwise interact with the PayCal service (together, the Service).

PayCal supports service businesses and their staff, as well as the customers who book or pay those businesses. Our role depends on the information involved:

If you are a customer of a business using PayCal, that business is your main contact for questions or requests about your booking record, forms, notes, photographs or other information it holds about you. We will assist the business where required.

02 · Information we handle

What we collect

We collect information directly from you, from the business you deal with, automatically from your device when you use the Service, and from service providers such as Stripe, Apple and Google.

03 · How and why we use it

Purposes and lawful bases

Where PayCal acts as controller, we rely on the lawful bases below. More than one basis may apply depending on the circumstances.

Where PayCal acts as a processor for a business, the business determines the purpose and lawful basis for using customer and staff information. Our processing is carried out to provide the Service under our agreement with that business.

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects. We do not use business customer records for third-party advertising.

04 · Who we share it with

Service providers, businesses and authorities

We share only what is reasonably necessary for the purpose concerned. Depending on the features used, recipients may include:

• The PayCal business you deal with, including its authorised staff, for bookings, customer management, forms, communications, invoices and payments.
• Stripe, for connected-account onboarding, Tap to Pay, online payments, payment links, recurring customer payments, refunds, fraud prevention and payment reporting. Stripe may act as an independent controller for parts of its payment and compliance services.
• Apple and Google, for app distribution, mobile subscription purchases, entitlement verification, push notifications and platform services.
• Hosting, database, storage, backup and security providers that run and protect PayCal's infrastructure.
• Communication providers, including Amazon Web Services for transactional email and VoodooSMS for SMS delivery, when a business uses those features.
• Diagnostics providers, including Firebase Crashlytics, for app stability and crash investigation.
• Professional advisers, insurers, auditors and prospective transaction partners, subject to appropriate confidentiality protections.
• Courts, regulators, law enforcement or other authorities where disclosure is required by law or is necessary to protect legal rights, users or the public.

We do not sell personal information. If ownership or control of all or part of PayCal changes, relevant information may transfer as part of that transaction, subject to applicable law and continued protection.

International transfers

Some providers may process information outside the United Kingdom. When a restricted transfer is made, we use an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, and supplementary security measures where required. You may contact us for more information about safeguards relevant to your information.

05 · Retention and security

How long we keep information

We keep personal information only for as long as it is reasonably needed for the purposes described in this policy. The exact period depends on the type of record, the business's instructions, legal and accounting requirements, security needs, and whether a dispute or claim is active.

• Account and business configuration is generally kept while the account is active and for a limited period after closure so that we can complete deletion, handle support, prevent abuse and resolve disputes.
• Customer, booking, staff, forms and media records are retained on the relevant business's instructions and in line with its own retention responsibilities. When our services end, information is deleted or returned in accordance with the agreement, subject to backups and legal requirements.
• Payment, subscription and financial records may be kept for the period required for accounting, tax, fraud prevention, chargebacks and legal claims.
• Authentication, audit, diagnostic and security logs are retained for limited periods based on operational and security need.
• Backups are protected and removed on a rolling schedule. Information deleted from live systems may remain in a backup until that backup expires, unless longer retention is legally required.

We review retention needs and delete or anonymise information when it is no longer required.

How we protect information

We use technical and organisational safeguards designed to protect personal information, including encrypted network connections, password hashing, encrypted provider credentials, rotating authentication tokens, device-session controls, access permissions, audit logging, backups and monitoring. No online service can guarantee absolute security, so users should protect their devices and credentials and contact us promptly if they suspect unauthorised access.

Cookies and local storage

Our public booking pages use essential browser storage to keep a booking or signed-in customer session working. Stripe and other payment providers may use necessary cookies or similar technologies on payment pages to provide security, prevent fraud and complete transactions. The PayCal marketing website does not currently use behavioural advertising cookies. If we introduce non-essential analytics or advertising technologies, we will provide appropriate information and choices first.

06 · Your rights

Your UK data protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• 01AccessAsk for a copy of your personal information.
• 02RectificationAsk us to correct incomplete or inaccurate information.
• 03ErasureAsk for information to be deleted where there is no lawful reason to keep it.
• 04RestrictionAsk us to limit how information is used in certain circumstances.
• 05PortabilityReceive certain information in a structured, machine-readable format.
• 06ObjectObject to processing based on legitimate interests and to direct marketing at any time.
• 07Withdraw consentWithdraw consent at any time where consent is the basis used.
• 08ComplainRaise a concern with the UK Information Commissioner's Office.

These rights are not absolute and an exemption may apply. We may need to verify your identity before acting on a request.

You may complain to the Information Commissioner's Office. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the ICO.

Other important information

Children and third-party services

Children

PayCal business accounts are intended for adults and authorised business users. A business may use PayCal to provide a service to a child or record information about a child where lawful and appropriate. In that case, the business is responsible for providing suitable privacy information and obtaining consent from a parent or guardian where required.

Links and third-party services

The Service may link to third-party websites or services with their own privacy practices. This policy does not govern processing that those third parties carry out independently.

Changes to this policy

We may update this policy as PayCal develops or the law changes. We will publish the revised version here, update the effective date and provide an additional notice where a change is material.