Privacy and Data Processing Policy

Version 1.0 · Effective 11 August 2026

Contents

1. About this policy
2. Definitions
3. Our role and your role
4. Categories of data processed
5. How we use Client Data
6. Where your data is stored
7. International transfers
8. Disclosure to third parties
9. Export and deletion of your data
10. Scope of our responsibility
11. Payments
12. Security
13. Data breach
14. Retention
15. European data protection
16. United Arab Emirates data protection
17. Cookies and the Platform interface
18. Changes to this policy
19. Governing law and jurisdiction
20. Contact

1. About this policy

1.1 In Good Company LLC (“In Good Company”, “we”, “us”, “our”) is a limited liability company established in the United Arab Emirates and licensed by the Sharjah Media City (Shams) Free Zone Authority under trade licence number 2536049.01. We develop, host and operate Bookably (the “Platform”), a software platform licensed to businesses.

1.2 This policy is addressed to the businesses that license or subscribe to the Platform (“Client”, “you”, “your”). It explains how we handle the data you and your personnel place on the Platform, and how we handle the data relating to your own customers, members, patients, guests or other end users (“End User Data”).

1.3 This policy does not replace your own privacy notice. You remain responsible for publishing a privacy notice to your End Users and for describing your own data practices to them. Nothing in this policy is a privacy notice to your End Users, and we do not communicate directly with your End Users about their data except as set out in clause 9.4.

1.4 This policy forms part of, and is to be read together with, the agreement between you and us for use of the Platform (the “Agreement”). If there is a conflict between this policy and the Agreement, the Agreement prevails, except that, in respect of the processing of personal data, the data protection terms of this policy prevail over the Agreement to the extent of any conflict, and except where this policy sets out a higher standard of data protection.

2. Definitions

3. Our role and your role

3.1 You are the controller of End User Data. You decide what End User Data is collected, why it is collected, how long it is kept and who inside your organisation may see it. You are responsible for the lawfulness of that collection, including obtaining any consent required, and for the accuracy and relevance of the data you upload.

3.2 We are the processor of End User Data. We process End User Data only to provide, secure, maintain and support the Platform, and only in accordance with your instructions and the Agreement. We do not decide the purposes of that processing.

3.3 We are the controller of a limited set of account and operational data. This includes the identity and contact details of your administrators and billing contacts, your subscription and account records, correspondence with our support team, and technical logs generated by the Platform such as IP addresses, device and browser identifiers, timestamps and error traces. We process this data to operate our business, administer your account, secure the Platform, meet our legal obligations and improve the service.

3.4 Where we act as processor and you instruct us to do something that we believe would breach Applicable Data Protection Law, we will tell you and may suspend the relevant instruction until the point is resolved.

4. Categories of data processed

4.1 The exact categories depend on how you configure the Platform. Typically, the Platform may hold:

• Identity and contact details of End Users, such as name, email address, telephone number and preferred language.
• Booking, appointment, reservation and scheduling records, including dates, times, services selected, locations, staff assigned, notes and cancellation history.
• Account credentials and authentication data for your personnel and, where enabled, for End Users.
• Communication records generated through the Platform, such as confirmations, reminders and notifications.
• Usage and technical data, such as log files, IP addresses, session identifiers, device type and error diagnostics.
• Any additional fields, notes or attachments that you choose to configure or that your personnel choose to enter.

4.2 Special category data. The Platform is not designed or certified as a system of record for health data, biometric data, genetic data, data revealing racial or ethnic origin, religious or political beliefs, trade union membership, or data concerning sex life or sexual orientation. If your intended use involves any of those categories, you must contact us in writing before uploading such data so that the appropriate safeguards and contractual terms can be agreed. Uploading special category data without that written agreement is a breach of the Agreement and is at your own risk.

4.3 Payment card data. We do not collect, process, transmit or store full payment card numbers, card verification values or bank account credentials. See section 11.

4.4 Children’s data. The Platform is not intended for direct use by children. If your service involves bookings made for or by minors, you are responsible for obtaining any parental or guardian consent required in your jurisdiction, and you must notify us in writing so that any additional safeguards can be agreed.

5. How we use Client Data

5.1 We process Client Data only for the following purposes:

• a) to host, deliver, operate and make the Platform available to you;
• b) to authenticate users and enforce access controls;
• c) to provide technical support and resolve incidents you report;
• d) to maintain the security, integrity, availability and resilience of the Platform, including backups, monitoring and abuse prevention;
• e) to detect, investigate and prevent fraud, security incidents and misuse of the Platform;
• f) to carry out the export and deletion requests described in section 9;
• g) to comply with a legal obligation binding on us; and
• h) to enforce the Agreement and establish, exercise or defend legal claims.

5.2 We do not sell Client Data. We do not rent, trade or otherwise commercialise Client Data or End User Data.

5.3 We do not use Client Data for advertising. We do not use Client Data for behavioural advertising, profiling for marketing purposes, or advertising measurement, whether for ourselves or for any third party.

5.4 We do not use Client Data to train artificial intelligence or machine learning models, and we do not disclose Client Data to any third party for that purpose, unless you instruct us to do so in writing.

5.5 We do not market to your End Users. We do not contact your End Users on our own behalf.

5.6 We may generate and use aggregated, statistical and de-identified information about the operation of the Platform, for example total request volumes, feature usage counts and performance metrics. Such information contains no personal data, does not identify you or any End User, and cannot reasonably be used to re-identify any individual.

6. Where your data is stored

6.1 Client Data is hosted on servers located in Singapore and in Europe. The specific region that applies to your instance is recorded in your account settings or in your order form.

6.2 Our hosting infrastructure is provided by established commercial data centre and cloud providers operating under recognised international security standards. Details of the providers and the specific facilities used for your instance are available on written request.

6.3 Backups of Client Data are retained within the same region as the primary instance, unless we notify you otherwise in writing in advance.

6.4 Our corporate operations, engineering, support and administration are carried out from the United Arab Emirates. Our authorised personnel may access Client Data remotely from the UAE, and from any other location where we operate, strictly for the purposes listed in clause 5.1. Access is limited to personnel who need it to perform their role, is subject to authentication controls, is logged, and is covered by written confidentiality obligations.

6.5 We will not move your Client Data to a different hosting region without giving you prior written notice and a reasonable opportunity to object.

7. International transfers

7.1 Because the Platform is hosted in Singapore and in Europe and operated from the United Arab Emirates, Client Data crosses borders in the ordinary course of providing the service.

7.2 Where personal data protected by the GDPR is transferred outside the European Economic Area, including access from the UAE, that transfer is made on the basis of the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the transfer is subject to the UK GDPR, or another transfer mechanism recognised under Chapter V of the GDPR, together with any supplementary technical and organisational measures identified as necessary by a transfer risk assessment. A copy of the applicable clauses is available on written request.

7.3 Where personal data is transferred out of the UAE, we comply with the cross-border transfer requirements of UAE Federal Decree-Law No. 45 of 2021 and any implementing regulations in force at the relevant time.

7.4 You are responsible for confirming that transfers to the region you have selected are lawful under the laws that apply to you and to your End Users.

8. Disclosure to third parties

8.1 We do not share Client Data or End User Data with third parties, except in the limited circumstances set out in this section.

8.2 Sub-processors. We engage a small number of sub-processors to deliver the Platform, for example hosting and data centre providers, transactional email and SMS delivery providers, error monitoring services and backup services. Every sub-processor is bound by a written contract imposing data protection obligations no less protective than those in this policy, and is permitted to process Client Data only to deliver the service we have engaged it for. A current list of sub-processors is available on written request. We will give you reasonable prior notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

8.3 At your instruction. We will disclose Client Data to a third party where you instruct us to do so, for example when you enable an integration, connect an external calendar, or authorise an export to another provider. Any such disclosure is made on your instruction and at your risk, and this policy does not govern what the receiving party does with the data.

8.4 Legal requirement. We may disclose Client Data where we are compelled to do so by a binding order, subpoena, warrant, regulatory demand or other legal process issued by a competent authority. Unless we are legally prohibited from doing so, we will notify you before disclosing, give you a reasonable opportunity to seek protective relief, and limit the disclosure to what is legally required.

8.5 Professional advisers. We may disclose Client Data to our lawyers, auditors and insurers where necessary and under a duty of confidentiality.

8.6 Corporate transaction. If we are involved in a merger, acquisition, restructuring or sale of assets, Client Data may be transferred as part of that transaction. We will notify you in advance, and the receiving entity will be bound by obligations at least as protective as those in this policy.

8.7 We do not disclose Client Data to advertising networks, data brokers, list vendors or analytics companies that would use it for their own purposes.

9. Export and deletion of your data

9.1 Your right to export. You may request an export of your Client Data at any time during the term of the Agreement. Exports are provided in a structured, commonly used, machine readable format such as CSV or JSON.

9.2 Your right to deletion. You may request the deletion of all or part of your Client Data at any time. On completion, the data is removed from the live production environment and is no longer accessible through the Platform.

9.3 Timeline. Requests that concern a single End User, such as assistance with an individual export or erasure, are processed within 10 working days of the date we accept a valid request. Bulk requests, whole account exports and whole account deletions are processed within 7 to 30 working days, and the time taken within that range depends on the volume of data, the complexity of the request and the number of systems involved. We will confirm receipt of your request and, where a request is likely to take longer than the applicable window for reasons outside our control, we will tell you why and give you a revised timeline.

9.4 How to make a request. Requests must be submitted in writing by an authorised administrator of your account to digital@ingoodcomp.co. We may ask you to verify your identity and your authority to act for the Client before we proceed. We do not accept export or deletion requests directly from your End Users. If an End User contacts us with such a request, we will not action it. We will tell the End User to contact you, and we will forward the request to your registered administrator contact without undue delay.

9.5 Assisting you with End User requests. Where an End User exercises a right against you as controller, we will provide reasonable assistance so that you can respond within your own legal deadline. Under the GDPR, for example, you must generally respond to a data subject within one calendar month, and our 10 working day commitment for single End User requests is set so that you can meet that deadline. Raise time critical requests with us as early as possible, marked as urgent, and factor our processing windows into your own scheduling.

9.6 Backups. Deletion from the live environment does not immediately remove data from encrypted backup media. Backup copies are overwritten on our standard rotation cycle, which is 30 days. Data held in backups is not accessible for ordinary business use and is deleted at the end of that cycle.

9.7 Deletion on termination. Unless you instruct otherwise in writing, we will make your Client Data available for export for 30 days after the Agreement ends. After that period, we will delete the Client Data in accordance with clauses 9.6 and 9.8.

9.8 Limits on deletion. We may retain a limited subset of data after a deletion request where retention is required by law, necessary to comply with a legal hold or ongoing legal proceedings, or necessary to establish, exercise or defend a legal claim. We may also retain account, billing and transaction records required for tax, accounting and corporate compliance purposes under UAE law. Anything retained on these grounds is isolated, access restricted, and used only for the purpose that justified retaining it.

9.9 Cost. Routine export and deletion requests are provided at no charge. We reserve the right to charge a reasonable fee for requests that are manifestly excessive, repetitive, or that require significant bespoke engineering work, and we will tell you the cost before proceeding.

10. Scope of our responsibility

10.1 We provide infrastructure and technology only. Our role is to supply, host and maintain the Platform. We are not a party to any relationship between you and your End Users.

10.2 We are not responsible for:

• a) the services, goods, treatments, sessions, appointments or experiences that you provide to your End Users;
• b) the accuracy, legality, quality or availability of anything you offer or advertise through the Platform;
• c) the content, pricing, terms, cancellation policies or refund policies that you publish through the Platform;
• d) any booking that you honour, decline, reschedule, cancel or fail to fulfil;
• e) any dispute, complaint or claim between you and an End User;
• f) your compliance with the licensing, professional, consumer protection, health and safety, tax or sector specific regulations that apply to your business;
• g) the content that you or your personnel upload to the Platform; or
• h) any third party service, integration, plugin or application that you connect to the Platform.

10.3 The Platform is a tool. Any decision made using it, and any consequence of that decision, is yours.

10.4 You will indemnify us against any claim brought by an End User, a third party or a regulator that arises from your use of the Platform, from the services you provide, or from your failure to comply with Applicable Data Protection Law in your capacity as controller, except to the extent the claim arises from our own breach of this policy or the Agreement.

10.5 Nothing in this section limits liability that cannot be limited under UAE law.

11. Payments

11.1 We are not a payment service provider. We are not a bank, a payment institution, an acquirer, a payment facilitator, a money transmitter or an escrow agent. We do not hold client money, and we do not settle funds.

11.2 You contract directly with your own payment service provider. Any collection of money from your End Users takes place through a payment service provider that you select, onboard with and contract with in your own name. Your relationship with that provider is governed entirely by the terms between you and that provider.

11.3 Where the Platform offers an integration with a payment service provider, that integration is a technical connection only. Enabling it does not make us a party to the payment, does not make us responsible for the payment, and does not make us an agent of you or of the provider.

11.4 We give no guarantee of any kind in relation to payments. Without limitation, we do not warrant or guarantee:

• a) that any payment will be authorised, captured, settled, cleared or received;
• b) the timing, amount, currency conversion or fees applied to any payment;
• c) the availability, uptime, performance or continuity of any payment service provider or payment integration;
• d) the security, compliance or solvency of any payment service provider;
• e) the outcome of any refund, chargeback, reversal, dispute or fraud investigation; or
• f) that a payment service provider will approve, retain or continue your merchant account.

11.5 Payment issues are raised directly with your payment service provider. All questions, complaints, disputes, refund requests, chargebacks, reconciliation queries and claims relating to payments must be raised by you, or by your End User through you, directly with your payment service provider. We will not act as an intermediary, will not adjudicate payment disputes, and will not issue refunds of money we never received. Where a problem is caused by a defect in our integration code, we will investigate and remediate the defect as a technical support matter, but this does not make us liable for the underlying payment.

11.6 Your payment service provider is an independent controller of the payment data it processes. Its privacy notice, not this policy, governs that data. You are responsible for telling your End Users which provider you use and where its notice can be found.

11.7 Subscription fees payable by you to us for the Platform are collected separately and are governed by the Agreement.

12. Security

12.1 We maintain technical and organisational measures appropriate to the risk, which include:

• encryption of data in transit using industry standard TLS;
• encryption of data at rest on our production systems and backups;
• role based access control, with access granted on a least privilege basis;
• multi factor authentication for administrative access to production systems;
• logging and monitoring of access to production environments;
• network segregation, firewalling and hardened server configuration;
• regular patching of operating systems and dependencies;
• routine encrypted backups with periodic restoration testing;
• written confidentiality undertakings from all personnel with access to Client Data; and
• security awareness training for personnel.

12.2 No system is completely secure. We do not warrant that the Platform will be free from unauthorised access, and clause 12.1 is a description of our measures rather than a guarantee of outcome.

12.3 Your responsibilities. You are responsible for the security of your own environment, including managing user accounts and permissions within your instance, revoking access promptly when personnel leave, requiring strong credentials, keeping devices secure, and not sharing login details. We are not responsible for a compromise that results from your own credential handling.

13. Data breach

13.1 If we become aware of a personal data breach affecting Client Data, we will notify you without undue delay and in any event within 48 hours of becoming aware of it.

13.2 Our notification will describe, so far as we know at the time, the nature of the breach, the categories and approximate volume of data and individuals affected, the likely consequences, the measures we have taken or propose to take, and a contact point for further information. We will provide updates as the investigation develops.

13.3 As controller of End User Data, you are responsible for deciding whether the breach must be notified to a supervisory authority or to affected individuals, and for making those notifications within your applicable deadlines. We will provide reasonable assistance.

13.4 Notification of a breach is not an admission of fault or liability by either party.

14. Retention

14.1 We hold Client Data for as long as your Agreement is in force, and afterwards only as set out in clauses 9.6 to 9.8.

14.2 Within the Platform, retention of individual records is controlled by you through your configuration. Where you have set retention rules, we apply them. Where you have not, data remains until you delete it or until the Agreement ends.

14.3 Technical and security logs for which we act as controller are retained for 12 months and then deleted or anonymised.

14.4 Account, billing and corporate records are retained for the period required by UAE commercial, tax and corporate law, currently a minimum of 5 years from the end of the relevant financial year.

15. European data protection

15.1 This section applies where the GDPR applies to the processing of Client Data, including because Client Data is hosted on our European servers or because you or your End Users are established in the European Economic Area or the United Kingdom.

15.2 Where the GDPR applies, we act as processor and you act as controller, and Article 28 GDPR requires a written data processing agreement between us. Clauses 3 to 9 and 12 to 14 of this policy constitute those written terms, bind both parties from the start of the Agreement, and prevail over the Agreement as set out in clause 1.4. Where an international transfer requires them, the European Commission’s Standard Contractual Clauses, and the UK International Data Transfer Addendum where relevant, are incorporated into these terms by reference and take effect between the parties from the start of the Agreement. A signed standalone copy of the data processing agreement and of the applicable clauses is available on written request.

15.3 In particular, we undertake that we will:

• a) process personal data only on your documented instructions;
• b) ensure that personnel authorised to process personal data are bound by confidentiality;
• c) implement the security measures required by Article 32 GDPR;
• d) engage sub-processors only on the terms in clause 8.2;
• e) assist you, taking into account the nature of the processing, in responding to requests from data subjects exercising their rights under Chapter III GDPR;
• f) assist you with your obligations under Articles 32 to 36 GDPR, including breach notification and data protection impact assessments;
• g) delete or return personal data at the end of the Agreement, as set out in clause 9.7; and
• h) make available the information necessary to demonstrate compliance with Article 28 and allow for audits as set out in clause 15.5.

15.4 Rights of data subjects. Individuals in the EEA and the UK have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Those rights are exercised against you as controller, not against us. An individual also has the right to lodge a complaint with a supervisory authority in their country of residence, place of work or place of the alleged infringement.

15.5 Audit. On reasonable written notice and no more than once in any twelve month period, unless required more frequently by a supervisory authority, you may audit our compliance with this section. We may satisfy an audit request by providing an existing third party audit report or completed security questionnaire where one adequately addresses your questions. Audits are at your cost, must not disrupt our operations, and must respect the confidentiality of our other clients.

15.6 We will notify you if we determine that we can no longer meet our obligations under this section.

15.7 Interaction with governing law. Clause 19 sets UAE law as the governing law of the Agreement between us. A governing law clause cannot displace the mandatory application of the GDPR where the GDPR applies of its own force. Where a term of this policy conflicts with a mandatory requirement of the GDPR in relation to processing to which the GDPR applies, the GDPR requirement prevails to the extent of the conflict, and the remainder of this policy continues to apply.

16. United Arab Emirates data protection

16.1 We are established in the United Arab Emirates and process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, as supplemented by any implementing or executive regulations in force from time to time.

16.2 At the date of this policy, the executive regulations to Federal Decree-Law No. 45 of 2021 have not been issued in final form. We monitor developments and will update our practices and this policy as the implementing framework is published.

16.3 Where a specific free zone regime applies to your engagement with us, for example the DIFC Data Protection Law No. 5 of 2020 or the ADGM Data Protection Regulations 2021, the additional requirements of that regime will be addressed in a separate written schedule.

17. Cookies and the Platform interface

17.1 The Platform uses cookies and similar technologies that are strictly necessary to deliver it, including session cookies for authentication, security tokens and load balancing.

17.2 Where you enable optional analytics or marketing technologies on any customer facing pages served through the Platform, you are responsible for obtaining any consent required from your End Users and for disclosing those technologies in your own privacy and cookie notice.

17.3 Details of the cookies set by the Platform are available on written request.

18. Changes to this policy

18.1 We may update this policy to reflect changes in the Platform, our sub-processors, our security practices or the law.

18.2 We will give you at least 30 days’ written notice before a change that materially reduces the protections in this policy takes effect. Other changes take effect when the updated policy is published.

18.3 If a material change is unacceptable to you, you may terminate the Agreement in accordance with its terms and request an export and deletion under section 9.

18.4 The version number and effective date at the top of this document identify the current version. Superseded versions are available on request.

19. Governing law and jurisdiction

19.1 This policy, and any dispute or claim arising out of or in connection with it, including any non-contractual dispute or claim, is governed by and construed in accordance with the federal laws of the United Arab Emirates as applied in the Emirate of Sharjah.

19.2 The parties submit to the exclusive jurisdiction of the courts of the Emirate of Sharjah, United Arab Emirates, in respect of any dispute arising out of or in connection with this policy.

19.3 Any issue, complaint, claim or dispute concerning the Platform, this policy or the handling of Client Data is to be dealt with under UAE law and through the UAE and Sharjah legal process, subject only to clauses 19.4 and 19.5.

19.4 Clauses 19.1 to 19.3 do not deprive an individual of the protection of any mandatory provision of law that applies to them regardless of choice of law, and do not limit the jurisdiction of a supervisory authority that has statutory competence over processing to which this policy relates. See clause 15.7.

19.5 Where the Standard Contractual Clauses or the UK International Data Transfer Addendum apply under clause 7.2 or clause 15.2, the governing law and forum provisions of those instruments prevail for the matters within their scope.

19.6 This policy is issued in English. The English version prevails unless and until an Arabic version is formally issued, after which the Arabic version prevails to the extent required by law.

20. Contact

For any question about this policy, or to make an export or deletion request:

We aim to acknowledge written enquiries within 7 working days.