Privacy Policy

Last updated: 7 April 2026

1. Who We Are

Bookstead is operated by Catalin Iftimie trading as Bookstead. For the purposes of UK data protection law, Bookstead is the controller of the personal data described in this Privacy Policy.

Contact details:
Catalin Iftimie trading as Bookstead
3 Chester Street, London, SW1X 7BB
Email: iftimiecatalin@gmail.com

2. Scope of This Policy

This Privacy Policy explains how Bookstead collects, uses, stores, shares, and protects personal data when you use the Bookstead website, create an account, use the Bookstead application, or interact with Bookstead client portal features.

3. Personal Data We Collect

Depending on how you use Bookstead, we may collect and process the following categories of personal data:

• account details such as your name, email address, login credentials, and profile settings;
• business details such as your trading name, contact details, timezone, currency, and preferences;
• client and contact data you enter, including names, email addresses, phone numbers, and notes;
• booking and enquiry data, including event dates, venues, contract status, payment tracking, and related operational notes;
• timeline and music preference data submitted through the platform or client portal;
• portal access data, including token-based access to booking-related pages;
• Google Calendar integration data if you choose to connect your Google account;
• technical and usage data such as browser information, log data, page interactions, and limited analytics data where enabled in production.

4. How We Collect Personal Data

We collect personal data:

• directly from you when you create an account, edit settings, connect integrations, or use Bookstead features;
• from your clients or contacts when they use portal pages you provide to them;
• from integrated services such as Google where you authorise a connection;
• automatically through standard website and application logs, cookies, and analytics tools where enabled.

5. How We Use Personal Data

We use personal data to:

• provide, operate, and maintain Bookstead;
• authenticate users and protect account security;
• store and display your business, client, booking, contract, and music-planning data;
• enable client portal access and related workflows;
• support Google Calendar integration where connected;
• monitor performance, security, and service reliability;
• communicate service-related information, account notices, and legal updates;
• comply with legal obligations and enforce the Bookstead terms.

6. Lawful Bases for Processing

Under the UK GDPR, Bookstead relies on one or more of the following lawful bases:

• performance of a contract, where processing is necessary to provide Bookstead to you;
• legitimate interests, including operating, improving, and securing the service, provided those interests are not overridden by your rights;
• legal obligation, where processing is necessary to comply with applicable law;
• consent, where you choose to connect optional integrations or where consent is otherwise required.

7. Sharing Personal Data

We may share personal data with service providers that help operate Bookstead, including:

• Supabase for database, authentication, and backend infrastructure;
• Vercel for hosting and deployment;
• Google and related Google APIs where you connect Google Calendar;
• Vercel Analytics, where analytics is enabled in production.

We do not sell personal data. We may also disclose personal data where required by law, regulation, court order, or to protect rights, safety, and the integrity of the service.

8. International Transfers

Some suppliers used to operate Bookstead may process personal data outside the United Kingdom. Where that happens, we take reasonable steps to ensure appropriate safeguards are in place, such as relying on adequacy regulations or suitable contractual protections where required.

9. Data Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the service, maintain backups, resolve disputes, enforce agreements, and comply with legal obligations. Retention periods may vary depending on the type of data and whether an account remains active.

10. Security

Bookstead uses technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures include authenticated access controls, infrastructure security controls, and database protections. No system can be guaranteed to be completely secure, but we aim to use reasonable and proportionate safeguards.

11. Your Rights

Under the UK GDPR, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain processing based on legitimate interests;
• request portability of data where applicable;
• withdraw consent where processing is based on consent.

To exercise your rights, contact iftimiecatalin@gmail.com. We may need to verify your identity before responding.

12. Complaints

If you are unhappy with how personal data is handled, you can contact us first at iftimiecatalin@gmail.com. You also have the right to complain to the Information Commissioner's Office (ICO) in the United Kingdom. Further information is available at ico.org.uk.

13. Cookies and Similar Technologies

Bookstead may use cookies and similar technologies that are necessary for authentication, session handling, and basic application functionality. Where analytics tools are enabled, similar technologies may also be used to understand service usage and performance. This Privacy Policy covers those uses for now.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in Bookstead, legal requirements, or operational practices. The updated version will be posted on this page with a revised last-updated date.