This Privacy Policy explains how Skedda, Inc. ("Skedda", "we", "us") handles personal information when you visit our websites, contact us, or use our booking and resource-management services, including services offered under the AllBooked brand (the "Services"). Skedda and AllBooked are brands of Skedda, Inc.

Organizations that subscribe to the Services ("Customers") use them to manage bookings for their workplaces, venues and communities, including by their employees, members, guests and other users ("Users"). Information entered into a Customer's booking site or account is "Customer Data." The Customer decides why and how that information is used; Skedda processes it on the Customer's behalf under our agreement with that Customer, including, where it applies, our Data Processing Addendum (https://www.skedda.com/data-processing-addendum). Users should direct questions or requests about Customer Data to the relevant Customer.

Skedda is responsible for personal information it uses for its own business purposes, including information from visitors to our own websites, people who contact us or request a demo, Customer administrators and billing contacts (including information about how administrators use the Services), and Skedda logins that can be used across more than one Customer. This does not include booking content or personal information about other Users. Except where it describes our handling of Customer Data (Section 4), this policy covers those activities.

We collect information you provide to us, including contact, account and login information; business and billing details; communications, feedback and support requests; and, where disclosed at the start of a call or meeting, recordings and transcripts. Payment-card details are collected directly by our payment provider and are not stored by Skedda. We also collect device, usage, cookie and approximate-location information when you use our websites or Services.

We may receive information from sign-in providers, Customers, business-contact and enrichment providers, advertising and social-media platforms, event organizers, resellers, integration partners and other publicly or commercially available sources. Where permitted, we may use website-visitor identification services that help us identify visitors to our websites using IP addresses, cookies and similar technologies. We may combine information from these sources with information we collect directly.

Where we ask you for information, we indicate when it is required. If you do not provide it, we may be unable to provide the relevant Service or respond to your request.

We use personal information to provide, operate, secure, support and improve the Services and our websites; manage accounts, subscriptions and payments; communicate with you; respond to requests; conduct marketing and events; send text messages where you have opted in; record and manage calls or meetings where permitted; and comply with law, enforce our agreements and protect our rights and the rights of others.

For people in the EEA, United Kingdom and Switzerland, we rely on: performance of our contract with you or your organization to provide the Services and manage accounts, billing and support; legal obligation for tax, accounting and legal compliance; consent for non-essential cookies and advertising where required, and for text messages; and legitimate interests for securing and improving the Services, preventing fraud, recording calls for quality and training, and marketing our Services to business contacts, including using business-contact enrichment and website-visitor identification to understand which organizations are interested in Skedda. You may ask us for more information about our legitimate interests and object to processing based on them.

We use service providers, including AI-enabled tools, to help us carry out these activities. They process personal information under contractual confidentiality and data-protection obligations. We may also aggregate or de-identify information and use it for lawful purposes. Where required by law, we maintain de-identified information in that form, do not attempt to re-identify it except as law permits, and require recipients to do the same.

We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects for you.

We process Customer Data only as the Customer instructs and as permitted by our agreements and applicable law. We do not sell Customer Data, share it for cross-context behavioral or targeted advertising, or combine it with personal information from other sources except as law permits. Customers control the information collected in their accounts, who can see it, and the retention settings available to them. Customer administrators may see and manage information and activity in their accounts as the Customer configures.

Customers must not submit sensitive information to the Services, such as health information, government identification numbers or financial-account numbers, other than payment-card details entered directly into secure payment fields.

Your Skedda login may be used with more than one Customer. Skedda is responsible for maintaining that login; each Customer remains responsible for the information in its own account, including bookings and profile information. Customer-configured single sign-on is part of that Customer's account. You may ask us to delete your Skedda login as described in Section 8.

We share personal information with service providers that help us operate, secure, support, analyze and market the Services; send communications; process payments; manage customer relationships; and record or transcribe calls. Sub-processors that process Customer Data are listed at https://trust.skedda.com/subprocessors.

We also share information with the relevant Customer and its Users as the Customer configures the Services; payment providers; products connected through an integration; advertising and analytics partners that help us advertise our own Services and measure effectiveness; and website-visitor identification providers. Advertising and website-visitor identification technologies are used on our own marketing websites, not on booking sites we host for Customers or in our booking widget. A Customer's own website, including a page containing our widget, is governed by that Customer's privacy practices.

We may also disclose information in connection with a corporate transaction, to comply with law or legal process, to protect rights, property or safety, or with your consent or at your direction.

We use cookies and similar technologies to operate our websites and Services, remember preferences, understand how they are used and support our marketing. Our Cookie Policy is available at https://support.skedda.com/en/articles/1802467-skedda-cookie-policy. Where required, including in the EEA and United Kingdom, we obtain consent before setting non-essential cookies.

You can manage cookies through your browser settings and, where available, our cookie settings. Where required by applicable law, we honor legally recognized browser-based opt-out preference signals, such as Global Privacy Control. We do not otherwise respond to Do Not Track signals.

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including to provide the Services, meet legal, tax and accounting obligations, resolve disputes and enforce our agreements. We retain Customer Data as the Customer instructs, subject to the retention settings and our data-retention documentation for the Services (https://support.skedda.com/en/articles/6294354-user-data-retention, https://support.skedda.com/en/articles/5707504-booking-and-visit-data-retention and https://support.skedda.com/en/articles/9620217-occupancy-data-retention), which we update from time to time. After a Customer's subscription ends, we delete Customer Data in accordance with that documentation and our agreement with the Customer. Backup and log copies are removed under their normal schedules.

We maintain administrative, technical and organizational safeguards designed to protect personal information, including encryption in transit, access controls and an information-security program independently audited under the SOC 2 Type II framework. No system is completely secure. If a security incident affects personal information, we notify Customers, individuals and regulators as required by law and our agreements. For Customer Data, we notify the affected Customer, which is responsible for notices to its Users.

Depending on where you live, you may have rights to access, correct, delete or receive a portable copy of personal information; object to or restrict certain processing; withdraw consent; opt out of sale, sharing or targeted advertising; and appeal a decision about your request.

You can object at any time to our use of your personal information for direct marketing, and we will stop.

To exercise a right, email dpo@skedda.com. We may verify your identity and authority, and may decline a request where law permits. Authorized agents may make requests on your behalf. If we decline a request, you may appeal by replying to our decision or emailing dpo@skedda.com with "Appeal" in the subject line. We will not discriminate against you for exercising your rights.

You can opt out of marketing emails using the unsubscribe link in the email. To opt out of text messages, reply STOP. We may still send non-promotional service messages.

If you ask us to delete your Skedda login, you will no longer be able to sign in. Customer records, including booking records, remain with the relevant Customer. For a request concerning Customer Data, contact the Customer; we will forward requests we receive and assist as required by our agreement with that Customer.

If you opt in to receive text messages, we may send messages such as demo confirmations and reminders. Message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help. We do not share mobile phone numbers or text-message opt-in data and consent with third parties or affiliates, except with providers that deliver our text messages or as required by law. Our SMS Messaging Terms are available at https://support.skedda.com/en/articles/15674923-sms-messaging-terms.

Skedda is based in the United States. We and our service providers process personal information in the United States and other countries. Where required for transfers from the EEA, United Kingdom or Switzerland, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and relevant UK and Swiss equivalents. You may request more information about these safeguards at dpo@skedda.com.

Skedda, Inc. is the controller of the information described in Section 1 that we process for our own purposes. You may contact our Data Protection Officer at dpo@skedda.com or the address in Section 14. Our representatives under Article 27 of the GDPR and UK GDPR are:

You may lodge a complaint with your local data-protection authority.

This section supplements this policy for residents of California and other US states with comprehensive privacy laws, and serves as our notice at collection. In the past 12 months, we have collected identifiers and contact details; customer, commercial and professional information; internet or network activity; approximate location; recordings and transcripts; and account login credentials. We collect this information from the sources described in Section 2 and use it for the purposes in Section 3. Section 7 explains how long we keep personal information.

We disclose these categories to service providers and, where relevant, Customers, payment providers and integrations. We may share identifiers and internet or network activity with advertising partners for cross-context behavioral or targeted advertising, and disclose them to website-visitor identification providers. These disclosures may be considered a sale, sharing or targeted advertising under certain US state privacy laws. We do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only to provide and secure the Services, not to infer characteristics about you.

To opt out of sale, sharing or targeted advertising, email dpo@skedda.com. Residents of some states may request a list of specific third parties to which we disclosed their personal information.

You may contact our Data Protection Officer at dpo@skedda.com with questions or complaints. Your personal information may be processed outside your country, including in the United States, and may be subject to the laws of those locations. If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner or the Office of the Privacy Commissioner of New Zealand, as applicable.

Our websites are not directed to children, and we do not knowingly collect personal information from children under 13, or under 16 in the EEA and United Kingdom, for our own purposes. Customers that allow bookings involving minors are responsible for obtaining any consent required by law. Contact dpo@skedda.com if you believe a child has provided personal information in breach of this policy.

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, where changes are material, provide notice as required by law.

Questions about this policy or our privacy practices may be sent to:

Skedda, Inc., Attn: Data Protection Officer

PMB 2510, 3839 McKinney Ave., Suite 155

Dallas, TX 75204, USA

Email: dpo@skedda.com