1Scope and controller

This policy applies to the Bookasion website, its pages, dashboards, forms and connected services. It covers visitors, clients, service providers and their representatives.

The operator of Bookasion is responsible for the personal data processing described in this policy, unless a separate service provider is identified as processing data for its own purposes.

2Data we collect

Depending on how you use the platform, we may collect the following categories:

• Account and identity data: name, Gulf mobile number, email address, role, profile image, account status and encrypted login credentials.
• Provider data: business name, category, Emirate, years of experience, biography, images, services, prices, availability, approval status and rejection reasons where applicable.
• Booking and event data: requested service, date, Emirate, venue, guest count, notes, offer value, booking and payment status, and related communications.
• Payment data: amount, currency, payment status, payment method and reference. When an external payment gateway is used, we generally do not store full card details.
• Content and communications: contact messages, enquiries, ratings, reviews, complaints, images and other content submitted to the platform.
• Technical and usage data: IP address, device and browser type, requested pages, login times, login attempts, error logs, language preference and essential cookies.

3Sources of data

We receive data directly from you when you register, update a profile, submit a booking or send a message. Some data is generated automatically through site use, and we may receive data from payment, hosting or analytics providers, or from another provider or party involved in a booking.

4How we use data

• Creating, verifying and managing accounts and providing secure login functionality.
• Displaying services and professional profiles and operating search, filters and favorites.
• Creating booking requests, checking availability, and managing acceptance, rejection, cancellation and payment.
• Enabling client-provider communication and sending operational notifications.
• Reviewing providers and services and preventing fraud, misuse and conflicting bookings.
• Responding to support requests and complaints, resolving disputes and protecting legal rights.
• Measuring performance and improving user experience, content and security, using aggregated or limited data where possible.
• Sending marketing communications where consent or another appropriate legal basis exists, with an unsubscribe option.

5Bases for processing

We process data where necessary to perform our agreement with you or take requested steps, comply with legal obligations, protect legitimate interests and rights such as platform security and fraud prevention, or based on consent where consent is required. You may withdraw consent prospectively without affecting prior lawful processing.

6Data sharing

We may share the minimum necessary data with:

• Clients and providers: to assess a request, perform a booking and communicate about an event.
• Technology providers: such as hosting, email and messaging, storage, security, support and analytics.
• Payment providers: to process and verify payments and combat payment fraud when electronic payments are enabled.
• Advisers and authorities: where disclosure is legally required or necessary for an investigation, claim, or protection of users and the platform.
• Corporate transaction parties: in a restructuring, merger or sale, subject to confidentiality and continued appropriate protection.

We do not permit service providers to use data obtained through the platform for purposes unrelated to the booking or authorized relationship.

7International data transfers

Some hosting, support or communications systems may be located outside the United Arab Emirates. When data is transferred across borders, we seek to use trusted providers and appropriate contractual and technical safeguards under applicable legal requirements.

8Data retention

We retain data only as long as necessary to operate accounts and bookings, meet accounting and legal obligations, handle complaints and disputes, and protect the platform from fraud. The period varies by record type, account status and legal requirements. When no longer needed, data is deleted, anonymized or securely isolated unless longer retention is required.

9Cookies and similar technologies

The platform uses essential cookies to operate sessions, protect requests, remember language and provide remembered login. Additional analytics or performance cookies may be used if enabled. You can control cookies through your browser, but disabling essential cookies may prevent some functions.

Public service pages do not display direct provider contact details such as phone numbers, email addresses, or social-media accounts. Booking-related communication is kept within the platform to protect both parties and preserve the transaction record.

10Information security

We apply appropriate administrative and technical measures, including password hashing, secure sessions, request-forgery protection, input and upload validation, login-attempt controls, role-based permissions, security logs and appropriate backups. No electronic method is absolutely secure, so you must protect your password and device and promptly report unauthorized use.

11Your rights and choices

Subject to applicable law, you may be entitled to request:

• information about the types of your data, processing purposes and sharing recipients.
• access to your data or a structured copy of it.
• correction of inaccurate data or completion of incomplete data.
• deletion, restriction of processing or objection where applicable.
• data portability where technically feasible and legally provided.
• withdrawal of consent and stopping marketing communications.
• objecting to a materially affecting automated decision and requesting human review where the right applies.

We may verify your identity before acting on a request, and may refuse or limit a request where it affects others’ rights, conflicts with a legal obligation or is needed to preserve a legitimate claim. You can also update some data directly through your dashboard.

12Children’s privacy

The platform is intended for persons legally able to create an account and enter a booking. We do not knowingly collect data from a child who lacks the necessary capacity. If you believe a child submitted data without proper authorization, contact us so it can be deleted or handled according to law.

13Changes to this policy

We may update this policy when services, practices or legal requirements change. The revised version will be posted on this page with an updated date, and an additional notice may be provided for a material change.