Privacy Policy

This Privacy Policy describes how BrandPacks Limited ("we", "us", or "our") collects, uses, discloses, and safeguards information when you use the BoothHQ software-as-a-service platform, our marketing website, help centre, and related products and services (together, the "Service"). By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

Who we are

BoothHQ is operated by BrandPacks Limited, a company incorporated in the Hong Kong Special Administrative Region. Our registered office is Unit 1603, 16th Floor, The L. Plaza, 367–375 Queen's Road Central, Sheung Wan, Hong Kong. You can reach our team at [email protected] for any privacy-related enquiry. For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA), BrandPacks Limited is the data controller in respect of account-holder information and website visitors, and acts as a data processor on behalf of our business customers in respect of the personal data they upload about their own clients.

Information we collect

We collect three broad categories of information:

1. Information you provide directly. This includes your name, business name, email address, phone number, postal address, billing details, payment information handled via our payment processor, and any content you upload to the Service — including photographs, event details, client contact lists, invoice data, and messages.

2. Information from your use of the Service. We automatically collect log data (IP address, browser type, operating system, referring URL, pages visited, timestamps, and error reports), device identifiers, and usage patterns within the product. This helps us diagnose issues, measure performance, prevent abuse, and improve features.

3. Information from third parties. If you sign in via a single-sign-on provider, connect a calendar integration, or accept payments via Stripe, those services share limited data with us (such as your name, email address, and basic account metadata). Our third-party sub-processors are listed below.

How we use your information

We use personal data to provide, operate, and improve the Service — this includes creating and managing your account, fulfilling bookings and invoices, processing payments, sending transactional emails (booking confirmations, payment receipts, reminders), providing customer support, detecting and preventing fraud, complying with legal obligations, and enforcing our Terms & Conditions.

We also use de-identified, aggregated data for analytics — for example, understanding which features are most used or where customers encounter errors — so that we can improve the product over time. We will only use personal data for materially new purposes after notifying you and, where required by law, obtaining your consent.

Our legal basis for processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases: (a) performance of a contract — to provide the Service to you; (b) legitimate interests — to secure, improve, and market the Service to existing customers, provided your interests and fundamental rights do not override those interests; (c) consent — where you have opted in to marketing communications or certain cookies; and (d) legal obligation — where we must retain records to comply with tax, accounting, or other statutory requirements. You can withdraw consent at any time by contacting [email protected].

How we share information

We do not sell personal data. We share personal data only in the following limited circumstances:

- With sub-processors who help us run the Service, including cloud hosting, file storage, payment processing, and transactional email delivery. The current list is maintained on a separate page (see link below) and kept up to date whenever a vendor changes. These parties are bound by contractual obligations consistent with applicable data-protection law.

- With your instructions: when you use an integration, share a public booking link, send an invoice, or connect a calendar, we transmit the data necessary to complete those actions.

- For legal reasons: to comply with a valid legal process, enforce our Terms, protect the safety of our users, or respond to law-enforcement requests. We will resist overbroad requests where it is lawful to do so.

- In connection with a corporate transaction: if BrandPacks Limited is involved in a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users.

The complete, up-to-date list of our sub-processors is available here: Sub-processors.

International data transfers

Because we operate globally, your personal data may be processed in jurisdictions outside your country of residence, including the United States, the European Economic Area, the United Kingdom, and Hong Kong. Where we transfer personal data from the EEA or the UK to a country not recognised as providing an adequate level of protection, we rely on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Agreement / Addendum) and implement additional safeguards where necessary.

Data retention

We retain personal data for as long as your account is active and for a reasonable period afterwards to comply with legal, accounting, tax, and dispute-resolution obligations. When you close your account, we delete or anonymise most personal data within 90 days, except where retention is required by law or reasonably necessary to resolve outstanding disputes or enforce our agreements. Public shareable invoice links automatically expire after the linked event date.

Security

We implement administrative, technical, and organisational safeguards designed to protect personal data — including encryption in transit (TLS 1.2+), encrypted storage of sensitive fields such as payment-integration credentials, role-based access controls, audit logging, and regular backups. No system is perfectly secure, however, and you are responsible for maintaining the confidentiality of your account credentials. If you suspect unauthorised access, contact [email protected] immediately.

Your rights

Subject to applicable law, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion or restriction of processing; object to processing based on our legitimate interests; request portability of your data in a machine-readable format; and withdraw consent where processing is based on consent.

Residents of the European Economic Area and the United Kingdom also have the right to lodge a complaint with their local supervisory authority. Residents of California have additional rights under the CCPA, including the right to know what categories of personal information we collect and the right to opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioural advertising). Residents of Hong Kong have rights under the Personal Data (Privacy) Ordinance, including the right to access and correct personal data held about them.

To exercise any of these rights, email [email protected]. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling a request.

Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences (such as language), measure how the Service is used, and — where you have opted in — deliver marketing communications. Strictly necessary cookies are set whenever you use the Service. You can control non-essential cookies through your browser settings; disabling certain cookies may impair functionality. We do not use third-party advertising cookies that track you across unrelated websites.

Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact [email protected] so we can delete it.

Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify account holders by email or via a prominent notice in the Service and update the "Effective" date at the top of this page. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

Contact us

If you have any questions about this Privacy Policy or our data practices, please contact:

BrandPacks Limited
Unit 1603, 16th Floor, The L. Plaza
367–375 Queen's Road Central
Sheung Wan, Hong Kong
Email: [email protected]