Privacy Policy

Codesignx Limited ("MakesBooking", "we", "us", "our") operates the MakesBooking booking platform. This Privacy Policy (the "Policy") explains what personal data we collect, how we use it, where it is kept, and the choices you have. It covers the MakesBooking website, the merchant dashboard, and the booking pages we host for merchants (together, the "Services").

Personal data reaches us in two different ways, and our responsibilities are not the same in each.

• As a data user. When you visit our website, create a MakesBooking account, or contact us, we decide how that data is used, and this Policy governs it.
• As a data processor. When a business uses MakesBooking to take bookings, that business decides what to collect from its own customers and why. We hold and process those records on its instructions, under our agreement with it.

If you booked with a business through MakesBooking, that business's own privacy notice governs your booking record. Send requests about it to that business first; we will help it respond.

When you use the Services, create an account, contact us, or make a booking, we may collect:

• Account and contact details: name, email address, phone number, business name, and billing details.
• Business configuration: the services offered, prices, availability, staff, and similar settings.
• Booking records: the details of a booking, together with the name and contact details of the person it is for.
• Anything else you choose to send us.

We collect automatically: account activity, usage data, and basic access information (browser, IP address, device data, cookies and similar technologies).

Payments are processed by Stripe. Card numbers are entered on, and held by, Stripe — we never receive or store them. We keep a payment reference, the amount and status, and, where a card is kept on file for a later charge, the token Stripe gives us in place of the card.

We use Cloudflare Turnstile to distinguish people from automated traffic on sign-up and booking forms. It processes your IP address and basic request data for that purpose only.

We may also receive information from third parties such as payment processors, and combine it with what we already hold.

Any product suggestions or other unsolicited information you send us will be treated as non-confidential, and we may use it freely.

• To operate, provide, secure and improve the Services;
• To process bookings, payments, notifications and customer management;
• To send service updates and technical support, and — where you have not opted out — occasional product news;
• To respond to enquiries and provide customer service;
• To analyse usage trends and produce reports.

We use cookies and similar technologies for three purposes: to keep you signed in and protect the forms you submit; to measure how our website and dashboard are used; and, on a merchant's booking page, for whatever measurement or advertising tags that merchant has chosen to enable.

The first kind is strictly necessary — without it the Services cannot function — and is not optional.

On booking pages we host for merchants, non-essential tags stay off until the visitor agrees, and that choice can be changed at any time from the same banner.

On the MakesBooking website and the merchant dashboard, measurement cookies (Google Analytics 4) are set when you arrive. You can block or delete them in your browser settings without losing access to the Services. We do not respond to Do Not Track signals.

We do not sell personal data. We share it only in the following circumstances:

• With the service providers that run parts of the platform for us. Today these are: Alibaba Cloud (application hosting and the primary database); Cloudflare (content delivery, DNS, bot protection, and hosting for our website and dashboard); Stripe (payment processing); and Google (Google Analytics, and — where a merchant enables it — advertising measurement on that merchant's booking page).
• With the merchant you booked with, where you are that merchant's customer.
• In connection with a business transfer such as a merger or sale.
• With your consent.
• Where the law requires it, or to establish, exercise or defend a legal claim, or to protect the rights or safety of any person.

This list changes as the platform does; the current list is the one stated here. Where a change affects a merchant's own customers' data, we tell that merchant before it takes effect.

Account data and booking records are held in Hong Kong, in a managed PostgreSQL database operated by Alibaba Cloud in its Hong Kong region, and are served by application instances in the same region.

Some providers necessarily operate across borders: Cloudflare serves pages from the edge location nearest the visitor, Stripe processes payments on its own global infrastructure, and Google processes analytics data outside Hong Kong. Using the Services therefore involves some personal data being transferred outside Hong Kong.

We keep personal data while the account it belongs to is open, and after that only for as long as we need it:

• Account and booking data: for the life of the account, then deleted or anonymised within 90 days of the account closing, unless we are required to keep it longer.
• Payment and invoicing records: seven years, to meet Hong Kong tax and accounting requirements.
• Server and access logs: twelve months.

Deleted data can persist in encrypted backups until those backups are rotated out in the ordinary course. It is not restored to the live system.

We take reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encryption in transit, access controls, and keeping each merchant's data separated from every other merchant's.

No system is completely secure, and we cannot guarantee absolute security.

If a breach of personal data occurs that is likely to cause real harm, we will investigate, take steps to contain it, and notify the affected users and, where appropriate, the Privacy Commissioner for Personal Data, without undue delay.

You may ask us to access, correct, delete or anonymise your personal data, to stop using it for promotional messages, or to close your account.

Send the request to [email protected]. We will respond within 40 days — the period the PDPO allows for a data access request — and usually much sooner.

There is deliberately no self-service delete. Closing an account and erasing its data is done by us on request, so that we can confirm who is asking and what the deletion would remove — for a shared workspace, that is other people's booking history as well as your own.

If you booked with a business through MakesBooking, ask that business first — it decides what happens to its own customer records, and we will help it act on your request. You can block or delete cookies through your browser at any time.

The Services are not directed at children under 13 and we do not knowingly collect their personal data from them directly. A merchant may record a booking made for a child — a class booked by a parent, for example — in which case that merchant is responsible for having the right to give us that information. If you believe we hold a child's data without a proper basis, contact us and we will remove it.

We are based in Hong Kong and operate the Services from Hong Kong. Personal data about individuals in Hong Kong is protected by the Personal Data (Privacy) Ordinance (Cap. 486). If you are outside Hong Kong, other rules may give you further rights; where they apply to us we will honour them, and requests go to the same address.

We update this Policy as the Services change; the date at the top is the last change. Where a change materially affects how we use data you have already given us, we will tell account holders by email before it takes effect.

This document is published in English, Traditional Chinese and Simplified Chinese. If there is any inconsistency or ambiguity between the versions, the English version prevails.

Codesignx Limited, Hong Kong — [email protected]. If you are exercising one of the rights above, please put “Data request” in the subject line.