Who is responsible for your information?
Plainbooking is operated by NUVIX STUDIO LIMITED, a company registered in England and Wales (number 16287603), with its registered office at 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE. Contact support@plainbooking.com about this notice or your data.
We are the controller of information used to run Plainbooking accounts, answer support enquiries and protect the service. When you book with a venue, that venue normally decides why and how your booking information is used. It is the controller, and Plainbooking processes the information on its behalf.
This notice covers plainbooking.com and our booking application. The venue’s booking page explains its own use of your details. Contact the venue first to change a visit or ask about its records; we can help direct a data request.
What we collect
- Accounts and teams: your name, email, venue details, team membership, account settings, password hash and sign-in security information. Passwords are not stored as plain text.
- Bookings: the organiser’s contact details, date, time, group size, organisation and answers to the venue’s booking questions. These can include age ranges, transport arrangements, accessibility needs and notes.
- Venue records: bookings entered by staff or imported from a diary, private staff notes, assignments and a record of changes.
- Support: messages and attachments you choose to send us. Our website contact composer opens your email app; it does not send a message until you send it.
- Technical and delivery information: IP address, browser and request information, sign-in and security events, and email delivery status. These help us run the service, investigate faults and prevent misuse.
We receive details from you, from your venue or organiser, and from the providers listed on our service providers page. You do not need a Plainbooking account to request a booking.
Why we use it
- Provide your account and agreed service: create accounts, authenticate users, manage teams and support the venue. Our basis is performance of a contract where you are the contracting person; for staff at a customer organisation, it is our legitimate interest in providing that organisation’s service.
- Operate bookings for venues: receive requests, keep the diary and send booking messages, following the venue’s instructions. The venue is responsible for explaining its lawful basis.
- Answer enquiries and resolve problems: our legitimate interests in responding to people who contact us and keeping the service useful and reliable.
- Security and service monitoring: our legitimate interests in preventing fraud, abuse, unauthorised access and data loss. Operational counts help us understand whether the service is working.
- Meet legal duties: retain records or disclose information where the law requires it, including responding to valid legal requests.
We do not sell personal information or use booking details for advertising. Booking and account emails are service messages. We do not currently operate an optional marketing-cookie or advertising programme.
Automatic confirmation, where a venue enables it, follows that venue’s availability and booking rules. We do not use AI to decide booking requests or make decisions with legal or similarly significant effects on people.
Accessibility and children’s information
Only share what the venue needs to organise the visit. Use practical descriptions of an adjustment rather than medical histories. Do not enter payment-card details, identity documents or individual children’s names in booking notes.
Accessibility information can reveal health information. The venue must identify an appropriate lawful basis and, where required, a separate condition for handling special-category information. The booking acknowledgement is not a blanket consent to every use of sensitive data.
Plainbooking accounts are intended for adult venue staff and organisers. School visits should use an adult organiser’s contact details and group-level information.
How long we keep information
We use the following criteria rather than keeping everything indefinitely. Account closure and venue deletion requests are currently handled through support, not an automatic deletion button.
- Accounts and venue records: while needed to provide the service, manage team access and fulfil the venue’s documented instructions. After closure, we arrange export and deletion with the authorised owner, subject to outstanding visits, disputes or legal duties.
- Booking details and private notes: for the venue’s booking administration and agreed record-keeping purposes. The venue should review completed visits and remove unnecessary sensitive details. Contact us to arrange deletion where the interface does not offer it.
- Support and email records: while needed to resolve the enquiry, investigate delivery, maintain necessary correspondence or handle an ongoing dispute. Retention is reviewed when the matter or account closes.
- Application security events: the routine retention window is 180 days. Relevant evidence may be retained longer for an active incident or legal claim.
- Recovery copies: encrypted backups are kept separately for recovery. Deletion from the active service does not immediately remove every backup copy. We account for retained recovery copies when handling deletion requests and reapply necessary deletions if a backup is restored.
Ask us or your venue for the retention arrangements applying to a particular record. A trial ending stops new booking intake; it does not automatically erase existing bookings.
Your choices and rights
Depending on the circumstances, you can ask for access, correction, deletion, restriction or portability of your information, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.
Email support@plainbooking.com. We may need proportionate information to verify your identity. We normally respond within one month; if a lawful extension is needed, we will explain it. Requests concerning a venue’s booking records are handled with that venue.
You can complain to the Information Commissioner’s Office (ICO). You do not have to contact us first.
Account contact details are needed to create and secure an account. The booking form marks required information needed by the venue to handle a request. If you do not provide it, the online request cannot be completed. Optional fields can be left blank.
Cookies and updates
See our cookies and local storage notice for sign-in and security technology. We will update this notice when the service or our practices change, and draw attention to material changes where appropriate.