How to check a booking system protects your customers’ data

When customers book with you, they hand over their names, emails and phone numbers. Many activity businesses also ask about health, swimming ability or children’s ages, and take card payments. Your booking system holds all of it, so choosing one means choosing who looks after your customers’ data.

Here’s what to check before you sign up, and how eola handles each point.

Who is responsible for what under GDPR

Under UK GDPR, you’re usually the controller of your customers’ data: you decide what to collect and why. Your booking system is a processor, handling the data on your behalf. The law expects a written agreement between you that sets out what the processor will do.

Check the provider’s terms say:

• they only use your customers’ data to provide the service, on your instructions
• how quickly they’ll tell you about a security breach
• which other companies (sub-processors) they share data with, and how they tell you about new ones
• that they’ll delete or return your data if you leave

How eola handles it: eola’s terms and conditions cover all four points, including how quickly eola will tell you about a breach and how to get your data deleted or returned. Read them before you sign up.

Card payments and PCI DSS

PCI DSS is the security standard set by the card brands for anyone who takes, processes or stores card details. Meeting it yourself is a lot of work. The simplest way to keep your part small is a booking system where card details go straight to a certified payment provider and never touch your systems or the booking software’s.

Check which payment provider the system uses, whether customers type their card details into that provider’s own form, and what you have to do yourself.

How eola handles it: eola’s payments run through Stripe, which is certified to PCI Level 1, the highest level. At checkout, customers enter their card details into Stripe’s card fields, so the details go to Stripe rather than eola. Customers can also pay with Apple Pay or Google Pay. When you connect your account, your bank and business details go into Stripe’s verification and eola doesn’t see your full bank details.

eola can only make sure payments taken through eola are handled this way. Your own team shouldn’t write down or store card numbers. For a phone booking, send a payment link or take the payment on a card reader instead. Stripe’s guide to PCI compliance explains what applies to your business.

Staff logins and permissions

A shared password on the front desk computer is one of the easiest ways for data to leak. Check that every member of staff can have their own login, that you can limit what each person sees, and what sign-in options there are beyond a password.

How eola handles it: each team member gets their own login, added under Toolset > Team, and a permission set controls what they can see and do. Unlimited instructors and instructor permissions are on every plan. Team members can also sign in with a passkey, such as Face ID, Windows Hello or a security key, instead of a password. They set it up from My account > Personal settings.

Whatever system you use, review your team list regularly and lower or remove access when someone changes role or leaves.

Health questions and consent

Health details count as special category data under GDPR, so only ask what you need for safety. Check you can set your own questions for each activity, that answers are stored digitally rather than on paper, and that marketing consent is collected properly.

How eola handles it: you write your own disclaimers and question packs and choose which activities they apply to. Answers are kept with the booking, not on a clipboard. When customers create an account, the box to hear news from your business starts unticked, and each customer record shows whether they’re subscribed to your emails. Notes your team adds to a customer belong to your business: other eola businesses they book with don’t see them.

Getting your data out

Check you can export your customer and booking data at any time, and what happens to it if you leave.

How eola handles it: customer reports are on every plan and reports download as CSV files. If you decide to leave, email help@eola.co and the team will help you close your account safely.

Questions to ask any provider

• Can I see your data processing terms?
• Who processes card payments, and do card details ever reach your servers?
• How fast will you tell me about a breach?
• Can each member of staff have their own login and permissions?
• How do I get my data back if I leave?

For the rest of the buying decision, see our checklist of what to look for in a booking system.

What it costs

Starter is £0 a month and Pro is £249 a month. Card payments have a 1.7% + 30p processing fee, and customers pay a 5% booking fee at checkout. See our pricing page for what each plan includes.

See eola in action

Want to see how this could work for your business? Book a demo or get in touch with our team.