Data processing agreement
Draft. This is being finalised and reviewed before launch. Details in [square brackets] will be filled in.
This agreement forms part of the terms of service. It covers the personal data of the salon's customers that Alex Rose, trading as Groomer’s Day (the "processor") handles for the salon (the "controller"), as UK GDPR Article 28 requires.
1. What is processed
| Purpose | Providing Groomer’s Day: diary, client records, online booking, client forms, photos, payments records, reports and emails to the controller's customers |
| People | The controller's customers (dog owners), their emergency contacts, and the controller's staff |
| Data | Names, mobile numbers, emails, home addresses, dog details including health and behaviour notes, vet details, booking and payment history, signatures on client forms, photos |
| Special category data | None intended. Health notes are about dogs, not people. The controller must not record owners' health details |
| How long | For the length of the agreement, then deleted as in section 8 |
2. The processor's duties
The processor will:
- only process the data on the controller's documented instructions (these terms, and how the controller uses Groomer’s Day), unless the law requires otherwise, in which case it will tell the controller unless the law forbids it;
- make sure everyone who can access the data is bound to keep it confidential;
- keep the data secure (section 4);
- only use sub-processors as set out in section 5;
- help the controller answer requests from people exercising their rights, including through the app's tools to view, correct, export and delete records;
- help the controller with security, breach notification and data protection impact assessments, as far as is reasonable;
- delete or return the data when the agreement ends (section 8);
- give the controller the information needed to show this agreement is being followed, and allow reasonable audits with [30 days] notice, at the controller's cost.
3. The controller's duties
The controller is responsible for having a lawful basis for the data, for telling its customers how their data is used, for getting photo consent, and for the accuracy of what it enters.
4. Security
- Encryption in transit (HTTPS) and at rest.
- Database rules so each salon can only read and write its own data, tested on [date].
- Passwords stored by Supabase Auth with strong hashing; minimum length 8.
- Staff logins can only do what the salon owner allows, and this is checked by the database.
- Support staff can only see a salon's data while the salon has turned on support access. Access is view-only unless the salon allows changes, and every visit and change is logged for the salon to see.
- Access to production systems limited to named Groomer’s Day staff, with strong authentication.
- [Backups: frequency and retention to confirm with the Supabase plan.]
5. Sub-processors
The controller agrees to these sub-processors. The processor will give [30 days] notice of any new one, by email. The controller can object, and if no solution is found, can end the agreement.
| Sub-processor | Service | Data location | Transfer safeguard |
|---|---|---|---|
| Supabase Inc | Database, authentication, file storage | London, UK (eu-west-2) | [Confirm: UK IDTA / Data Bridge for support access from outside the UK] |
| Vercel Inc | Hosting the app and booking pages | [Confirm] | [Confirm] |
| Resend | Email delivery | [Confirm] | [Confirm] |
| Stripe (when payments start) | Payment processing | [Confirm] | [Confirm] |
The processor stays responsible to the controller for its sub-processors' work.
6. International transfers
The processor will only transfer personal data outside the UK with appropriate safeguards: a UK adequacy regulation (including the UK–US Data Bridge for certified US companies) or the UK International Data Transfer Agreement or Addendum.
7. Personal data breaches
The processor will tell the controller without undue delay, and within [48 hours] of becoming aware of a breach affecting the controller's data. It will include what is known about what happened, what data and how many people are affected, and what is being done. The controller decides whether to report to the ICO within 72 hours.
8. When the agreement ends
The controller can download its data at any time. Within [30 days] of the account closing, the processor deletes the controller's data from the live system, and from backups within [90 days], unless the law requires it to be kept.
9. Liability
The liability limits in the terms of service apply to this agreement, except where the law does not allow it.