Privacy Policy

Last Updated: February 11, 2026

---

1. Introduction

Book Community Centre ("BCC", "BCC Platform") is a product of Sandron Infotec Limited ("we", "us", or "our"), a company registered in Ireland (Company No. 797329). We are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, share, and protect your personal information in connection with the BCC Platform.

The BCC Platform enables users to discover, book, and manage community centre facilities across Ireland. We process your data responsibly to facilitate community engagement while respecting your privacy rights under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

This Privacy Policy applies to all users of the BCC Platform, including visitors, registered users (such as members, community centre administrators, and staff), and anyone who interacts with our website at bookcommunitycentre.ie or related services (collectively, the "BCC Services").

The BCC Platform is not intended for users under the age of 16. We do not knowingly collect personal data from children under 16 (see Section 13 — Children's Privacy).

We do not collect special categories of personal data (e.g., health, racial or ethnic origin, religious beliefs) unless voluntarily provided by you (e.g., in booking notes or communications).

---

2. Data Controller

The data controller responsible for your personal data is:

Company Name: Sandron Infotec Limited Company Number: 797329 Registered Address: C4, Swords Enterprise Park, Feltrim Road, Swords, Co. Dublin, K67 HC44, Ireland Company Email: info@sandroninfotec.ie BCC Platform Email: info@bookcommunitycentre.ie

Sandron Infotec Limited does not currently have a dedicated Data Protection Officer (DPO). For any questions about this Privacy Policy, your personal data, or to exercise your data protection rights, please contact us at info@bookcommunitycentre.ie or info@sandroninfotec.ie.

---

3. Data We Collect

We collect and process personal data only as necessary to provide the BCC Services, ensure security, and comply with legal obligations. Personal data means any information that identifies you or could reasonably be used to identify you.

3.1 Account Data

• Full name
• Email address
• Phone number (optional)
• Password (managed securely by our authentication provider, Supabase; we do not store or have access to your plaintext password)
• Profile picture (optional)

3.2 Booking Data

• Booking history and reservation details
• Facility preferences
• Event details (date, time, duration, purpose)
• Special requirements or notes
• Booking status and cancellation records

3.3 Payment Data

• Payment method information (processed securely by Stripe)
• Billing address
• Transaction history and payment status
• Refund records
• Note: We do not store full credit card details. All payment card processing is handled by Stripe, a PCI DSS Level 1 compliant payment processor. For certain activities such as fraud prevention and regulatory compliance, Stripe may act as an independent controller, as described in Stripe's Privacy Policy.

3.4 Membership Data

• Community centre membership status and history
• Membership requests and approvals
• Centre assignment and role information (for staff and administrators)
• User preferences and communication settings

3.5 Centre Administration Data

If you are a community centre administrator or staff member, we may additionally collect:

• Centre details (name, address, description, contact information, operating hours)
• Facility details (name, description, capacity, pricing, amenities, images)
• Payout information (bank account or payment details for receiving booking payments, processed via Stripe Connect)
• Administrative activity logs (booking approvals, membership management actions, facility updates)
• Note: Payout and bank account details are processed and stored by Stripe. We do not store your full bank account details. See the Stripe disclosure in Section 7.1 for details.

3.6 Location Data

• Location information provided during facility search (latitude, longitude, search radius)
• Note: We only collect location data when you actively use our search feature. We do not continuously track your location.

3.7 Usage Data

• Page views and navigation patterns
• Device information (browser type, operating system)
• IP addresses (anonymised for analytics)
• Performance metrics
• Search queries and filter selections

3.8 Technical and Error Data

• Error logs and crash reports (via Sentry)
• Anonymised user context for debugging
• Technical information (browser version, device type)
• Note: Error data is anonymised and used exclusively for technical purposes.

3.9 Marketing and Communications Data

• Preferences for receiving newsletters, updates, or promotional content
• Email engagement data (opens, clicks) where consent has been given
• Subscription and unsubscribe history

We anonymise or pseudonymise data where possible to minimise privacy risks.

---

4. How We Collect Your Data

We collect data through:

• Direct interactions: When you register an account, make bookings, update your profile, contact support, subscribe to newsletters, or communicate with community centres.
• Automated technologies: Via cookies, analytics tools, and standard web server logging (e.g., IP address, browser type). You can manage cookie preferences via our Cookie Policy.
• Third-party services: From authentication providers (e.g., Google, if you choose to sign in via Google OAuth), payment processors (Stripe), and error monitoring services (Sentry). If you choose to sign in with Google, we receive only your name, email address, and profile picture from Google to authenticate you and create or link your BCC account. We do not access your emails, calendar, or other Google account content.
• Other users or centres: Community centre administrators may add information about you in the context of memberships or bookings.

If you fail to provide required data (e.g., email for account creation), we may not be able to provide certain services.

Third-Party Links

Our platform may include links to third-party websites, plug-ins, or applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy notice of every website you visit when you leave our platform.

---

5. How We Use Your Data

We use your personal data only for specified, legitimate purposes, based on one or more legal bases under GDPR and Irish law:

5.1 Service Provision (Contractual Necessity)

• Process and manage facility bookings and reservations
• Process payments securely via Stripe, including payouts to community centres via Stripe Connect
• Manage your account, memberships, and centre assignments
• Send transactional communications (booking confirmations, reminders, payment receipts, cancellation notices)
• Facilitate communication between users and community centres
• Enable centre administrators to manage their centres, facilities, bookings, and memberships

5.2 Platform Improvement (Legitimate Interest)

• Analyse usage patterns to improve platform features and user experience
• Monitor performance and identify technical issues
• Develop and test new features
• Conduct internal analytics and reporting

5.3 Marketing and Communications (Consent)

• Send newsletters, promotional content, or platform updates
• Notify you about new features, centres, or facilities
• Note: You can withdraw marketing consent at any time (see Section 9.7 — Right to Withdraw Consent)

5.4 Security and Fraud Prevention (Legitimate Interest)

• Detect and prevent fraudulent activity or misuse
• Protect the platform and users from security threats
• Monitor for suspicious account activity

5.5 Legal Compliance (Legal Obligation)

• Retain booking and payment records as required by Irish tax law
• Respond to lawful requests from authorities
• Comply with applicable laws and regulations

5.6 User Support (Contractual Necessity / Legitimate Interest)

• Respond to inquiries and provide customer support
• Assist with account recovery
• Resolve disputes between users and community centres

---

6. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal bases:

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

---

7. Sharing and Disclosure of Your Data

We do not sell your personal data. We share it only as necessary:

7.1 Third-Party Service Providers

We use the following third-party services that process your data on our behalf under strict data processing agreements:

Stripe

• Purpose: Payment processing, fraud detection, and financial regulatory compliance
• Data processed: Payment card information, billing address, transaction data, device identifiers, and IP addresses
• Privacy Policy: Stripe Privacy Policy
• Data Processing Agreement: We have a Data Processing Agreement (DPA) with Stripe governing the processing of personal data on our behalf.
• Sub-processors: Stripe may engage sub-processors to assist in providing its services. A list of Stripe's sub-processors is available on Stripe's website.
• Note: Stripe is PCI DSS Level 1 compliant. We never store full credit card numbers. Stripe may also process your data for its own purposes, including fraud prevention, financial risk mitigation, and regulatory compliance, as described in Stripe's Privacy Policy.

Supabase

• Purpose: Authentication and database hosting
• Data processed: User credentials (hashed), profile data, booking data
• Privacy Policy: Supabase Privacy Policy
• Data location: EU region

Cloudinary

• Purpose: Image storage and optimisation
• Data processed: Uploaded images (facility photos, centre images, user avatars)
• Privacy Policy: Cloudinary Privacy Policy

Sentry

• Purpose: Error monitoring and debugging
• Data processed: Error logs, anonymised user context, IP addresses
• Privacy Policy: Sentry Privacy Policy
• Note: Error data is anonymised and used only for technical debugging.

Vercel

• Purpose: Web hosting and analytics (with consent)
• Data processed: Page views, performance metrics, device information
• Privacy Policy: Vercel Privacy Policy
• Note: Analytics are only enabled if you consent to analytics cookies.

Google (OAuth)

• Purpose: Optional authentication provider
• Data processed: Email address, name, profile picture (only if you choose to sign in with Google)
• Privacy Policy: Google Privacy Policy
• Note: We use your Google account information solely to authenticate you, enable secure sign-in, and maintain your BCC account. We do not use Google OAuth data for advertising, profiling, or unrelated purposes.

7.2 Community Centres and Administrators

Data shared with centre administrators: When you make a booking or request a membership at a community centre, limited information (e.g., your name, email address, booking details) is made available to the centre's administrators and staff so they can manage your booking or membership. Centre administrators can only access data for users associated with their own centre.

Data provided by centre administrators: Centre administrators provide centre and facility information (names, descriptions, images, pricing, operating hours) that is displayed publicly on the platform. Administrators are responsible for ensuring they have the right to publish any content they upload.

Administrator responsibilities: Centre administrators and staff who access personal data of members and bookers through the platform must handle that data in accordance with applicable data protection law. We enforce role-based access controls to ensure administrators can only view data relevant to their centre and role.

7.3 Legal and Regulatory Bodies

We may disclose your data where required by Irish law, court order, or to comply with requests from the Irish Data Protection Commission or other regulatory authorities.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, with appropriate safeguards and notification.

---

8. Data Transfers

• Primary storage: Your data is stored in the EU (Supabase EU region).
• Payment processing: Stripe may process payment data outside the EU but maintains GDPR compliance through EU Standard Contractual Clauses (SCCs) and appropriate safeguards.
• Image storage: Cloudinary may store images on servers outside the EU. Transfers are protected by EU Standard Contractual Clauses (SCCs).
• Error monitoring: Sentry may process error data outside the EU under EU Standard Contractual Clauses (SCCs).
• Analytics: Vercel processes analytics data in compliance with GDPR, protected by appropriate transfer mechanisms.

We ensure all third-party processors have appropriate data protection agreements in place, including EU Standard Contractual Clauses where data is transferred outside the European Economic Area (EEA).

---

9. Your Data Protection Rights (GDPR)

Under GDPR and the Irish Data Protection Act 2018, you have the following rights:

9.1 Right to Access

You can request a copy of all personal data we hold about you.

9.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

9.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data, subject to our legal obligations (e.g., tax record retention).

9.4 Right to Restrict Processing

You can request that we limit how we process your data in certain circumstances.

9.5 Right to Data Portability

You can request your personal data in a structured, commonly used, machine-readable format.

9.6 Right to Object

You can object to processing based on legitimate interests or direct marketing at any time.

9.7 Right to Withdraw Consent

You can withdraw consent at any time. For analytics cookies, use our Cookie Preference Centre. For marketing emails, use the unsubscribe link in any email or contact us directly.

How to Exercise Your Rights

To exercise any of these rights, contact us at info@bookcommunitycentre.ie.

We will respond to your request within one month. In exceptional circumstances (e.g., complex or numerous requests), we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it within the initial one-month period.

No fee is usually required. However, we may charge a reasonable fee for manifestly unfounded or excessive requests, or we may refuse to act on such requests.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Right to Lodge a Complaint

If you are not satisfied with how we handle your data or your request, you have the right to lodge a complaint with the Irish Data Protection Commission:

Data Protection Commission 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland Website: www.dataprotection.ie Phone: +353 (0)1 765 0100 / 1800 437 737 Email: info@dataprotection.ie

---

10. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy, or as required by law:

After the applicable retention period, data is securely deleted or irreversibly anonymised.

For deletion requests, contact us at info@bookcommunitycentre.ie. Please note that we may need to retain certain data to comply with legal obligations even after you request deletion.

---

11. Data Security

We implement industry-standard technical and organisational measures to protect your data from unauthorised access, loss, alteration, or destruction:

• Encryption in transit: All data transmitted via HTTPS/TLS
• Encryption at rest: Database encryption for stored data (Supabase)
• Secure authentication: Supabase Auth with bcrypt password hashing and optional Google OAuth
• PCI DSS compliance: Payment processing via Stripe (PCI DSS Level 1)
• Access controls: Role-based access controls limiting personal data access on a need-to-know basis
• Real-time monitoring: Error and security monitoring via Sentry
• Regular assessments: Ongoing security monitoring and assessments

No system is 100% secure. We encourage you to use strong passwords and to report any security concerns to info@bookcommunitycentre.ie.

---

12. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms:

• We will notify the Irish Data Protection Commission within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• If the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as required by GDPR Article 34, providing details of the breach and recommended steps to protect yourself.
• We maintain an internal breach register documenting all personal data breaches, their effects, and remedial actions taken.

---

13. Children's Privacy

The BCC Platform and Services are not intended for users under the age of 16, and we do not knowingly collect personal information from users under 16. This is in accordance with the Irish Data Protection Act 2018, which sets Ireland's digital age of consent at 16 under GDPR Article 8.

If you are under the age of 16, you are not permitted to use the BCC Platform or to disclose personal information using the BCC Services. If we learn we have collected or received personal information from a child under 16, we will delete that information promptly.

If you believe we might have any information from or about a child under 16, please contact us immediately at info@bookcommunitycentre.ie.

Note: Children under 16 may attend events or use facilities at community centres, but account registration and bookings must be made by a parent, guardian, or an individual aged 16 or over.

---

14. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you, as defined under GDPR Article 22.

Search results on our platform are determined by relevance, distance, and user-applied filters. No automated profiling, scoring, or algorithmic decision-making is used to affect your access to services or facilities.

---

15. Cookies and Similar Technologies

We use cookies and similar technologies to enhance your experience. For detailed information about our cookie usage, categories, and how to manage your preferences, please see our Cookie Policy.

Cookie Categories:

• Strictly necessary cookies: Required for platform functionality (always active). These cannot be disabled.
• Analytics cookies: Used to understand platform usage and improve performance (requires your consent).
• Functional cookies: Store your preferences such as language or display settings (requires your consent).

You can manage your cookie preferences at any time via our Cookie Preference Centre.

---

16. Marketing Communications

Where you have given us consent, we may send you marketing communications about:

• New community centres and facilities on the platform
• Platform features and updates
• Promotions, events, or community news

Your choices:

• You can opt out of marketing communications at any time by using the unsubscribe link in any marketing email, or by contacting us at info@bookcommunitycentre.ie.
• Withdrawing marketing consent does not affect transactional communications (e.g., booking confirmations, payment receipts), which are necessary for service delivery.
• We will never share your email address with third parties for their marketing purposes.

---

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make changes:

• We will post the updated policy on this page and update the "Last Updated" date.
• For material changes that significantly affect how we process your personal data, we will notify you by email (if you have an account) and may require you to review and acknowledge the updated policy.
• Where changes require a new legal basis (e.g., new consent for a different type of processing), we will seek your explicit consent before processing your data under the new terms.

We encourage you to review this policy periodically.

---

18. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Ireland, including the General Data Protection Regulation (GDPR) as applied in Ireland and the Irish Data Protection Act 2018. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the Irish courts.

---

19. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have a complaint about how we handle your data, please contact us:

Email: info@bookcommunitycentre.ie Address: C4, Swords Enterprise Park, Feltrim Road, Swords, Co. Dublin, K67 HC44, Ireland

We aim to respond to all privacy inquiries within one month. If we need more time (up to an additional two months for complex requests), we will inform you within the initial one-month period.

If you are not satisfied with our response, you have the right to lodge a complaint with the Irish Data Protection Commission.

---

This Privacy Policy is effective as of February 11, 2026.

Book Community Centre is a product of Sandron Infotec Limited, a company registered in Ireland (Company No. 797329).