Privacy policy

This policy explains how BookSpace (bookspace.my) handles personal data for everyone who uses the platform — customers who book or ask us to source an event business, hosts who list spaces, and providers who list services. It applies to the website and to the transactional emails we send.

BookSpace is operated by Core Space Network (Registration No. 202603207241 / MA0350684-T). We handle personal data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA). Core Space Network is the data user for BookSpace; the service providers named below process data only for the functions described.

Account details — Your name, email address, password (stored only as a bcrypt hash, never in readable form), and optionally your phone number. We record when your email was verified, when you last signed in, and when your password last changed, so that a password change can sign out other sessions.

Listing content — For venue partners and service vendors: business name, listing descriptions, addresses, capacity and pricing, and the photographs you upload.

Verification and payout details — For venue partners and service vendors being verified: a contact name, phone, email and address, plus the bank name, account holder name, and account number we need in order to pay you. These are visible only to you and to our administrators, and are never shown on a public listing.

Booking records — The bookings you make or receive, their dates, times, guest counts, prices, deposits, add-ons, statuses, payouts, reviews, and any dispute you open.

Event sourcing requests — If you ask BookSpace to find a venue or vendor, we collect your name, email, event type, optional event date, location, optional estimated guest or unit count, optional estimated budget, and the requirements you write in the form. We do not ask for a phone number on this form and contact you by email. An account is not required. If you are signed in, the request may be linked to your account; a guest request is not attached to an account merely because its email address matches one.

Messages — Messages exchanged between customers, hosts, and providers through the platform’s inbox. Our administrators can access these where needed to investigate a dispute or a safety report.

Technical data — Standard server logs and first-party product analytics. We use a random visitor identifier and an acquisition-source cookie to measure page views and actions such as starting signup, viewing a listing, checking availability, contacting a partner, and starting or completing a booking. Where you are signed in, an event may also be linked to your BookSpace account. We do not store IP address, user agent, email, phone, messages, or payment details in these analytics events, and we do not build a cross-site advertising profile.

We use personal data only to run the platform:

• to create and secure your account, and to verify your email address;
• to show listings, calculate availability and pricing, and record bookings;
• to take payment, calculate our processing fee, and pay hosts and providers;
• to send transactional email — booking confirmations, approvals, cancellations, verification and password-reset codes;
• to let the two sides of a booking message each other;
• to review event sourcing requests, identify potentially suitable venues or vendors, contact those businesses with a non-identifying brief, and make an introduction where the customer permits it;
• to review verifications and listing applications, and to investigate disputes, fraud, and abuse;
• to understand how people use BookSpace and improve search, listings, signup, and booking flows;
• to keep the records we are required by law to keep.

We do not sell personal data or use it for advertising, cross-site tracking, or targeted advertising.

We rely on a small number of service providers, each handling only what their function requires:

• CHIP — our primary payment gateway. Billplz may be used only where it is selected as the payment gateway for a checkout. You enter card or online-banking details on the gateway’s own secure page; we receive only the amount and transaction reference.
• DigitalOcean — production hosting, database infrastructure, and listing-photo storage for the platform.
• Resend — delivery of transactional email.

Beyond these, we disclose personal data only where the law requires it, where it is necessary to establish or defend a legal claim, or where you ask us to make an event-sourcing introduction. A booking necessarily shares the details needed to honour it — your name and booking details reach the host or provider, and theirs reach you.

For a sourcing request, we may first approach BookSpace listings or other event businesses using an anonymised brief containing details such as the event type, date, city, guest count and budget. We do not give businesses your email address as part of that initial approach. We share your name or email with a suitable selected business only after obtaining your permission. The business then handles any data it receives under its own privacy obligations.

The providers above operate infrastructure outside Malaysia, so your personal data may be stored or processed abroad. We only use providers that offer contractual protections consistent with the standard the PDPA requires, and we transfer no more than the service needs.

If a venue partner or service vendor chooses to connect Google Calendar, BookSpace accesses only the Google data needed to provide the calendar-sync feature they requested.

What we access — We read the names and identifiers of calendars the connected Google account owns so the user can choose one. For the selected calendar, we read event identifiers, status, transparency, and start and end times to determine when the partner is unavailable. We also create, update, and delete calendar events that represent confirmed BookSpace bookings. BookSpace does not store titles, descriptions, locations, attendees, or attachments from the user’s existing Google events.

How we use and store it — Existing Google events are converted only into unavailable time ranges in BookSpace. Customers and other partners can see that a time is unavailable, but cannot see which Google event caused it or any event details. We store the selected calendar identifier and name, encrypted OAuth refresh token, synchronization cursor, BookSpace-created Google event identifiers, and the start and end times of imported busy periods. OAuth tokens are encrypted at rest and are not exposed to customers or partners.

What BookSpace sends to Google — To create or update a BookSpace-managed calendar event, we send Google the booking time, the relevant venue resource or service name, the booking location or address where available, and a BookSpace management link. We do not add customer contact details, payment details, messages, guest lists, or private notes to those Google Calendar events.

Who we share it with — We do not sell Google user data, use it for advertising, or disclose it to customers, venue partners, service vendors, payment providers, or email providers. The limited stored data described above is processed only by BookSpace and our contracted hosting and database infrastructure providers, solely as needed to operate and secure calendar synchronization. Those providers act on our instructions and may not use the data for their own purposes. We disclose it otherwise only if required by law.

Control and deletion — Calendar connection is optional. The user can disconnect it from BookSpace at any time. Disconnecting revokes BookSpace’s Google access, removes imported busy periods and stored connection data, and removes calendar events created by BookSpace where Google still permits that cleanup. It does not alter the user’s own Google events.

BookSpace’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Account, listing, and message data is kept while your account is open. Booking, payment, and payout records are kept for seven years after the booking for tax and accounting record-keeping. First-party analytics events are kept only as long as needed to measure and improve BookSpace, then deleted or aggregated.

Event sourcing requests are kept while we work on them. We retain the operational record for up to 12 months after it is closed so we can follow up and resolve questions, then remove the customer's contact identity. Non-identifying information such as event type, location, budget band and outcome may be kept in aggregate to understand demand and improve marketplace supply.

When you close your account we delete or anonymise what we are not required to retain. Records tied to a completed booking, an unresolved dispute, or a legal obligation are kept for the periods above, even after closure.

Passwords are hashed with bcrypt and are never stored or logged in readable form. Traffic is encrypted in transit. Changing your password immediately invalidates every other signed-in session. Access to verification and payout details is limited to administrators who need it. No system is perfectly secure, so if a breach ever affects your personal data we will tell you and the relevant authority promptly.

Under the PDPA you may:

• ask for a copy of the personal data we hold about you;
• correct anything inaccurate or out of date — most of it you can edit yourself in your account;
• ask us to delete data we no longer have a lawful reason to keep;
• limit how we process it, or withdraw a consent you previously gave;
• object to receiving non-transactional email.

Email support@bookspace.my and we will respond within 21 days. We may need to confirm your identity before acting on a request.

We use cookies to keep you signed in, remember interface preferences such as your theme and language, and operate first-party analytics. The bookspace_visitor and bookspace_source cookies hold a random visitor identifier and first acquisition source for up to one year. They are secure, HttpOnly, same-site cookies used only by BookSpace; they are not advertising or third-party tracking cookies. Blocking the sign-in cookie will prevent you from staying logged in.

BookSpace is not intended for anyone under 18 and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

We will update this policy as the platform changes. The effective date at the top always reflects the current version. If we change how we access, use, store, or share Google user data, we will update this notice and obtain any consent required before using Google data in the new way.

Core Space Network’s BookSpace Privacy Team handles privacy questions and requests. For any question about this policy, or to exercise any of the rights above, email support@bookspace.my. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia.