This is a plain-English draft of how CONOURI ONE handles personal data. It needs a legal review and a named data controller before launch.
The service is run by CONOURI. For account and billing data we are the controller. For the guest details a member collects through their booking page, the member is the controller and we process that data on their behalf. A full company name, address and contact for data requests must be added.
To provide your page and booking calendar, to send booking confirmations when email is added, to prevent abuse, to understand basic page usage, and to take subscription payments when you choose a paid plan. Our lawful bases are contract, legitimate interests (security and basic analytics) and consent where required.
Account and profile data are kept while the account is open. Booking data is kept for as long as needed to manage bookings and any legal obligations; this retention period must be set before launch. Busy-time caches refresh every ten minutes. Rate-limit counters expire naturally by hour.
You can ask for a copy of your data, correction, deletion, restriction, or to object to processing. Guests should contact the member whose page they booked through; we will help the member respond. Email hello@conouri.com. You can complain to the UK Information Commissioner's Office (ICO).
Our hosting and payment providers may process data outside the UK. Appropriate safeguards must be confirmed with each provider before launch.
Passwords are stored as PBKDF2 hashes with a unique salt. Sessions use hashed tokens. Accounts are isolated by tenant. Uploaded images are size and file-type checked. Calendar links are fetched only over https and private network addresses are blocked.
We will update this page when the way we handle data changes. This draft is not a substitute for legal advice.