Effective from 5 November 2026
This agreement is part of the BookUp Business Terms. It covers the personal information BookUp handles for a business about its Clients and Staff. It meets the requirements of Article 28 of the UK GDPR. Words defined in the Business Terms have the same meaning here.
1.1 You are the controller of Client Data. We are your processor.
1.2 We are a controller in our own right for some information, such as your account and billing details, the BookUp booking fee, and customers' BookUp accounts. Our Privacy Notice covers that information, and this agreement doesn't.
2.1 We only process Client Data to provide BookUp to you, as described in Annex 1, and on your documented instructions. Your use of BookUp's features counts as an instruction.
2.2 If the law requires us to process Client Data in another way, we will tell you first unless the law forbids it.
2.3 We will tell you if we think an instruction breaks data protection law.
Only people who need access to Client Data to provide or support BookUp can get to it. They are bound to keep it confidential.
We use the technical and organisational measures in Annex 2 to protect Client Data. We may update them as long as they stay at least as protective.
5.1 You give us general permission to use the sub-processors in Annex 3.
5.2 We will tell you at least 30 days before we add or replace a sub-processor, by email or in BookUp. If you have a reasonable data protection objection, tell us within that time and we will try to resolve it. If we can't, you can end the Business Terms without penalty.
5.3 Each sub-processor is bound by a written contract with data protection terms at least as protective as this agreement. We remain responsible for them.
Some sub-processors handle Client Data outside the UK. Where a country doesn't have a UK adequacy decision, we use a lawful transfer safeguard. This will be the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
7.1 If a Client asks to see, correct, delete or move their information, you can do most of this in BookUp. Where you can't, we will help within a reasonable time. If a Client asks us directly, we will pass the request to you.
7.2 We will give you reasonable help with data protection impact assessments and with questions from the Information Commissioner's Office, as far as they relate to BookUp.
If we become aware of a personal data breach affecting Client Data, we will tell you without undue delay, and within 48 hours. We will give you the information you reasonably need to meet your own duties, and take reasonable steps to contain it.
9.1 You can ask for a copy of your Clients and bookings within 30 days after the Business Terms end.
9.2 After that, we will delete Client Data from our live systems within 90 days. Copies in any backups are deleted as those backups expire. We keep payment and tax records for as long as the law requires.
We will give you the information you reasonably need to show we are meeting this agreement. If that isn't enough, you can audit us once a year, with 30 days' notice and at your cost, in a way that protects other customers' data.
The liability limits in the Business Terms apply to this agreement.
| Item | Details |
|---|---|
| Purpose | Providing BookUp: bookings, scheduling, payments, client records, forms, messages, marketing, reviews, reporting and support |
| Duration | While the Business Terms last, and until deletion under section 9 |
| People | Your Clients and their dependants (including children), your Staff, and people who send you enquiries |
| Personal data | Name, email, phone, date of birth, gender, address, profile photo, booking and payment history, saved-card details (brand, last 4 digits, expiry), memberships, credits and gift cards, notes, messages, enquiry photos, form answers and signatures, marketing history, and staff shifts and holidays |
| Special category data (if you collect it) | Health information in forms and notes, skin type and patch test results, and photos that could reveal health or ethnic origin |
| Sub-processor | What it does | Where the data is | Safeguard |
|---|---|---|---|
| Google (Firebase and Google Cloud) | Hosting, database, file storage, sign-in, app notifications, maps | UK (London) and EU (Belgium, EU multi-region). Notifications and maps may use the US | UK adequacy for the EU; UK Extension to the Data Privacy Framework for the US |
| Stripe | Payments, saved cards, memberships, in-person payments | UK, EU and US | UK Extension to the Data Privacy Framework |
| Twilio SendGrid | Sending emails, including open and click tracking | US | UK Extension to the Data Privacy Framework |
| Meta (WhatsApp Business Platform) | Sending WhatsApp messages | US and other countries | UK Extension to the Data Privacy Framework |
| Algolia | Client search for businesses | EU or US | UK adequacy for the EU; UK International Data Transfer Agreement or Data Privacy Framework for the US |
| Supabase | Records of WhatsApp messages sent, including phone numbers | EU or US | UK adequacy for the EU; UK International Data Transfer Agreement or Data Privacy Framework for the US |
| Sentry (Functional Software) | Error monitoring, including screen replays when an error happens | EU (Germany) | UK adequacy for the EU |
| Chatwoot | Support chat and its AI help assistant | EU or US | UK adequacy for the EU; UK International Data Transfer Agreement or Data Privacy Framework for the US |
| Anthropic | Cadger, the AI assistant: the questions your staff ask it and the details it looks up to answer them, such as bookings, Clients and their contact details. Not used to train AI models | US | UK Addendum to the EU Standard Contractual Clauses |
| Slack (Salesforce) | Messages from your staff to the BookUp founders and the founders' replies, including feedback on Cadger's answers | US | UK Extension to the Data Privacy Framework |