Privacy Policy

This Privacy Policy describes how DAIT Consultancy Limited ("BookerBat", "we", "us", or "our"), a company registered in New Zealand, collects, uses, stores, and shares personal information in connection with the BookerBat platform at bookerbat.com.

This policy applies to Business Owners (BOs) who register for and use BookerBat, and separately addresses how we handle the personal data of End Customers (the clients of our BOs) that passes through our platform.

We are committed to complying with the New Zealand Privacy Act 2020, the EU General Data Protection Regulation (GDPR) where applicable, the Australian Privacy Act 1988, and the California Consumer Privacy Act (CCPA).

Data Controller (for Business Owners): When you register and use BookerBat as a Business Owner, DAIT Consultancy Limited is the data controller of your personal information. We determine the purposes and means of processing your account and business data.

Data Processor (for End Customers): When your End Customers make bookings through your BookerBat-powered booking page, you (the Business Owner) are the data controller of their personal information. DAIT Consultancy Limited acts as a data processor, processing that data on your instructions and solely for the purpose of providing the Service to you.

Business Owners are responsible for ensuring they have a lawful basis for collecting their End Customers' data and for providing appropriate privacy notices to those customers.

For users in the EU/EEA, we process personal data on the following legal bases:

• Contract (Article 6(1)(b)): Processing necessary to provide the Service under our Terms of Service — account management, billing, service delivery.
• Legitimate Interests (Article 6(1)(f)): Security monitoring, fraud prevention, product improvement, and analytics where our interests do not override your rights.
• Legal Obligation (Article 6(1)(c)): Compliance with applicable laws and regulatory requirements.
• Consent (Article 6(1)(a)): Marketing communications, non-essential cookies. You may withdraw consent at any time.

Under the NZ Privacy Act 2020, we collect personal information only where it is reasonably necessary for our business functions and we have a lawful purpose for doing so.

We do not sell your personal information. We may share your information in the following circumstances:

We retain your personal information for as long as your account is active or as necessary to provide the Service. Specifically:

• Account and business data: retained for the duration of your account plus 30 days after termination.
• Booking and transaction records: retained for 7 years for accounting and tax compliance purposes.
• Support communications: retained for 3 years.
• Log and usage data: retained for up to 12 months.
• Billing records: retained as required by NZ financial and tax regulations.

After applicable retention periods, data is securely deleted or anonymised. You may request early deletion of your data subject to any overriding legal obligations (see Section 9).

BookerBat is hosted and operated primarily through services based in the United States. If you are located in the EU/EEA, New Zealand, or another jurisdiction with data transfer restrictions, please note that your personal information will be transferred to and processed in countries that may not provide the same level of data protection as your home jurisdiction.

For transfers from the EU/EEA, we rely on the following safeguards:

• EU Standard Contractual Clauses (SCCs) with our sub-processors.
• Our sub-processors' participation in approved data transfer frameworks where applicable.

For transfers from New Zealand, such transfers are made in accordance with Principle 12 of the NZ Privacy Act 2020, which permits transfers where we take reasonable steps to ensure the recipient protects the information in a comparable way.

Depending on your location, you may have the following rights regarding your personal information. To exercise any of these rights, please contact us at support@bookerbat.com.

• Right of Access: Request a copy of the personal information we hold about you.
• Right of Correction: Request correction of inaccurate or incomplete personal information.
• Right of Deletion: Request that we delete your personal information, subject to legal retention obligations.
• Right to Object: Object to our processing of your information based on legitimate interests or for direct marketing.
• Right to Restrict Processing: Request that we restrict processing of your information in certain circumstances.
• Right to Data Portability (GDPR): Receive your personal information in a structured, machine-readable format.
• Right to Withdraw Consent: Withdraw consent where processing is based on consent, without affecting prior processing.

We will respond to your request within 20 working days (as required by the NZ Privacy Act 2020) or within 30 days (as required by GDPR). We may need to verify your identity before processing your request.

If you are dissatisfied with our response, you have the right to lodge a complaint with the Office of the New Zealand Privacy Commissioner at privacy.org.nz or, for EU residents, your local data protection authority.

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/HTTPS.
• Encryption of sensitive data at rest within our database infrastructure.
• Access controls limiting personnel access to personal data on a need-to-know basis.
• Regular security assessments and monitoring.
• Use of industry-standard authentication practices.
• Payment card data is processed directly by Stripe under PCI-DSS compliance — we never store card numbers.

Despite our efforts, no security system is impenetrable. In the event of a data breach that is likely to cause serious harm, we will notify affected individuals and the Privacy Commissioner as required by the NZ Privacy Act 2020 and GDPR, and will take immediate remedial action.

BookerBat uses the following types of cookies and similar technologies:

• Strictly necessary cookies: Required for the Service to function (e.g. authentication session tokens). These cannot be disabled.
• Functional cookies: Remember your preferences (e.g. language, timezone settings).
• Analytics cookies: Help us understand how the Service is used (e.g. pages visited, features used). These are anonymised and aggregated.
• Performance cookies: Used to monitor platform performance and identify technical issues.

We do not use third-party advertising cookies or track your activity across other websites for advertising purposes.

You can control non-essential cookies through your browser settings. Disabling cookies may affect the functionality of the Service.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child under 18 has provided us with personal information, please contact us at support@bookerbat.com and we will take steps to delete such information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will notify you of material changes by email to your registered address and/or by displaying a prominent notice on the Service at least 14 days before the change takes effect.

Your continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

If you are located in the European Union or European Economic Area, the following additional provisions apply:

• Our representative for GDPR purposes is DAIT Consultancy Limited, reachable at support@bookerbat.com.
• Where we rely on legitimate interests as a legal basis, you may object at any time and we will cease processing unless we demonstrate compelling legitimate grounds.
• You have the right to lodge a complaint with your local supervisory authority (e.g. your national data protection authority).
• We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.
• Where we appoint sub-processors, we ensure appropriate data processing agreements and safeguards are in place.

If you are a California resident, under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), you have the following additional rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioural advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond providing the Service.

To exercise your California rights, contact us at support@bookerbat.com. We will verify your identity before processing your request and respond within 45 days.

This policy is designed to comply with all 13 Information Privacy Principles (IPPs) under the New Zealand Privacy Act 2020. Key principles we adhere to include:

• IPP 1 (Purpose of collection): We collect only the personal information necessary for our stated purposes.
• IPP 2 (Source): Where practicable, we collect personal information directly from the individual.
• IPP 3 (Collection of information from individual): We inform individuals of the purpose of collection at the time of collection.
• IPP 5 (Storage and security): We protect personal information with appropriate safeguards.
• IPP 6 (Access to personal information): Individuals may request access to their personal information.
• IPP 7 (Correction of personal information): Individuals may request correction of their personal information.
• IPP 8 (Accuracy): We take reasonable steps to ensure personal information is accurate and up-to-date.
• IPP 11 (Limits on disclosure): We only disclose personal information in accordance with this policy.
• IPP 12 (Unique identifiers): We do not assign unique identifiers unless necessary.

For any privacy-related questions, requests, or concerns, please contact our Privacy Officer:

Email: support@bookerbat.com

We aim to respond within 20 working days.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of New Zealand: