Privacy notice
Last updated [not yet published]
Draft for review. This page hasn't been checked by a solicitor yet, and anything in square brackets still needs filling in. It isn't in force until it's published without this notice.
Who we are
Sittings is run by [Company name] Ltd, a company registered in England and Wales (company number [number]), with its registered office at [registered office address]. We're registered with the Information Commissioner's Office, registration number [number]. You can contact us about anything in this notice at [contact email].
Two kinds of personal data
Data about the businesses that use Sittings, and their staff. We decide how and why this is used, so we're the controller for it.
Data a business keeps about its own clients. When a salon, barbershop, nail studio or clinic stores details about its clients in Sittings, such as names, contact details, appointments, notes, consultation forms and purchases, that business is the controller. We process the data on its behalf and only on its instructions, under our data processing agreement. If you're a client of one of these businesses and want to use your data rights, contact the business first. We'll help them respond.
What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Business details: name, address, contact name, email and phone | To set up and run your account and contact you about it | Contract |
| Staff logins: name, email, phone number, what each person can access, sign-in times | To let your team sign in securely, send two-factor sign-in codes, and keep a record of changes | Contract, and legitimate interests in keeping accounts secure |
| Billing: your plan, invoices and payment status | To charge for the service and keep financial records | Contract, and legal obligation for tax records |
| Message usage: how many texts and emails your account sends | To bill for texts beyond your plan's allowance | Contract |
| Technical data: IP address, browser type and request times in server logs | To keep the service secure and fix problems | Legitimate interests |
| Messages you send us | To answer your enquiry | Legitimate interests |
| Demo requests: your name, business, email, phone, type of business, the times that suit you and anything you tell us | To arrange and run the demo you asked for, and to follow up afterwards | Legitimate interests, and steps you asked us to take before a contract |
We don't hold card numbers. Card details are collected and stored by our payment provider.
Cookies
This website doesn't set cookies and doesn't use analytics or advertising trackers. It remembers which kind of business you picked in your browser's session storage until you close the tab, and that never leaves your browser. The Sittings app uses cookies only to keep you signed in. These are strictly necessary for the service to work, so they don't need your consent.
Who we share it with
We use these providers to run the service. Each one only gets what it needs for its job.
| Provider | What for | Where |
|---|---|---|
| Our cloud hosting provider | Hosting the service, its database and backups | London, UK |
| Our payment provider | Deposits that clients pay when booking online, and our own subscription billing | UK, EU and United States |
| Our SMS and WhatsApp provider | Sending text and WhatsApp messages, including appointment reminders and sign-in codes | United States |
| Our email delivery provider | Sending emails, such as reminders, receipts and password resets | United States |
| Our error-monitoring service | Error reports when something in the app goes wrong, so we can fix it. Passwords are removed before a report is sent. | EU (Germany) |
The current list of our sub-processors, with their names, is available on request from [contact email].
We don't sell personal data, and we don't share it for advertising.
International transfers
Some of these providers process data in the United States. Where they do, the transfer is covered by the UK extension to the EU-US Data Privacy Framework or by the UK International Data Transfer Addendum to the provider's standard contractual clauses.
How long we keep it
- Account and client data: while the account is open, and for 90 days after it closes so the business can ask for a copy. Then we delete it.
- Backups: taken every night. Copies on our server are deleted after 14 days, and the off-site copies (also kept by our cloud hosting provider in London) after 35 days.
- Billing records: six years, as UK tax law requires.
- Server logs: [number] days.
- Demo requests: 6 months after we were last in touch, unless you become a customer. Ask us and we'll delete yours sooner.
- Anything typed into one of the demo businesses: deleted when the demo resets overnight.
How we protect it
- All connections use HTTPS, and data is stored in London.
- Each business's data is kept separate from every other business's.
- Payment provider credentials are stored encrypted.
- Staff accounts can use two-factor sign-in, and admins control what each person can see.
- Access to the production systems is limited to [who].
Your rights
Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, ask us to restrict or stop using it, and ask for it in a format you can take elsewhere. Email [contact email] and we'll reply within a month.
If your data is held by a business that uses Sittings, ask that business. Businesses can download a copy of a client's data, or erase a client or a member of staff, from within the app, and we help them if they need it.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
We'll update this page and the date at the top when anything changes. If a change is significant, we'll also email account holders.