Data processing agreement
Last updated [not yet published]
Draft for review. This page hasn't been checked by a solicitor yet, and anything in square brackets still needs filling in. It isn't in force until it's published without this notice.
This agreement is between [Company name] Ltd ("we") and the business using Sittings ("you"). It forms part of our terms of service and applies whenever we process personal data on your behalf. You're the controller of that data and we're the processor. If this agreement and the terms disagree about personal data, this agreement wins.
1. What we process for you
| Subject matter | Running Sittings for your business: the diary, client records, till, staff rotas, messages and online booking. |
|---|---|
| Duration | While your account is open, then up to 90 days after it closes. Backups that contain it are deleted within 35 days after that. |
| What we do with it | Store it, show it to the people you give logins to, send the texts and emails you set up, take deposits for online bookings, back it up, and keep the service secure. |
| Whose data | Your clients (including people who book online), your staff, and anyone else you add. |
| Types of data | Names, contact details, dates of birth, addresses, appointments, purchases, notes and tags, marketing consent, loyalty and membership details, staff rotas and earnings. Also health information you record, such as allergies, medical notes and consultation forms. |
Health information is special category data. If you record it, you need a lawful basis and an Article 9 condition for doing so, such as the client's explicit consent.
2. Only on your instructions
We only process your data to provide Sittings, as set out in the terms and in how you use the app. Your use of the app, such as adding a client or sending a campaign, counts as your instruction. We won't use your data for anything else, including our own marketing. If we think an instruction breaks data protection law, we'll tell you. If the law requires us to process your data in some other way, we'll tell you first unless the law forbids it.
3. Our people
Only people who need access to run or support the service can reach your data, and they're bound to keep it confidential.
4. Security
We protect your data with measures that include:
- HTTPS on every connection, and hosting in London.
- Your data kept separate from every other business's, checked on every request.
- Passwords stored only as salted hashes, and sign-in sessions held in secure, HTTP-only cookies.
- Permissions you set for each member of staff, and optional two-factor sign-in.
- An activity log of changes made in your account.
- Rate limits on sign-in and on the public forms.
- Payment provider credentials stored encrypted (AES-256-GCM).
- Nightly backups, kept on the server for 14 days and copied off-site (also in London) for 35 days, and tested by restoring them.
5. Sub-processors
You agree that we can use these providers to run the service:
| Provider | What for | Where |
|---|---|---|
| Our cloud hosting provider | Hosting the service, its database and backups | London, UK |
| Our payment provider | Deposits taken through online booking | UK, EU and United States |
| Our SMS and WhatsApp provider | Sending texts and WhatsApp messages | United States |
| Our email delivery provider | Sending emails | United States |
| Our error-monitoring service | Error reports, with passwords removed | EU (Germany) |
The current list of our sub-processors, with their names, is available on request from [contact email].
Each one is bound by a written contract with data protection terms at least as protective as these. We'll email you at least [30] days before adding or replacing one. If you object for a reasonable data protection reason, tell us within that time. If we can't resolve it, you can close your account without a penalty [and we'll refund any unused prepaid fees].
Where a provider processes data in the United States, the transfer is covered by the UK extension to the EU-US Data Privacy Framework or by the UK International Data Transfer Addendum.
6. Helping with requests from your clients and staff
If someone asks you for a copy of their data, or asks you to correct or delete it, you can do most of it yourself in the app: download a copy of a client's data, edit their record, or erase a client or a member of staff. If you need more help, ask us at [contact email]. If someone contacts us directly about data you hold, we'll pass the request to you and won't answer it ourselves unless you ask us to.
7. Data breaches
If we become aware of a breach affecting your data, we'll tell you without undue delay, and within 48 hours. We'll explain what happened, what data and how many people are likely to be affected, what we're doing about it, and who you can talk to. This gives you time to meet your own 72-hour deadline for reporting to the Information Commissioner's Office, if a report is needed. We'll keep you updated as we learn more.
8. Other help
We'll give you the information you reasonably need for a data protection impact assessment, or for a consultation with the ICO, about your use of Sittings.
9. When your account closes
Your account closes when a cancellation takes effect, or when it's suspended for an unpaid bill (see the terms). You can ask us for a copy of your data at any time while your account is open and for 90 days after it closes. After those 90 days we delete it, and the backups that contain it are deleted within the following 35 days. We keep billing records about your account for six years because UK tax law requires it, but they don't include your client records.
10. Showing we comply
We'll give you the information you reasonably need to show that we meet this agreement, and answer your written questions about it.
11. What you're responsible for
You decide what data to put into Sittings and why, so you're responsible for having a lawful basis for it, for telling your clients and staff how you use their data, for only sending marketing to clients who agreed to it, and for making sure your instructions to us are lawful.
12. Liability
The limits on liability in the terms of service apply to this agreement too.
Questions about this agreement: [contact email].