Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Controller") and Igor Kałużny, trading as Nailbook (the "Processor"), and applies whenever Nailbook processes personal data about your clients on your behalf. It reflects Article 28 of the UK GDPR.

1. Roles

You are the controller of your clients' personal data. Nailbook is the processor and processes that data only to provide the service to you and only on your instructions (including as set out in the Terms and this DPA).

2. Subject matter and duration

The processing lasts for as long as you have a Nailbook account, plus the short retention period described in the Privacy Policy, after which the data is deleted or returned.

3. Nature and purpose of processing

Storing and organising client records, taking and managing bookings, and sending appointment confirmations and reminders on your behalf.

4. Types of personal data

Client names, phone numbers, email addresses, appointment history and any notes you choose to record about a client.

5. Categories of data subject

Your clients.

6. Our obligations as processor

  • Process the data only on your documented instructions, unless required otherwise by law (in which case we will tell you unless the law forbids it).
  • Ensure people authorised to process the data are under a duty of confidentiality.
  • Put in place appropriate technical and organisational security measures (Article 32).
  • Assist you, as far as reasonably possible, in responding to your clients' data-subject requests.
  • Assist you with security, breach notification and impact assessments given the information available to us.
  • Delete or return the data at the end of the service, and delete existing copies unless the law requires us to keep them.
  • Make available the information needed to demonstrate compliance and allow for reasonable audits.

7. Sub-processors

You give general authorisation for us to use sub-processors to run the service: Stripe (payments), Resend (email delivery) and DigitalOcean (hosting). We impose data-protection obligations on them and will give you notice of any intended change, so you can object.

8. International transfers

Where a sub-processor processes data outside the UK, we ensure an appropriate safeguard is in place (such as UK/EU adequacy or standard contractual clauses).

9. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your clients' data, with the information you need to meet your own obligations.

10. Deletion and return

On termination you can export your data. After a reasonable period we delete it from live systems and, on the next cycle, from backups, unless we are legally required to retain it.

11. General

This DPA is governed by the law of England and Wales. Where it conflicts with the rest of the Terms on the subject of data protection, this DPA prevails. Contact for data matters: support@nailbook.co.uk.