This Privacy Policy explains how CS Bookings ("CS Bookings", "the Service") collects, uses, and protects personal data. CS Bookings is operated by Cicada Labs, a subdivision of Cicada Cybersecurity ("we", "us", "our"), based in Ireland. We are committed to protecting your privacy and handling personal data in line with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts.

By using the Service, you acknowledge the practices described in this Policy. This Policy should be read alongside our Terms and Conditions.

1. Who this policy applies to

This Policy applies to:

• Customers who buy or use CS Bookings for their business.
• Website visitors who browse csbookings.com or contact us.
• End Customers who make bookings through a Customer's booking site (see section 9 for how we handle their data).

2. Our role: controller and processor

For personal data about our own Customers and website visitors, we act as a data controller. For personal data that End Customers submit when booking through a Customer's site, we act as a data processor on behalf of that Customer, who is the data controller for their own bookings.

3. Personal data we collect

Depending on how you interact with us, we may collect:

• Account and billing data, such as your name, email address, business name, and payment confirmation details.
• Contact data, such as the information you send us through our support form or by email.
• Booking site content you provide, such as your services, prices, hours, and branding.
• Technical data, such as IP address, browser type, device information, and basic usage information needed to run and secure the Service.

We do not collect or store your customers' card details. Card payments are handled directly by our payment providers.

4. How we use personal data

We use personal data to:

• Set up, provide, maintain, and support the Service.
• Process payments for plans and add-ons.
• Respond to your enquiries and provide customer support.
• Keep the Service secure and prevent fraud or abuse.
• Comply with our legal and regulatory obligations.
• Improve and develop the Service.

5. Legal bases for processing

Under GDPR, we rely on the following legal bases: performance of a contract (to deliver the Service you purchase), legitimate interests (to run, secure, and improve the Service, provided your rights do not override those interests), legal obligation (for example, tax and accounting records), and consent where required (for example, certain cookies or optional communications). You may withdraw consent at any time.

6. Cookies and analytics

We use only the cookies and similar technologies needed to operate the site and, where applicable, to understand how it is used. Essential cookies keep the site working. Any non-essential or analytics cookies are used only where permitted, and you can control cookies through your browser settings.

7. Payment processing

Payments for the Service are processed by Stripe and PayPal. Deposits taken from your End Customers are processed through your own connected Stripe account and paid directly to you. These providers process payment data as independent controllers under their own privacy policies, and we do not receive or store full card details.

8. Sharing and sub-processors

We do not sell your personal data. We share it only with trusted third parties who help us run the Service, such as hosting providers, domain registrars, email delivery services, and payment providers. These sub-processors are only permitted to process personal data on our instructions and under appropriate safeguards. We may also disclose personal data where required by law or to protect our legal rights.

9. Personal data we process for Customers

When you use CS Bookings as a Customer, your End Customers submit personal data (such as their name, email, and booking details) through your booking site. We process this data only as a processor, on your instructions, to provide the Service. As the controller of that data, you are responsible for having a lawful basis for collecting it, providing appropriate privacy information to your End Customers, and handling their data protection rights.

10. International transfers

We aim to keep personal data within the European Economic Area (EEA) where possible. Where a provider processes data outside the EEA, we take steps to ensure appropriate safeguards are in place, such as adequacy decisions or Standard Contractual Clauses.

11. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy, including to provide the Service, meet legal and accounting obligations, and resolve disputes. When personal data is no longer needed, we securely delete or anonymise it.

12. Security

CS Bookings is built and maintained by Cicada Labs, a subdivision of Cicada Cybersecurity. We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No system can be guaranteed completely secure, but we work to keep the Service safe and to respond promptly to any security incident.

13. Your rights

Subject to applicable law, you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. To exercise these rights, contact us at privacy@csbookings.com. If your request concerns data we process on behalf of a Customer (as a processor), we will direct you to, or work with, the relevant Customer as controller.

14. Children's privacy

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children under the digital age of consent (16 in Ireland). This does not prevent a business run by someone under 18 from using the Service through a parent or guardian, as described in our Terms and Conditions. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps.

15. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, for example by posting the updated Policy on our website with a new "last updated" date. Continued use of the Service after changes take effect means you accept the updated Policy.

16. Contact us and complaints

If you have any questions about this Policy or how we handle personal data, contact us at privacy@csbookings.com. You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at dataprotection.ie.