Version 1, 10 November 2026

Data Processing Agreement

1. About this agreement

1.1 This Data Processing Agreement ("DPA") forms part of our Terms. It applies when you use the Services and we process personal data on your behalf. It is accepted when you sign up for, or continue to use, the Services. You are "you" or the "Customer"; we are Booking Connect Ltd, company number 16513326, registered at 185 Ivydale Road, London SE15 3DX ("we", "us" or the "Processor").

1.2 In this DPA, "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and any other law about personal data that applies to the processing. "controller", "processor", "personal data", "personal data breach", "processing", "data subject" and "supervisory authority" have the meanings given in the UK GDPR.

1.3 "Customer Personal Data" means the personal data about your customers, clients and staff that we process on your behalf in providing the Services. It does not include the personal data about you and your account users that we use to run your account. For that, we are a controller and our Privacy Policy applies.

1.4 The details of the processing are in Annex A, our security measures are in Annex B, and our sub-processors are in Annex C.

2. Our roles

2.1 For Customer Personal Data, you are the controller and we are your processor.

2.2 You are responsible for your compliance with Data Protection Law as controller. In particular you must: have a lawful basis for the processing; give your customers and staff the information they are entitled to; keep the data you give us accurate; make sure your instructions comply with the law; and not send us special category or criminal offence data or any data we do not need to provide the Services.

2.3 Phorest, Treatwell, Fresha, ClassPass and any other booking or calendar service you connect to Booking Connect are your own service providers. We exchange data with them on your instructions, using the credentials, links and settings you provide. They are not our sub-processors. Your agreements with them, and what they do with data, are your responsibility.

3. What we will do

3.1 We will process Customer Personal Data only on your documented instructions, including to provide the Services as described in the Terms and our website, and as you configure and use them. The Terms, this DPA and your use and settings of the Services are your complete instructions. We may refuse, or charge reasonable fees for, an instruction that goes beyond these.

3.2 We will tell you if we think an instruction breaks Data Protection Law. We may suspend the instruction until you confirm or change it. We may also process Customer Personal Data where the law requires us to, and will tell you first unless the law prevents us.

3.3 We will make sure the people who can access Customer Personal Data are bound by a duty of confidentiality.

3.4 We will keep Customer Personal Data secure using the appropriate technical and organisational measures in Annex B, taking into account the state of the art, the costs, and the nature, scope and risk of the processing. You are responsible for keeping your own login details, API credentials and devices secure.

3.5 Taking into account the nature of the processing, we will give you reasonable help, at your reasonable cost where the help goes beyond the normal operation of the Services, with: responding to requests from data subjects; your obligations about security, breach notification and data protection impact assessments; and prior consultation with a supervisory authority.

3.6 We will make available to you the information we reasonably hold that is needed to show we have complied with Article 28 of the UK GDPR. We will allow audits only as set out in section 9.

4. Data subject requests

4.1 If a data subject contacts us about Customer Personal Data, we will pass the request to you, and will not reply other than to say we have done so, unless the law says otherwise. You are responsible for responding.

4.2 Our dashboard lets you export your client list, and you can ask us to delete data as set out in section 7.

5. Sub-processors

5.1 You give us general written authorisation to use the sub-processors in Annex C, and to appoint others.

5.2 We will give you at least 15 days' notice of any new or replacement sub-processor, by email, through the app or on our website. If you object on reasonable data protection grounds during that time, and we cannot reasonably avoid the objection, you may stop using the affected Services and cancel. That is your only remedy for the change. Fees already paid for the period you have used are not refundable.

5.3 We will put a written contract in place with each sub-processor that requires it to protect Customer Personal Data to a standard that meets Article 28(4) of the UK GDPR. We are responsible to you for our sub-processors' compliance, subject to section 11.

6. International transfers and personal data breaches

6.1 Our sub-processors may process Customer Personal Data in the UK, the European Economic Area and the United States. Where data is transferred outside the UK, we will use a lawful transfer mechanism, such as the UK adequacy regulations (including the UK-US data bridge), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You authorise those transfers.

6.2 If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay and, where practicable, within 72 hours. We will give you the information we have so you can meet your own obligations. You are responsible for deciding whether to notify the supervisory authority and data subjects. Our notice, or our help, is not an admission of fault or liability.

7. Deletion and return of data

7.1 On your written request (an email to support@booking-connect.com from the address registered to your account is enough) we will delete the Customer Personal Data you identify, or all of it, within 30 days of receiving the request. We will confirm in writing when it is done. This includes copies of notification emails, and of the booking emails attached to them, held in our internal mailbox. We may ask you to confirm who you are first. We will not delete data we are required by law to keep, and will tell you if so.

7.2 When your account is closed, or the Services end for any reason, we will delete all Customer Personal Data within 30 days, unless you ask us to keep it, or the law requires us to. We recommend that you export your client list from the dashboard before then. We will also give you a copy in a common format on request, if it is reasonably practicable.

7.3 Copies in our backups are deleted in the ordinary course of the backup cycle, and in any event within 90 days. Until then we will keep them secure and will not use them.

7.4 Deleting data from Booking Connect does not delete it from Phorest, Treatwell, Fresha, ClassPass or any other service you use. You are responsible for that.

7.5 We may keep anonymised or aggregated information that does not identify any person, and the records we need to show that we complied with this DPA and the law.

8. Your instructions and responsibility for them

8.1 You are responsible for the instructions you give us, for your use of the Services and for your customers' data. You will compensate us for any losses, fines, costs and claims we suffer because you breached this DPA or Data Protection Law, or because we followed your instructions.

9. Audits

9.1 We will answer reasonable written questions about our processing and our security. We will make available documents we reasonably hold, such as summaries of our security measures.

9.2 If that is not enough to show our compliance, or a supervisory authority requires it, you may audit us once in any 12 months. You must give us at least 30 days' notice, agree the scope and timing with us, use an independent auditor who is bound by confidentiality, carry out the audit during working hours without disrupting our business, and bear the costs of the audit and our reasonable costs of helping. An audit will not give you access to other customers' data or to our systems or information that are not needed to check our compliance.

10. How long this agreement lasts

10.1 This DPA applies for as long as we process Customer Personal Data, including during the deletion period in section 7. Sections that are intended to continue (including sections 8 and 11 and section 12) will continue after that.

11. Liability

11.1 Each party's liability under or in connection with this DPA is subject to the exclusions and limits in the Terms. Those limits apply in total to all claims under the Terms and this DPA together, and are not additional to them.

11.2 In particular, our total liability to you under or in connection with the Terms and this DPA, however it arises, is limited to the subscription fees you paid us in the 12 months before the event that led to the claim, or £100 if you have not paid any.

11.3 We are not liable for loss of profit, revenue, business, goodwill or anticipated savings, or for any indirect or consequential loss, under or in connection with this DPA.

11.4 Nothing in this DPA limits liability that cannot lawfully be limited, including liability for death or personal injury caused by negligence, or for fraud. Nothing in this DPA limits the rights of data subjects. As between you and us, each of us is responsible for the part of any compensation paid to a data subject that matches our share of the responsibility for the damage, as set out in Article 82 of the UK GDPR.

12. General

12.1 If this DPA and the Terms conflict about the processing of Customer Personal Data, this DPA applies. In every other respect, including liability, the Terms apply.

12.2 We may update this DPA in the way the Terms allow us to change them, and immediately if the law, or a supervisory authority, requires.

12.3 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

12.4 You can contact us about this DPA at support@booking-connect.com, which is also our data protection contact.

Annex A: Details of the processing

Subject matter and purpose. Keeping your booking systems in step, as described in our Terms and on our website. This includes receiving booking emails, creating, changing and cancelling appointments and breaks in your booking software, publishing calendar feeds of availability, sending you notifications about bookings and the health of the Services, and exporting your client list at your request.

Duration. For as long as you use the Services, plus the deletion period in section 7.

Nature of processing. Receiving, storing, organising, matching, transmitting and deleting data.

Types of personal data. For your customers: name, email address, telephone number, booking details (service, date and time, price, assigned staff member) and the booking email we are sent. A customer record identifier from your booking software. For your staff: names and availability.

Categories of data subjects. Your customers and clients, and your staff.

Special category data. We do not need it and you must not send it to us.

Annex B: Security measures

We use appropriate technical and organisational measures, including:

• Your Phorest API login is encrypted before it is stored.

• Data is held against your account, and the database enforces access rules so that users can only reach their own account's data.

• Access to the production systems and data is limited to the administrators who need it, and uses authenticated accounts.

• We use encrypted (HTTPS) connections between you, our service and the booking services we connect to.

• The health of the service is monitored, and failed or stuck processing is flagged to us.

• We use reputable infrastructure providers (Annex C) that maintain their own security measures.

We may change these measures if the protection they give is not reduced.

Annex C: Sub-processors

• Supabase Inc: database hosting, in the London region (AWS eu-west-2).

• Vercel Inc: application hosting. Our application runs in Vercel's London region. Vercel's global network may also handle requests, and Vercel Inc is a US company.

• Amazon Web Services (AWS): sending and receiving email.

• Microsoft: our email service, which holds copies of the notification emails we send you (these can include booking details and the original booking email) and our correspondence with you.

Other suppliers do not process Customer Personal Data for us. Stripe processes your payment details for billing and acts for itself as a controller. Our content publishing service does not hold Customer Personal Data.