Data processing agreement

Who this agreement covers

This data processing agreement ("DPA") is part of the Fairlybook terms of service. It applies to every business with a Fairlybook account, and the business accepts it by accepting the terms. No signature is needed. Here, "you" means the business and "we" or "us" means Fairlybook.

For the personal data your business collects and manages in Fairlybook, such as your customers' booking details, you are the controller and we are your processor. This agreement sets out the processor terms required by Article 28 of the GDPR and the UK GDPR, and by similar data protection laws.

We are responsible ourselves for the personal data of visitors to our website and for the account and sign-in details of people with a Fairlybook account, as described in our privacy policy.

What we process, for how long and why

• Subject matter: the personal data that you, your team and your customers enter into Fairlybook while you use it.
• Purpose: to provide the booking service described in the terms: booking pages, the calendar, confirmation and reminder messages, team accounts, calendar sync and reviews.
• Nature: we store, organise, show, send and delete this data as the service needs. We never sell it and we don't use it for advertising.
• Duration: for as long as you use Fairlybook, until the data is deleted as described under "Deletion and return of data".

Types of personal data and people concerned

The people concerned are your customers, meaning the people who book with you, and your team members.

• Customers: name, email address and phone numbers if given; booking details such as the service, team member, time and time zone, notes and the booking's history; reviews they leave after a visit; and their email preferences.
• Team members: the names, photos and profiles you add, working hours and, if they connect a calendar, its busy times. We don't store event titles or attendees.

Notes are free text, so you decide what goes in them. Don't ask for sensitive data, such as health details, unless you need it and have a lawful basis for it.

Processing only on your instructions

We process this personal data only on your documented instructions. Those instructions are the terms, this agreement, and what is set up and done in your Fairlybook account, such as settings and bookings.

We process it in any other way only if the law requires it. In that case we will tell you first, unless the law forbids that.

If we believe an instruction breaks data protection law, we will tell you.

To run and improve Fairlybook, we also count how features are used with pseudonymous events, such as "a booking was created", as our privacy policy describes.

Confidentiality

Only people working for Fairlybook who need access to run, support or secure the service can access personal data, and each of them is bound by confidentiality.

When our support team looks at a business's data, the access is time-limited, read-only by default and logged.

Security measures

We protect personal data with technical and organisational measures suited to the risk, including:

• encryption in transit: connections to Fairlybook use HTTPS;
• calendar connection tokens encrypted at rest;
• each business's data isolated from every other business at the database level;
• role-based access for your team, and two-step verification available to every user and required for our own staff;
• rate limits, and bot checks on booking forms;
• logs that record IDs, not personal data such as names, email addresses or phone numbers, and error reports with personal data removed;
• an audit log of changes and privileged actions.

We review these measures as the service changes.

Subprocessors

You give us general authorisation to use subprocessors: the service providers that process personal data for us, such as hosting, the database and email delivery. The current list, with what each one does and where, is on our subprocessors page at fairlybook.com/legal/subprocessors.

We update that list before a new subprocessor starts processing personal data. If you object to a change for reasonable data protection reasons, email us. We will try to address your concern; if we can't, you can end this agreement by deleting your business.

We bind each subprocessor by a written contract to data protection obligations that protect personal data at least as well as this agreement, and we remain responsible to you for its work.

International transfers

Our database and servers run in the United States. Some subprocessors, such as email delivery, calendar sync or push notifications, may process data in other countries.

When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to the United States or another country, we rely on safeguards such as the European Commission's standard contractual clauses, with the UK and Swiss adjustments where needed. For transfers from you to us, you and we agree to those clauses by accepting this agreement. With our subprocessors, we use the same clauses or another lawful safeguard.

Helping with data subject requests

Fairlybook gives you tools to answer requests from your customers about their data:

• you can see and correct a customer's details in the dashboard;
• the business owner can export all business data, including customers and bookings, from Settings → Data & privacy;
• the business owner can delete the business there, and its customers' data is then permanently deleted after 30 days.

If a customer contacts us directly about their data, we pass the request on to you and don't answer it ourselves unless you ask us to or the law requires it. If a request needs more than these tools, such as erasing one customer's details, email us and we will help.

Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, by email to the business owner. We will share what we know, such as what happened, the data and people likely affected and what we are doing about it, and keep you updated as we learn more.

We will take reasonable steps to contain the breach and limit its effects, and help you meet your own duties, such as telling a data protection authority or the people affected.

Deletion and return of data

You can export your data at any time, including before you leave.

When you delete your business, it can be restored for 30 days. After that, its data, including your customers' data and uploaded images, is permanently deleted. Records we must keep for legal or security reasons are kept only as long as needed, without unnecessary personal data.

While you use Fairlybook, customer details are also erased automatically 24 months after a customer's last booking.

Audits and information

We will give you the information you reasonably need to show that we meet this agreement, such as this page, our privacy policy and our subprocessor list, and answer your reasonable questions about how we protect your data. This includes reasonable help with a data protection impact assessment or a consultation with a data protection authority.

If that isn't enough, or a data protection authority requires it, you can ask for an audit. It is carried out by you or an independent auditor bound by confidentiality, with reasonable notice, at a time and scope we agree, and in a way that doesn't expose other businesses' data.

How this agreement fits with the terms

This agreement is part of the terms of service. If the terms and this agreement disagree about personal data, this agreement applies. Where the standard contractual clauses apply, they take precedence over both.

Anything this agreement doesn't cover follows the terms.

Changes to this agreement

We may update this agreement, for example when the law or the service changes. If a change matters, we will tell account owners at least 30 days before it applies. If you keep using Fairlybook after that, the new version applies; if you don't agree, you can cancel and delete your business. The date at the top always shows the latest version.