Data Processing Agreement

Version 1.0 · Effective from publication

This Data Processing Agreement ("DPA") forms part of the DetailBook Terms of Service (the "Terms") between:

• Jamie Butcher, a sole trader trading as DetailBook, 52 Bateman Road, Hellaby, Rotherham, South Yorkshire S66 8HB, United Kingdom ("DetailBook", "we", "us"); and
• the business that holds a DetailBook account ("the Detailer", "you").

It applies whenever we process Customer Personal Data on your behalf in providing the Services. If this DPA and the Terms conflict on data protection, this DPA wins.

1. Definitions

• Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended or replaced.
• Customer Personal Data means personal data about your customers, your prospective customers, visitors to your booking pages, and people they tell you about, that we process on your behalf in providing the Services. Annex 1 describes it.
• Services means the DetailBook booking, customer management, invoicing, messaging and related services, including importing customer data at your request.
• Sub-processor means a third party we engage to process Customer Personal Data for us.
• Personal Data Breach, controller, processor, data subject and processing have the meanings given in Data Protection Law.

2. Roles

2.1 For Customer Personal Data, you are the controller and we are your processor.

2.2 We are a controller for our own purposes. These include your account and login details, billing, support, security, fraud prevention, legal compliance and our own marketing. Our Privacy Policy describes that processing, and this DPA does not cover it.

2.3 Some services you contract for yourself and connect to DetailBook receive data on your instructions. They act as your processor, an independent controller, or both, under their own terms. They are not DetailBook's Sub-processors. Examples are your Stripe connected account, Google Calendar and Xero. Google Maps Platform is used under Google's controller terms and acts as an independent controller.

3. Your instructions

3.1 We process Customer Personal Data only on your documented instructions. Your instructions are: (a) this DPA and the Terms; (b) how you set up and use the Services, including connecting third-party services and sending messages; and (c) other documented instructions, such as a request to import a customer file. These must be consistent with this DPA and the scope of the Services. Where they need functionality or work not included in the Services, they must be agreed with us first.

3.2 This includes transfers outside the UK. We make them only as set out in section 9.

3.3 We will process Customer Personal Data without your instruction only where UK law requires it. Unless the law forbids it, we will tell you before we do.

3.4 We will tell you straight away if we think an instruction breaks Data Protection Law.

4. Your responsibilities and rights

4.1 You are responsible for having a lawful basis to collect Customer Personal Data and give it to us. You are also responsible for telling your customers how you use their data, including that you use DetailBook.

4.2 You must not use the Services to process special category data (for example health, ethnicity or religion) or criminal offence data. This includes free-text notes, photos and uploaded files. If any reaches us by accident, tell us and we will help you remove it.

4.3 When you ask us to import a customer file, you confirm you are entitled to give us that data for that purpose.

4.4 You are responsible for keeping your login details secure, and for the people you give access to your account, including team members.

4.5 You keep control of Customer Personal Data. You may exercise the rights set out in sections 3, 7, 8, 11 and 12. These include giving documented instructions, objecting to new Sub-processors, asking for help and compliance information, auditing our compliance, and choosing return or deletion when the Services end.

5. Confidentiality

5.1 At the date of this DPA, DetailBook is run only by Jamie Butcher. Any other person we later authorise to process Customer Personal Data will first be bound by an appropriate duty of confidentiality, by contract or by law.

5.2 We access Customer Personal Data only as needed to provide, support, secure or fix the Services, or to carry out your instructions. Examples are importing a file you uploaded, or investigating a problem you report. We do not disclose it to anyone who is not a Sub-processor listed in Annex 3, except where the law requires it.

6. Security

6.1 We take appropriate technical and organisational measures to protect Customer Personal Data, as UK GDPR Article 32 requires. Annex 2 describes the measures in place at the date of this DPA.

6.2 We may change these measures over time, but not in a way that materially lowers the overall level of protection.

7. Sub-processors

7.1 You give us general written authorisation to use the Sub-processors listed in Annex 3.

7.2 We will tell you at least 10 days before we add or replace a Sub-processor, by email or by a notice in your account. If a shorter period is needed to deal with an urgent security or service-continuity risk, we will tell you as soon as reasonably possible.

7.3 You may object on reasonable data protection grounds, and we will make reasonable efforts to resolve the objection. If there is no reasonable solution, either of us may end the affected Services before the change takes effect, without penalty. We will refund any fees you have paid in advance for the period after that.

7.4 We impose data protection obligations on each Sub-processor by contract. These give the same level of protection as this DPA, in particular around security. We remain liable to you for our Sub-processors' performance of those obligations.

8. Helping you

8.1 Data subject requests. Taking into account the nature of the processing, we will help you respond to requests from your customers to exercise their data protection rights. We do this through appropriate technical and organisational measures, as far as possible. The Services include customer export, editing and archiving, and booking deletion, and we will help on request where these do not cover what you need. If a request comes to us directly, we will pass it to you promptly. We will not answer it ourselves unless you ask us to.

8.2 Other help. Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under UK GDPR Articles 32 to 36. These cover security, Personal Data Breaches (including telling affected people), data protection impact assessments and prior consultation with the ICO.

8.3 Charges. We may charge reasonable fees for non-routine help beyond the standard features of the Services, but only if you agree them in advance. We will not charge where the help is needed because we have breached this DPA or Data Protection Law.

9. Transfers outside the UK

9.1 Some Sub-processors process Customer Personal Data outside the UK, including our hosting provider in the United States. Annex 3 lists them.

9.2 We make such transfers only where UK law allows them, using: (a) UK adequacy regulations, for example for the EEA; (b) the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified; or (c) the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses, or the ICO's International Data Transfer Agreement.

Annex 3 states the mechanism we rely on for each Sub-processor.

10. Personal Data Breaches

10.1 We will tell you without undue delay after we become aware of a Personal Data Breach affecting Customer Personal Data.

10.2 We will give you the information you reasonably need to assess the breach and meet your own obligations, including notifying the ICO within 72 hours where required. That means what happened, the data and people likely to be affected, the likely consequences, and what we are doing about it. Where we do not have all of it at once, we will provide it in stages.

10.3 Telling you about a breach is not an admission of fault.

11. Ending the Services: return and deletion

11.1 While your account is open, you can export your customer records from the Services. You can also do this while it is suspended.

11.2 The Services end when you close your account. They also end when your account has been suspended for non-payment for 6 months, or for 90 days if it was a free trial that ended without ever being paid for. Before we delete a suspended account, we will email you 30 days and 7 days in advance. Until then you can restart your subscription, or take a copy of your data.

11.3 When the Services end, you may choose either: (a) return of Customer Personal Data in a commonly used format, followed by deletion; or (b) deletion without return.

You must tell us your choice within 30 days after the Services end. For a suspended account, the 30 days of warnings before deletion are that time. If you do not choose, you instruct us to delete the data. We will complete deletion from our live systems within 30 days after your choice or that default instruction. The only exception is where UK law requires us to keep the data.

11.4 Backup copies are put beyond ordinary use when the live data is deleted, and are deleted automatically when those backups expire, which is within 30 days. If we ever restore from a backup, we will reapply your deletion instruction before the restored data goes back into use.

11.5 Customer import files. A file you upload for import is deleted when the import is completed, when you delete it, and in any case no later than 14 days after upload. Records we could not import are listed in your account for 30 days after the import, then deleted.

11.6 Statistics. After deletion we keep only an anonymous, rounded record of how the Services were used, such as the quarter you signed up, ranges for bookings and customers, the features used and your postcode area. It contains no Customer Personal Data and cannot identify you.

12. Information and audits

12.1 We will make available to you the information reasonably needed to show that we comply with UK GDPR Article 28 and with this DPA. This will normally be written answers to your reasonable questions.

12.2 If that is not enough, you may audit our compliance yourself, or have an independent auditor bound by confidentiality do it. Audits will normally start with written information and remote review. They will take place in reasonable business hours, avoid unreasonable disruption, and protect other customers' data, security information and credentials.

12.3 You must give at least 30 days' notice, and may audit no more than once in any 12 months. These limits do not apply where a regulator requires the audit, after a relevant Personal Data Breach, or where there are reasonable grounds to suspect material non-compliance.

12.4 You pay your auditor's costs. Any charge for substantial DetailBook time must be reasonable and agreed in advance, except where the audit finds we have materially breached this DPA.

13. Records

We keep a record of the processing we carry out on your behalf, as UK GDPR Article 30(2) requires.

14. Duration and changes

14.1 This DPA lasts for as long as we process Customer Personal Data for you, including during return and deletion under section 11.

14.2 We may update this DPA to reflect changes in law, ICO guidance or the Services. We will give advance notice of any material change and keep a copy of every version. Where your acceptance is required, normal use of the Services will not resume until the account owner accepts the updated DPA.

15. Liability

Nothing in this DPA limits liability to data subjects or regulators, or any liability that cannot lawfully be limited. Between you and us, our total liability under this DPA is included within the liability cap in the Terms and does not increase it. This DPA creates no separate indemnity.

---

Annex 1 — Details of processing

Annex 2 — Security measures (as at the date of this DPA)

• Access control: Customer Personal Data is logically separated by account. Authenticated access is scoped to the account in the login token. Team-member access is deny-by-default and is re-checked against current permissions on every request. Passwords are stored as one-way hashes (bcrypt). Sessions expire after 7 days.
• Encryption in transit: the Services are reached over HTTPS, and connections to the database are encrypted.
• Hosting: the application, database and files are hosted by Railway in a professionally managed data centre in the United States.
• Backups: the database and uploaded files are backed up daily to Cloudflare R2 and deleted automatically after 30 days. A documented restore procedure covers them. Backups that are missing, late or too small trigger an alert.
• Payments: card details are entered directly with Stripe and never reach our servers.
• Application security: database queries are parameterised, output is escaped against script injection, payment webhooks are signature-checked, and uploads are limited by type and size.
• Monitoring: error events are sent to Sentry's Frankfurt event region; related account details may be processed outside the UK. Uptime is monitored with alerts.
• People and accounts: a single operator. Two-factor authentication on the hosting, payment and password-manager accounts.
• Data minimisation: customer import files are wiped after import. SMS phone numbers are masked in application logs. Logs and error reports are not claimed to be entirely free of personal data.

Annex 3 — Sub-processors

Independent controllers (not Sub-processors): Google Maps Platform (address look-up, under Google's controller terms) — see blocker 6.

---