Privacy Policy

We collect information you provide directly, including:

• Account information — name, email address, username, and password when you register.
• Profile details — phone number, company name, and profile photo.
• Booking data — space reservations, dates, times, and preferences.
• Payment records — billing details and payment receipts (we do not store full card numbers).
• Visitor log data — name, phone, purpose of visit, and check-in/out timestamps.
• Communications — emails, enquiries, and support messages you send us.

We also collect information automatically when you use our services:

• Log data — IP address, browser type, pages visited, and timestamps.
• Device information — hardware model and operating system.
• Cookie and session data (see Section 5 for details).

We use the information we collect to:

• Create and manage your member account and bookings.
• Process payments and send invoices and receipts.
• Communicate with you about your membership, bookings, and services.
• Send transactional emails — booking confirmations, credential delivery, and account notices.
• Improve our facilities, services, and website experience.
• Ensure the safety and security of our space and members.
• Comply with applicable legal and regulatory obligations.

We do not sell, trade, or rent your personal information to third parties. We may share your information only with:

• Service providers — trusted vendors who help us operate (email delivery, payment processing, cloud hosting). They are bound by confidentiality agreements and may not use your data for their own purposes.
• Staff — our team members who need access to deliver services or resolve issues.
• Legal requirements — when required by law, court order, or to protect our legal rights and the safety of others.

We implement industry-standard security measures to protect your personal information:

• All data transmissions are encrypted using HTTPS/TLS.
• Passwords are hashed using industry-standard algorithms — we never store plain-text credentials.
• Access controls restrict data access to authorised personnel only.
• Payment receipt uploads are stored in a secure, access-controlled directory.

Our website uses essential session cookies required for the platform to function correctly:

• Session cookies — keep you logged in during your visit. Expire when you close the browser.
• CSRF tokens — protect form submissions from cross-site request forgery attacks.
• Flash messages — store one-time status messages (e.g., booking confirmed) between page loads.

We do not use advertising trackers, third-party analytics, or cross-site tracking cookies. The embedded Google Map on our website is served by Google and may set cookies subject to Google's Privacy Policy.

We retain your personal data only as long as necessary:

• Account data — retained while your account is active. Deleted within 30 days of a verified deletion request.
• Booking and invoice records — retained for a minimum of 5 years for accounting and legal compliance.
• Visitor log data — retained for 90 days, then anonymised.
• Communication records — retained for 2 years for service continuity and dispute resolution.

You may request deletion of your account data at any time — see Section 7 for how to exercise this right.

Under applicable data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct any inaccurate or incomplete information.
• Erasure — request deletion of your account and associated data (subject to legal retention requirements).
• Portability — receive your data in a structured, machine-readable format.
• Withdrawal of consent — opt out of non-essential communications at any time.
• Restriction — request that we limit how we process your data in certain circumstances.

Our platform may link to or integrate with third-party services. These services operate under their own privacy policies, which we encourage you to review:

• Google Maps — embedded map on our contact page, governed by Google's Privacy Policy.
• Payment processors — any payment gateway used is PCI-DSS compliant and governs card data independently.
• Email delivery providers — used to send transactional emails on our behalf.

We are not responsible for the privacy practices of external websites or services linked from our platform.

Focus Nook is intended for adults aged 18 and over. Our services, including membership, booking, and co-working access, are designed for professional use by adults.

We do not knowingly collect, store, or process personal information from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us at booking@focusnook.space and we will delete it promptly.

We review and update this Privacy Policy periodically to reflect changes in our services, technology, and applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify active members by email if changes materially affect how we use their data.

Continued use of our services after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us: