Data processing agreement

This agreement is between Barbertab ("we", "us"), a sole trader business in England, and the shop holding the account ("you"). It forms part of our terms of service, and it applies automatically from the moment you open an account. There is nothing to sign.

Under UK data protection law you are the controller of your clients' personal data and we are your processor. You decide what to collect and why. We hold and handle it for you, and only for you.

Subject matter. Providing the Barbertab service: your booking page, your diary, your client records, appointment reminders, deposits, memberships and loyalty.

Duration. For as long as your account is open, and for 90 days after you close it so you can export your records. After that we delete them.

Nature and purpose of the processing. Storing, organising, retrieving and transmitting your client records so that your clients can book with you, so you can run your diary, so they get reminded, and so deposits and memberships can be taken.

Type of personal data. Your clients' names, mobile numbers, email addresses, appointment history, any notes you write about them, their loyalty and membership status, and any reviews they leave. Also your own staff's names, email addresses and login details.

• We never see or store card numbers. Card details go directly from your client's browser to Stripe, who are a controller in their own right for payment data and regulated separately.

Categories of data subject. Your clients, and the barbers and staff you give logins to.

Your obligations. You must have a lawful basis for the data you put into Barbertab, tell your clients what you do with it, and answer their requests about it. We will help you do that, but they are your clients and the duty is yours. Do not put special category data into a client note — health conditions, religion, anything of that kind — unless you have separately satisfied the extra conditions the law puts on it. The notes field is not designed to hold it.

You give us general written authorisation to use the sub-processors listed below, and no others. Each one is used for a single, stated job.

• Supabase — the database your shop's and clients' records live in. Data stored in the UK (London).
• Vercel — hosting and delivery of the app. Servers in the UK (London).
• Stripe — subscription billing and client deposits. Operates internationally; UK transfers covered by the International Data Transfer Addendum.
• Twilio — sending appointment reminder texts. Operates internationally; UK transfers covered by the International Data Transfer Addendum.
• Resend — sending transactional email such as verification and receipts. Operates internationally; UK transfers covered by the International Data Transfer Addendum.

Every one of them is bound by written terms no weaker than this agreement. If any of them fails to meet its data protection obligations, we remain fully liable to you for it.

If we ever want to add or change a sub-processor we will email you at least 30 days beforehand. If you object, tell us within those 30 days and you may close your account without penalty and take your data with you. We will not make the change for your account before that window closes.

We process your clients' personal data only on your documented instructions. Using the product is the instruction: when you take a booking, send a reminder or write a note, that is you telling us to process that data, and this agreement and our terms are the documented record of it.

We will not use your clients' data for our own purposes. We will not sell it, mine it, use it to advertise to anyone, or use it to train anything.

We will not transfer your clients' data outside the UK except through the sub-processors named in section 2, each of which is covered by an appropriate transfer mechanism. Your database and the servers that run the site are in London.

If we are ever required by law to process the data in some other way, we will tell you before we do it unless the law forbids us from saying so.

If we think an instruction from you breaches data protection law, we will tell you and may pause that instruction until it is resolved.

Access to live client data is limited to those who need it to run the service. In practice that is one person: the sole trader who operates Barbertab.

Anyone given access, now or in future, is bound by a written duty of confidentiality that continues after they stop working on Barbertab. Nobody gets access without it.

We take the security measures required by Article 32. Concretely, and these are things you can hold us to:

• Every table in the database has row-level security keyed on the shop, so one shop's login cannot read another shop's rows. This is enforced by the database itself, not by application code that could be bypassed.
• Data is stored in the UK (London) and the servers that run the site are in London.
• Everything travels over TLS. There is no unencrypted route in.
• Passwords are hashed by our authentication provider and are not readable by us.
• Card numbers never reach our servers.
• The public booking pages expose a fixed, audited list of fields through database views rather than querying tables directly, so a new column cannot accidentally become public.
• Backups are held by our database provider, encrypted, in the same region.

We review these measures as the service changes, and we will improve them where a risk warrants it. Security is judged against the state of the art and the risk to the people involved, not against a fixed list, and we treat it that way.

If one of your clients asks to see their data, correct it, delete it or have it ported elsewhere, that request is yours to answer. The dashboard is built so you can answer it yourself immediately: you can view, edit and delete any client record, and export your full client list and booking history as spreadsheets whenever you like.

If a request needs something the dashboard cannot do, email us and we will help, at no charge, in time for you to meet your one-month deadline.

If a client contacts us directly about data you control, we will not action it ourselves. We will tell them to contact you, and tell you it happened.

If we become aware of a personal data breach affecting your clients' data, we will tell you without undue delay, and in any event within 24 hours of becoming aware of it. You have 72 hours to report a qualifying breach to the ICO and you cannot start that clock until we have told you, so we will not sit on it.

When we tell you, we will include what we know at that point: what happened, which categories and roughly how many people and records are affected, the likely consequences, what we have done about it, and what we are still doing. If we do not have all of it at once we will send what we have and follow up rather than wait.

We will help you meet your own obligations under Articles 32 to 36 — securing the data, notifying the ICO, telling affected people where that is required, and carrying out a data protection impact assessment or consulting the ICO where one is needed. We will give you the information about how the service works that such an assessment needs.

We will not notify your clients directly unless you ask us to or the law requires us to.

You can export everything we hold for you, at any time, from Settings, as spreadsheets. You do not need to ask and there is no charge. This is deliberate: leaving should be as easy as arriving.

When you close your account we keep your records for 90 days so you can still export them, then delete them. Deletion is automatic — a scheduled job runs nightly and removes closed accounts past that window, along with every client, booking, service and record attached to them. It is not a promise that depends on somebody remembering.

If you would rather we deleted everything sooner than 90 days, email us and we will do it. Once it is deleted it cannot be recovered.

The one thing deletion does not reach is billing records — invoices and payment history — which we have to keep for six years because HMRC requires it. Those are about our contract with you, not about your clients.

We will make available to you whatever information you reasonably need to show that we are meeting our obligations under this agreement, on request and at no charge.

You may audit us, or have someone independent audit us on your behalf, to check we are doing what this agreement says. Ask in writing, give us 30 days' notice, and keep it to once a year unless a breach or a regulator's instruction makes another one necessary. We will contribute to it.

Where the question can be answered with documentation rather than an inspection, we will answer it that way, which is usually faster for both of us.

This agreement is part of our terms of service. Where anything in it conflicts with the rest of the terms, on anything to do with your clients' personal data, this agreement wins.

Nothing in this agreement limits either of our obligations under UK data protection law, and neither of us can contract out of them.

This agreement is governed by the law of England and Wales.

For anything under this agreement — a client request you need help with, an audit, a question about the sub-processors, or a breach — email support@barbertab.com. We answer data protection matters within five working days, and faster when something is actually wrong.

If you are not satisfied with how we have handled something, you can complain to the Information Commissioner's Office at ico.org.uk.