Privacy notice

Who is responsible

Olladay is operated by Donncha O Toole, trading as Olladay, at Bellevue House, Bellevue Demesne, Delgany, Co. Wicklow, Ireland. Contact hello@olladay.com for privacy questions or requests.

This notice covers olladay.com, the Olladay business console and booking services. Olladay decides how to use information for its own accounts, support, service security and administration. For those purposes, Olladay is the data controller.

The business you book with, called the venue in this notice, decides what it offers, which customer records it needs and how it uses those records. Olladay provides the software and handles those records to deliver the venue's requested service. The venue is responsible for its own privacy information, lawful use of customer records and any extra information it asks you to provide. Contact the venue about its activities, bookings or records. You can also contact Olladay for help identifying the venue or routing a privacy request.

Information we handle

• Enquiries and support. Your contact details, message and any attachments you send us.
• Business accounts. Your verified Google email address and Google account identifier, business details you enter, team invitations and permissions, settings, and records of changes. Google sign-in requests identity and email information. It does not request access to your Gmail messages or Google Drive files.
• Bookings and purchases. Names and email addresses, venue and session, attendance, tickets and extras, booking changes, cancellations, payment and refund references, amounts and status. Where used, records also include passes, memberships, voucher buyers and recipients, gift messages, balances, waitlists, discounts, group organisers and invoice details.
• Venue forms. If a venue uses health and safety terms, we record the version agreed, name, email, time and agreement. Individual guest signing can also record a typed or drawn signature, IP address and browser, an emergency contact, photo consent choices, and answers to the venue's yes/no health questions. These fields depend on the venue's settings. A photo consent choice is a record of your choice, not a photograph.
• Communications and choices. Service messages, delivery status, marketing choices and opt-outs. A venue can import existing customer, booking and credit records into Olladay. In that case, the venue supplies the information rather than you entering it here.
• Optional staff and integrations. If your venue uses staff scheduling or the mobile app, records can include your role, shifts, availability, time entries, contact details and registered device. A venue may connect other services, such as accounting, booking marketplaces or access control. Information shared depends on the service the venue selects.
• Technical information. Requests to our services can include IP address, browser and device information, requested pages, times, errors and security events. Login sessions and private booking links contain identifiers used to recognise authorised requests.

Stripe collects payment details through its payment interface. Olladay receives references, amounts and payment status so it can confirm bookings and handle refunds. Olladay does not receive or store your full payment card number or card security code. Stripe collects verification and payout information directly from a venue during Stripe onboarding.

Give an emergency contact's details only when you are entitled to do so, and tell them that the venue will use those details for emergencies. Avoid putting health information or other sensitive details in ordinary booking notes or support emails.

Why information is used

We use business account information to authenticate you, provide the service you request and administer your account. For services under an agreement with you, or steps you request before entering one, our lawful basis is performing that agreement or taking those steps. If you act for a business rather than contracting personally, our legitimate interest is providing and administering the service for that business. We use general enquiry information to answer you based on our legitimate interest in responding to people who contact us.

We use technical records and relevant account, booking and payment information to investigate faults, prevent misuse, reconcile transactions and deal with disputes. Our legitimate interests are running a reliable service, protecting users and keeping accurate records. We also retain or disclose information where necessary to meet applicable legal obligations.

Venues use booking and purchase information to provide the activity or product you request, manage attendance, collect payment and deal with changes or refunds. Olladay handles those records to provide the service the venue requests, rather than choosing the venue's purposes for it. The venue must explain its own lawful basis, including any additional legal condition required for health information. Agreeing to venue terms does not, by itself, establish a lawful basis for every use of health information.

Optional marketing and analytics rely on the relevant consent. A booking does not automatically sign you up for venue marketing. You can withdraw consent without changing the lawfulness of earlier use. Use an unsubscribe link where supplied, contact the venue about its marketing, or contact Olladay about analytics or Olladay communications. Essential booking and account messages are separate from marketing.

Required account and booking fields let us authenticate you or the venue fulfil your request. If you do not provide them, the account or booking may not work. Ask the venue about alternatives to any health form or other extra information it requests.

Cookies and optional analytics

The public marketing site is static HTML and does not run an Olladay analytics script. The business console uses essential cookies for login and security. Private booking links contain identifiers that let you manage your booking. A cookie can return you to the mobile app after payment. A referral link can also set a 30-day, venue-scoped cookie that records its source and, for Google referrals, a conversion identifier. Google and Stripe may use their own cookies when you use those services.

Where optional analytics is enabled and consent is given, Olladay can record product events such as business setup, booking, payment and refund completion. These events use pseudonymous identifiers and selected event details rather than customer names or email addresses. The optional analytics provider is Mixpanel. You can decline optional analytics and still use the service.

Who receives information

The venue and its authorised team can access customer information needed for their work. Olladay accesses information to provide support, operate the service and handle authorised requests. Relevant providers receive information for the functions below.

• DigitalOcean hosts the application and its database. The current application server is in London, United Kingdom.
• Google provides business-user sign-in. Messages sent to our hello address are forwarded through Namecheap to our Google mailbox.
• Stripe provides venue onboarding, payments, subscriptions, invoices and refunds. Stripe also processes information for its own legal, security and fraud-prevention purposes.
• Resend handles service email when email sending is enabled. It receives the recipient, subject and message content and returns delivery information.
• Mixpanel receives the optional consented analytics events described above when sending is enabled.

SMS sending is currently disabled. A venue's optional integrations have their own providers and privacy information. Ask the venue which it has connected. Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.

International processing

The UK application host is outside the European Economic Area. The European Commission has an adequacy decision for relevant transfers to the UK.

Google, Stripe, Resend and other providers operate internationally and may process information outside the EEA or UK. Resend describes processing in the United States, and Stripe describes transfers that can include the United States and India. The linked provider notices explain their processing and transfer arrangements. Contact Olladay for information about a particular transfer and how to obtain a copy of any applicable safeguards.

How long records are kept

Retention depends on the purpose and the record. Enquiries and support messages are kept while the enquiry or relationship is active and as needed to resolve the issue or a related dispute. Account and team records are kept while the account or access is needed and while closing outstanding service obligations.

Booking and purchase records are needed through the visit, any active pass, voucher or membership, and the handling of cancellations, refunds, disputes and accounting obligations. Unresolved payments or continuing membership renewals can delay erasure. Financial references and amounts may need to remain after contact details are removed.

Venue health answers and emergency contacts are relevant around the visit and, where the venue reuses an agreement, its applicable validity period. Agreement records can remain to establish which terms were accepted. Ask the venue for its retention decisions and contact us to request deletion of records that are no longer needed. Removal takes account of later bookings covered by the same agreement and any outstanding legal need for the record.

Technical logs, delivery records, provider copies and any backups can have different retention from working booking records. Their retention depends on their operational purpose, security needs, applicable legal requirements and the relevant provider. We consider these copies when handling a request. Contact us for the criteria that apply to your information.

Your choices and rights

Subject to the conditions in data protection law, you can ask for access to your information, correction, erasure, restriction of use or a portable copy. You can object to processing based on legitimate interests and object to direct marketing. You can withdraw consent where processing relies on consent.

Send requests to hello@olladay.com. Tell us enough to identify the account or booking and the venue involved. We may need to verify your identity without collecting more information than necessary. Venue-controlled requests may need the venue's decision or instructions. Erasure can be limited where records are needed for a legal obligation, an unresolved transaction or legal claims. We explain any applicable limitation when responding.

Booking availability and payment status are processed automatically. Stripe may also apply its own automated fraud checks, described in its privacy information. Contact the venue or Olladay if a booking or payment result needs investigation.

You can complain to the Irish Data Protection Commission or your local data protection authority. You can contact us first, but you do not have to do so.

Changes to this notice

We update this page when our handling of information changes. The date at the top identifies this version. Contact hello@olladay.com with questions about this notice or a change.