Privacy policy

Draft for review: to be checked against POPIA, ideally by a lawyer, before xBooking goes live.

In short: we collect only what's needed to make and run bookings, we don't sell it or use it for advertising, and each business sees only its own customers' details.

Who's responsible

For a booking, the business you book with is responsible for your information (the "responsible party" under POPIA); N epoch Technologies (Pty) Ltd runs xBooking for it (an "operator"). For businesses' own accounts, and for feedback and messages sent to us, we are responsible.

What we collect

When you book: your name, email and phone number, what you booked and when, any notes you add, and whether you've paid.
When you book for someone else, such as a child's swimming lessons: their name and the details the business asks for (for example their age or swimming level). Please share only what's needed.
Waiting lists: the same details, to offer you a place when one opens.
Reviews: if you review a booking or a purchase, your rating, your comment and any pictures or files you attach. They're public on the business's page, with your first name and last initial, never your email or phone. Location details in pictures are removed. Please don't put in anything you don't want public.
Businesses: the owner's name, email and password (stored only as a secure hash), the business's details and photos, and, if they connect online payments, their Netcash service key (stored encrypted).
Signing in with Google, Facebook or LinkedIn: your email address and an account identifier from that provider, nothing else.
Contact and feedback forms: what you send us.
Technical: server logs (such as IP addresses and pages requested) to keep the service secure and working.

How we use it

To make, confirm, change and cancel bookings; to email you about them (confirmations, cancelled sessions, places offered from a waiting list) and to ask you once for a review afterwards, unless you've unsubscribed from the business's emails; to let the business see and manage its bookings; to answer messages; and to keep xBooking secure. If you run a business here, we also send you occasional newsletters about xBooking, with a link in each to unsubscribe. We don't sell personal information or use it for advertising.

Who we share it with

The business you book with, which sees your booking details.
Netcash, our payment provider, when you pay online. Card details go to Netcash only.
Service providers who host the service and send its emails for us, under agreements to protect it.
Authorities, only where the law requires it.

Free trials

When a business signs up for a free trial of the plus add-ons, we check that the same person hasn't already had one under another email address. We compare the owner's email address, cell number, the business's name, company and VAT numbers, and the browser and internet (IP) address the signup came from, with businesses that already had a trial or owe us money. We keep only scrambled copies (keyed hashes) of these for the check, never the details themselves in readable form. A match never closes an account: a person at N epoch looks at it and decides about the trial. Browser and IP copies are deleted after 90 days, and the rest 24 months after a business is deleted.

How long we keep it

Booking records are kept while the business uses xBooking and as long as the law requires for its records (for example, for tax). Reviews are kept while the business uses xBooking; if you ask the business to clear your data, your name comes off your reviews and their files are deleted, while what you wrote stays without your name. Waiting-list entries you leave, and feedback, are kept only as long as useful. A business that leaves can ask for its data to be deleted.

How we protect it

Connections are encrypted, passwords are hashed, payment keys are encrypted, and each business can only see its own bookings. If information is ever compromised, we'll tell those affected and the Information Regulator as POPIA requires.

Your rights

You can ask what we hold about you, and ask for it to be corrected or deleted. About a booking, ask the business; we'll help them. You can also complain to the Information Regulator (inforegulator.org.za).

Cookies

We only use the cookie needed to keep you signed in and forms safe. See our cookie policy.