Booka Privacy Policy

1. Introduction

This Privacy Policy explains how Booka SA (Pty) Ltd collects, uses, stores, shares, retains, and protects personal information when people use the Booka platform.

It covers platform use for listings, discovery, messaging, booking requests, quotes, bookings, payments, payouts, refunds, support, moderation, verification, calendar sync, and related services.

Unless expressly stated otherwise for a specific activity, Booka SA (Pty) Ltd is the responsible party for the personal information processed through the platform. We process personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA), and other applicable South African law.

This Policy applies to clients, service providers, account holders, invited representatives, support users, and visitors to the platform. If you provide personal information about another person through Booka, including a guest, recipient, team member, representative, or contact person, you confirm that you are authorised to do so and that the disclosure is lawful, relevant, and reasonably necessary for the booking or platform process.

2. Information We Collect

We may collect and process identity and contact information, service-provider information, booking and transaction information, communication content, verification and compliance information, device and technical information, information received from third parties, and any other information that a user voluntarily includes in a booking brief, listing, chat, uploaded document, support request, or related platform workflow.

This may include names, surnames, email addresses, phone numbers, account credentials, profile details, business details, service descriptions, pricing, availability, payout details, billing details, tax or legal details, booking requests, quote details, payment status, refund status, payout status, messages, attachments, uploaded files, photos, videos, voice notes, moderation records, dispute records, identity-document information, bank-proof information, IP address, browser data, device data, session data, timestamps, local-storage data, usage logs, and approximate location indicators derived from technical signals.

We may receive information from payment providers, payout providers, social-login providers, communication providers, hosting providers, analytics providers, verification or compliance providers, fraud-prevention providers, calendar providers where a user chooses to connect a calendar, and lawful public or regulatory sources where relevant.

Users should not upload or send personal information that is excessive, irrelevant, or not reasonably required for the relevant platform purpose.

3. Camera, Photos, Voice Notes, and Uploaded Content

Booka may request access to a device's camera, photo library, microphone, files, or similar media features only after a direct user action, such as choosing to upload a profile image, listing media, chat attachment, voice note, or similar content.

We do not intentionally access the camera or microphone in the background through ordinary platform use.

Uploaded media, attachments, and voice notes may be visible to the parties involved in the relevant listing, booking, or communication flow, and may also be accessible to Booka personnel where reasonably necessary for support, moderation, fraud prevention, legal compliance, or dispute handling.

Users should not upload full payment card details through chat, support messages, or ordinary file uploads.

Users should avoid including unnecessary sensitive personal information in attachments, chat messages, or briefs unless its inclusion is lawful and reasonably necessary for the service or booking.

4. How We Use Personal Information

We may use personal information to create, verify, manage, secure, and maintain accounts, profiles, and platform access; operate listings, discovery, messaging, quote workflows, booking workflows, booking administration, and booking records; process or administer payments, refunds, payouts, reconciliation, finance operations, and related transaction workflows; support provider verification, payout onboarding, trust-and-safety checks, fraud prevention, moderation, compliance review, and risk management; enable communication between clients, service providers, their authorised representatives, and Booka support personnel; provide support, investigate incidents, review disputes, handle complaints, and maintain operational records; operate optional integrations or connected services chosen by the user; improve platform security, performance, reliability, and service quality; comply with legal obligations; and send service, transactional, legal, security, support, and lawful marketing communications.

5. Lawful Grounds for Processing

Booka processes personal information on one or more lawful grounds recognised under applicable law, including where processing is necessary to conclude or perform a contract or booking-related transaction, comply with a legal obligation, carry out a processing activity for which consent has been given, pursue legitimate interests not overridden by the rights or interests of the data subject, or establish, exercise, or defend a right or legal claim.

Not all processing depends on consent. Where consent is the lawful ground relied on, withdrawal of consent may affect the availability of certain features or services.

6. Collection Source, Mandatory vs Voluntary Information, and Consequences

Booka generally collects personal information directly from the data subject where reasonably practicable. Booka may also collect information from other users involved in the booking, payment or payout providers, verification providers, connected integrations, lawful public sources, and other third parties where collection is lawful and reasonably necessary.

Some personal information requested by Booka is mandatory for a particular purpose, and some is voluntary.

Mandatory information may include account registration information, contact details necessary to administer a booking or account, payment or payout information necessary to process a transaction, provider verification or banking information necessary to onboard or maintain certain provider or payout features, information reasonably required to investigate fraud, abuse, security incidents, disputes, or legal complaints, and information required by law, regulation, or a payment, tax, audit, or compliance process.

Voluntary information may include optional profile fields, optional portfolio or promotional media, optional preferences or marketing choices, optional calendar connections or enhanced integrations, and optional information included in a brief, message, or support request beyond what is strictly required.

If a data subject does not provide personal information that is mandatory for a specific process, Booka may be unable to create or maintain the account, conclude or administer the booking, process payment or payout, complete provider verification, enable a requested feature, or resolve a support, dispute, fraud, or compliance matter.

7. Sharing and Disclosure of Personal Information

Booka may share personal information where reasonably necessary with clients and service providers involved in the relevant booking, quote, listing, or support process; authorised representatives, invited team members, or linked provider-management users associated with the relevant provider account; payment providers, payout providers, hosting providers, storage providers, communication providers, email providers, SMS or WhatsApp providers, analytics providers, calendar or integration providers, fraud-prevention providers, verification providers, compliance providers, and support-service providers; professional advisers, auditors, insurers, and other service providers acting for legitimate business, legal, audit, or compliance purposes; regulators, law-enforcement authorities, courts, tax authorities, or other persons where disclosure is required or permitted by law; and any other person where the data subject directs or authorises the disclosure, or where disclosure is otherwise lawful.

Where a third-party operator processes personal information on Booka's behalf, Booka seeks to ensure that the operator does so under appropriate contractual, confidentiality, and security obligations consistent with applicable law.

Users who receive personal information through Booka must use that information only for lawful purposes connected to the relevant booking, support, compliance, communication, or dispute process, and not for unrelated marketing, harassment, resale, or misuse.

8. International Transfers

Some operators, systems, or service providers used by Booka may process personal information outside South Africa.

Where cross-border processing occurs, Booka takes reasonable steps to ensure that the transfer is lawful and that appropriate contractual, technical, organisational, or other recognised safeguards are in place, having regard to POPIA, the nature of the information, the purpose of the transfer, and the role of the relevant service provider.

9. Security Safeguards

Booka implements reasonable technical and organisational measures designed to protect the integrity, confidentiality, and availability of personal information.

These measures may include access controls and role-based permissions, secure hosting environments, encryption or protected transmission where reasonably appropriate, audit logging, monitoring, fraud-detection measures, internal process controls, limited personnel access, and contractual safeguards with operators and service providers.

No system, communication channel, or storage environment can be guaranteed to be completely secure. Booka does not warrant absolute security, but takes reasonable steps appropriate to the nature of the information and the risks involved.

If Booka has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Booka will take the steps required by applicable law, including notification where legally required.

10. Retention and Deletion

Booka retains personal information only for as long as needed for the purposes for which it was collected or processed, including to provide the platform, maintain records, comply with legal obligations, prevent fraud, manage financial reporting, handle support, administer payouts and refunds, and resolve disputes.

Booking and transaction records may be retained for at least 5 years after the relevant booking is completed, cancelled, refunded, reversed, or otherwise closed, and longer where required by law or reasonably needed for tax, accounting, audit, fraud-prevention, enforcement, or evidentiary purposes.

Communication records, support records, moderation records, and dispute records may be retained while relevant to the account, booking, support process, legal obligation, or enforcement need.

Provider verification, payout, banking, and compliance records may be retained while the relevant account or capability remains active and thereafter for as long as needed or legally required.

Media and uploaded files may be retained while they remain relevant to the account, listing, booking, support, legal, or dispute process.

Requests for deletion, destruction, or de-identification are considered subject to legal retention duties, security needs, evidentiary needs, fraud-prevention needs, and operational record requirements.

11. Your POPIA Rights

Subject to applicable law and proper verification of identity and authority, a data subject may have the right to request confirmation of whether Booka holds personal information about that person, access to personal information held by Booka, correction or updating of inaccurate information, deletion, destruction, or de-identification where Booka is no longer authorised to retain the information, objection to certain processing, objection to direct marketing by unsolicited electronic communications, withdrawal of consent where processing depends on consent, and information about the source of the personal information where collection was not directly from the data subject.

Booka may require reasonable proof of identity, authority, and sufficient detail to locate the relevant records before acting on a request.

12. Direct Marketing

Booka may send users service, operational, support, security, legal, and transaction-related communications where necessary for the platform or booking process. These messages are not the same as optional marketing communications.

Booka may send direct marketing communications only where lawful. Users may opt out of non-essential marketing communications at any time, but Booka may still send communications necessary to administer the account, booking, payment, support case, security issue, or legal relationship.

13. Cookies, Local Storage, and Similar Technologies

Booka may use cookies, local storage, device tokens, and similar technologies for authentication, session continuity, security, fraud prevention, preferences, performance, analytics, and user experience.

Users may manage some of these technologies through browser or device settings, but disabling them may affect platform functionality, account access, message continuity, checkout, or other core features.

14. Children and Third-Party Information

Booka is not intended for independent use by persons under 18 years old. Booka does not knowingly seek to create independent under-18 user accounts for ordinary platform use.

Where a user includes information about a child or another third party in a booking brief, recipient field, event description, support request, or similar workflow, that user is responsible for ensuring that the disclosure is lawful, authorised, relevant, and limited to what is reasonably necessary for the relevant purpose.

15. Complaints and Contact

Questions, requests, or complaints about privacy or personal-information handling may be directed to Booka using the contact details published on the platform, including accounts@booka.co.za and +27 64 081 2341.

A data subject also has the right to lodge a complaint with the Information Regulator of South Africa if they believe their personal information has been processed unlawfully or their rights have been infringed. More information is available at https://www.justice.gov.za/inforeg/.

16. Changes to This Policy

Booka may update this Privacy Policy from time to time. Any updated version applies prospectively from its published effective date unless the law requires another approach. The latest version will be published on the platform.

17. Currency

All pricing, payments, payouts, and refunds are processed and displayed in South African Rand (ZAR / R) unless Booka expressly states otherwise in writing.

Last updated: 22 March 2026