Data Processing Agreement

1. Scope and parties

This agreement forms part of the Terms of Service between the merchant (the “controller”) and SMB Booking (the “processor”) and applies to personal data of the merchant's customers that we process to provide the service (Article 28 GDPR). It takes effect when the merchant accepts the Terms.

2. Details of the processing

• Subject matter and purpose: providing the booking, payment and client-management service to the merchant.
• Duration: for as long as the merchant has an account, plus the deletion period in section 8.
• Nature of processing: storing, organising, transmitting (for example confirmation emails) and deleting data.
• Categories of data subjects: the merchant's customers and prospective customers.
• Types of personal data: name, email address, optional phone number, booking, waitlist, package and gift card history, payment status, and notes the merchant adds.

3. Our obligations

• We process personal data only on the merchant's documented instructions, which are these terms and the merchant's use of the service, unless the law requires otherwise (in which case we tell the merchant first, where lawful).
• We make sure everyone authorised to process the data is bound by confidentiality.
• We apply appropriate technical and organisational security measures (section 4).
• We assist the merchant, taking into account the nature of processing, in responding to data subject requests. The dashboard offers per-client export and deletion.
• We assist the merchant with security, breach notification, impact assessments and prior consultation where the merchant needs it and we hold the relevant information.

4. Security measures

• Encryption of data in transit (HTTPS/TLS).
• Passwords stored only as salted hashes; session tokens stored hashed.
• Access to production systems limited to authorised staff, with key-based authentication.
• Data segregated per merchant at application level.

5. Personal data breaches

We notify the merchant without undue delay after becoming aware of a personal data breach affecting their customers' data, with the information we have to help the merchant meet its own notification duties.

6. Subprocessors

The merchant gives general authorisation for the subprocessors listed on the subprocessors page. We bind each one to data protection obligations no less protective than these, and remain responsible for them. We give at least 30 days' notice of new or replacement subprocessors, and the merchant may object on reasonable data protection grounds; if we cannot resolve the objection the merchant may close their account.

7. International transfers

Where personal data is transferred outside the EEA, we ensure a valid transfer mechanism is in place, such as an adequacy decision or the EU standard contractual clauses.

8. Return and deletion

On account closure, or on request, we delete the merchant's customer data within 30 days, except where the law requires us to retain it, and the merchant can export it beforehand from the dashboard. Backups are overwritten in the normal cycle.

9. Audits

We make available the information needed to show compliance with Article 28 and allow for audits by the merchant or an auditor they appoint, on reasonable notice, during business hours and without disrupting the service. We may satisfy a request first by providing written answers or available reports.

10. Merchant responsibilities

The merchant is the controller: it must have a lawful basis for collecting its customers' data, give customers the required privacy information, obtain any consent needed for marketing messages, and not instruct us to process data unlawfully.

11. Contact

[set NEXT_PUBLIC_LEGAL_EMAIL]