Data processing agreement
Draft of 5 November 2026
Draft. This document is being reviewed before Booksure takes paying customers. Highlighted parts are still to be filled in. If anything here is unclear, send us a message.
This agreement covers the personal data of your customers that Booksure stores and uses for you. It meets Article 28 of the UK GDPR and forms part of our terms of service. It applies automatically when you accept those terms.
1. Parties and roles
You, the business, are the controller. [Operator’s legal name, for example “AutoZen Ltd”, company number and registered address] (“Booksure”) is the processor.
2. The processing
| Subject matter | Providing the Booksure booking service to you |
|---|---|
| Duration | While your account is open, then up to 90 days to delete the data |
| Nature and purpose | Storing, showing and changing bookings and customer records; sending booking emails and reminders |
| People concerned | Your customers, and your team members |
| Types of data | Names, email addresses, phone numbers, addresses, booking details and notes. No special category data is intended. |
3. What Booksure will do
- Process the data only on your documented instructions, which are these terms and the way you use the dashboard, unless the law requires otherwise (we will tell you if so, unless the law forbids it).
- Make sure everyone who can reach the data is bound to keep it confidential.
- Keep it secure (Article 32): encryption in transit, each business’s data kept separate, hashed passwords, two-step sign-in for our own access, and backups.
- Use other processors only as set out in section 4, under contracts with the same data protection duties.
- Help you answer your customers’ requests to see, correct or delete their data. The dashboard lets you find, change, delete and download customer data yourself. We pass on any request we receive directly.
- Help you with security, breach reports and impact assessments, taking into account what we know about the processing.
- Tell you without undue delay, and within [48] hours, after we become aware of a breach affecting your data, with the information you need to report it.
- When your account closes, delete the data within 90 days. You can download it before then. Copies in backups are gone within a further 30 days.
- Give you the information you need to show this agreement is being met, and allow reasonable audits, with reasonable notice, at your cost.
4. Other processors
You agree that Booksure uses these sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, bot checks | Western Europe [confirm] |
| Resend | Sending booking emails | [confirm] |
We will email you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, you can close your account before the change.
5. Transfers outside the UK
Where a sub-processor handles data outside the UK, we make sure a lawful safeguard is in place, such as UK adequacy regulations or the International Data Transfer Addendum.
6. Your duties
You are responsible for having a lawful basis for the data you collect, for telling your customers how you use it, and for not collecting more than you need.