Privacy Policy

Last updated: 19 June 2026

Introduction

Boon provides curated luxury experiences and accommodations ("Services"). This policy explains how Downtime Limited collects and processes personal data through your interaction with our website, Services, and any data you provide through signing up to our platform, orders, or inquiries. Downtime Limited is the controller responsible for your personal data (referred to as "Boon", "we", "us" or "our" in this policy). If you have questions or need to exercise your rights, please contact us using our contact details below. "You" and "your" means you as the user of our Site for the purposes of these Terms.

Boon respects your privacy and is committed to protecting your personal data. Our privacy policy informs you how we collect, use, and store your personal data when you visit our website ("Site") or use our Services. In addition to this Privacy Policy, our Cookies Policy and General Terms of Use, and any Terms of Service that may apply to your use of the Services, are incorporated into this Privacy Policy.

This Site is not intended for children, and we do not knowingly collect data from children. If you have any concerns that we have collected personal data of a minor without consent, please contact us. Please read this policy before you start using the Site.

Personal data that we collect about you

We collect, use, store, and transfer different kinds of personal data during our Service and when you interact with our Site, including:

Identity Data (name, username, title, date of birth)
Contact Data (email address, phone number, postal address)
Financial Data (payment card details, billing information)
Transactional Data (payments and other details related to services you have purchased)
Technical Data (IP address, browser type and version, location, operating system, and device information)
Profile Data (username, preferences, feedback, and orders)
Usage Data (information on how you use our website, products, or services)
Marketing and Communications Data (your preferences regarding receiving marketing materials)

We may also collect aggregated data, which provides us with analytical, statistical and demographic data that does not directly identify you. We will only consider aggregated data to be personal data if this can be linked with your personal data.

We may collect special categories of personal data in the instance you provide us with information when using our Services. Types of special category data may consist of allergies or health-related information.

Failure to provide personal data

If we require personal data or special category data, when requested for legal or contractual reasons and you fail to provide this, we will not be able to perform the services to your satisfaction. To the fullest extent permitted by law, we exclude and disclaim all warranties, terms, conditions, and representations that may otherwise be implied by law in connection to this. We are not responsible for any indirect, incidental, or consequential damages arising from your use of the Service.

How is your personal data collected?

We collect data from various sources in connection with the services, these are as follows:

Direct Interactions (you provide data directly by filling out forms, placing orders, creating accounts, or contacting us)
Automated Technologies (we collect data automatically as you interact with our website through cookies and server logs)
Third Parties or Public Sources (we may receive data from third parties like payment processors or analytics providers)

How we use your personal data

We will only use your personal data where we have a lawful basis to do so under UK data protection law. These include:

Performance of a contract (where processing is necessary to provide our services or fulfil a booking or request you have made, including steps taken at your request before entering into a contract)
Legitimate interests (where processing is necessary for our legitimate business interests, provided your interests and fundamental rights do not override those interests — for example, improving our services, ensuring security, and understanding how our platform is used)
Legal obligations (where we are required to comply with applicable laws and regulations)

The purposes we use your personal data for, and the lawful basis:

To create and manage your account (including referral-created accounts where you access Boon via a booking link or partner referral) — Identity, Contact, Technical Data — necessary to perform our contract with you, and for our legitimate interests (to analyse how our Services are used and develop them further).
To process and manage your booking or order — Identity, Contact, Financial, Booking Data — necessary to perform our contract.
To communicate with you about your account, booking or service updates — Identity, Contact, Booking Data — necessary to perform our contract, and for our legitimate interests.
To manage connected calendar services and synchronise availability (including preventing double bookings and displaying accurate availability) — Technical, Usage, Availability Data (free/busy status only) — necessary for performance of a contract (including steps prior to entering into a contract).
To improve and develop our services and understand how users interact with our platform — Technical, Usage Data — for our legitimate interests.
To ensure security, prevent fraud, and enforce our rights — Identity, Contact, Technical, Usage, Financial, Profile Data — legitimate interests and/or legal obligations.
To enforce legal rights — Identity, Contact, Technical, Usage, Financial, Profile — to comply with our legal and regulatory obligations and, in other cases, for our legitimate interests (to protect our business, interests and rights).

Marketing

You can choose to receive marketing communications when signing up to our Site. We will always seek your consent before sending marketing communications, and you can opt out at any time.

Disclosures of your personal data

We routinely share your personal data with the following categories of recipients:

Experience providers, to enable them to deliver your chosen experience or accommodation and manage your booking
Service providers who act on our behalf to support the operation of our platform and services (including hosting, communications, payments, analytics and customer support)
Property management systems and accommodation partners, including iPro, where you make a booking for accommodation or a stay — we share relevant booking details (such as guest name, contact details, booking dates and party size) to confirm, manage and administer your booking
Prospective business partners, advertisers and sponsors, where we may share aggregated or anonymised statistical information that does not identify individual users, in order to describe or improve our services
Third parties in connection with a business transfer or sale, such as a merger, acquisition or asset sale
Legal and regulatory authorities, where we are required to disclose personal data to comply with applicable law, regulation, court order or lawful government request

We require all third parties to process your personal data in accordance with applicable data protection laws and to use it only for the purposes for which it is disclosed. In more detail:

Sharetribe hosts and manages marketplace infrastructure — facilitating transactions, including handling listings, user accounts, and communication between marketplace participants, and enabling integrations with third-party services for payments, analytics, and notification. This includes user account details such as names and email addresses, device identifiers (e.g. IP address processed during the session), and transactional data (e.g. payment details processed via third-party payment services like Stripe). Data exchanged during user interactions, such as messages and listings, may also be processed. Sharetribe stores this information in compliance with data protection standards and may utilise pseudonymisation or de-identification methods where applicable.
Luxury Cotswold Rentals provides property and booking management services, including coordinating bookings, managing guest stays, liaising with providers and delivering operational support in relation to experiences and accommodation — Identity Data, Contact Data, Booking Details, Enquiry Details, Stay Information and Operational Notes.
iPro provides property and booking management services, including recording and administering bookings made through the platform and synchronising booking information with accommodation management systems — Guest Names, Email Addresses, Booking Dates, Party Size and Booking Reference Information.

International transfers

We may transfer personal data to countries outside the UK or EU. We take measures to ensure similar protection for your data when transferred outside the EEA, including using standard contractual clauses. The recipients outside the UK are:

Stripe Inc (USA) — facilitates online payments through Boon's Site; Stripe may process payment account details, bank account details, billing/shipping address, name, date/time/amount of transaction, device ID, email address, IP address/location, order ID, payment card details, tax ID/status, unique customer identifier, and identity information including government-issued documents (e.g. national IDs, driver's licences and passports); lawful safeguard: UK Data Transfer Addendum / IDTA (per the Stripe DPA, stripe.com/gb/legal/dpa).
Airtable (USA) — provides the database used to manage provider details, guest enquiries, bookings, availability information and operational records; Airtable bases may be shared with Luxury Cotswold Rentals where required to facilitate bookings, manage properties, coordinate guest stays and provide operational support; Identity Data, Contact Data, Booking Details, Enquiry Details, Property Information, Availability Information and Internal Operational Notes; lawful safeguard: UK IDTA or UK Addendum to EU SCCs.
Resend (USA) — sending transactional communications, including booking confirmations, account notifications, verification emails, sign-in links and other service-related communications; Names, Email Addresses, Booking Details, Account Information and Communication Metadata; lawful safeguard: UK IDTA or UK Addendum to EU SCCs.
Slack (USA) — internal team communications and operational notifications relating to enquiries, bookings, customer support and platform administration; Names, Contact Details, Booking Details, Enquiry Information and Communication Content; lawful safeguard: UK IDTA or UK Addendum to EU SCCs.
Twilio, including WhatsApp (USA) — sending booking notifications, alerts and operational communications to providers and, where applicable, users; Names, Telephone Numbers, Booking Details and Communication Records; lawful safeguard: UK IDTA or UK Addendum to EU SCCs.
Google Analytics (USA) — analysing website usage, monitoring performance, measuring engagement and improving our services and website functionality; Technical Data, Device Information, IP Address, Usage Data, Website Interaction Data and Booking Event Information; lawful safeguard: UK IDTA or UK Addendum to EU SCCs.
Google Calendar (USA) — synchronising provider availability and booking schedules; Availability Information and Calendar Data, including provider free/busy status; lawful safeguard: UK IDTA or UK Addendum to EU SCCs.

Your calendar information (experience providers)

If you choose to connect a calendar to your Boon listing — either by signing in with Google or by giving us a calendar link — we use it for one purpose only: to stop guests booking you when you are already busy.

What we collect: when you connect with Google, we only ever ask Google when you are busy. We cannot see what your events are called, what they contain, or who is in them. When you give us a calendar link instead, we read the events in that calendar feed solely to work out your busy times. In both cases we store your connection details securely and never display them to anyone.

What we do with it: we check your calendar regularly and mark your busy times as unavailable on your Boon listing. That is the only use. We do not share your calendar information with anyone else, we do not use it for advertising, and we never sell it.

Your control: you can disconnect your calendar at any time from your listing settings. When you disconnect, we delete the stored connection details and remove the unavailability we created from it. If you connected with Google, you can also withdraw Boon's access at any time from your Google account's security settings.

Boon's use of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Data security

The confidentiality of your information is important to us and we use all reasonable physical, technical and organisational measures to safeguard the personal data you provide to us. Unfortunately, the data transferred or stored by Boon cannot be completely secure or error free. Therefore Boon cannot guarantee the security of information you submit via the Site or Service; as a result any such submission is at the user's own risk.

Data retention

We retain your data only as long as necessary for legal, regulatory, or business purposes. Personal data related to transactions is retained for at least six years for tax purposes.

Your legal rights

You have rights regarding your personal data, including:

the right to access, edit, or erase your data held by us
the right to object to or restrict processing held by us
the right to withdraw consent for marketing communications
the right to request information that we transfer to a third party

Contact details and opting out

For questions regarding your legal rights listed above in this privacy policy or around our privacy practices, please contact:

Full name of legal entity — Downtime Limited
Email address — george@boon.club
Postal address — 128 City Road, London, United Kingdom, EC1V 2NX
Telephone number — 07516 684441

You have the right to make a complaint to the Information Commissioner's Office (ICO) at any time, the UK supervisory authority for data protection (ico.org.uk). However, we would appreciate the chance to resolve your concerns before you approach the ICO, so please contact us first.

Third-party links

Our website may contain links to third-party websites, applications, or services. These third parties may collect or share data about you, and we do not control their privacy policies. We encourage you to read the privacy policy of any third-party websites you visit.

Policy changes

We regularly review and update this privacy policy. It is important that the personal data we hold about you is accurate and up-to-date. Please inform us of any changes during our relationship.