Data Processing Addendum

1. Roles

The Business is the controller of its client records. WhenBy is its processor.
WhenBy is a separate controller for the data in its Privacy Policy: user accounts, clients' own bookings and settings, billing, security and analytics. This addendum doesn't cover that data.

2. What we process

Subject matter	Hosting and running the Business's client records, calendar and messages in WhenBy
Duration	While the Terms are in force, then until deletion under section 9
Nature and purpose	Storing, organising, showing, sending reminders, importing and exporting, so the Business can manage its bookings and clients
Data subjects	The Business's clients, and people in contact lists it imports
Personal data	Name, email, phone, notes, tags, booking history, no-shows, marketing consent, payments recorded at the visit, before-and-after photos, home-visit addresses
Special categories	Health data the Business chooses to record (allergies, skin conditions). The Business must have explicit consent or another Art. 9 condition

3. Our commitments

We will:

process the data only on the Business's documented instructions, which are the Terms, this addendum and how the Business uses WhenBy, and tell the Business if we think an instruction breaks the law;
make sure everyone who can access the data is bound by confidentiality;
keep the security measures in section 5;
use sub-processors only as in section 6;
help the Business answer data subject requests, mostly through features in the app (export, correction, deletion of client records);
help the Business with security, breach notices, impact assessments and prior consultation, taking into account what we know;
delete or return the data at the end, as in section 9;
give the Business the information it needs to show compliance, and allow audits as in section 8.

4. The Business's commitments

The Business:

has a lawful basis for every client record, including imported lists, and gives its clients the information the law requires;
gets explicit consent before recording health data, and only records what it needs;
sends marketing only to clients who opted in;
gives its Staff Members access only to what they need (WhenBy's roles help with this);
answers its clients' requests about their records.

5. Security measures (summary)

Data stored in the EU (Ireland), encrypted in transit (TLS) and at rest (AES-256).
Row-level security in the database keeps each Business's data apart, with automated isolation tests.
Client photos in private storage, shown only through links that expire after minutes.
Sign-in by one-time codes, no passwords; Owner-only actions for sensitive changes.
Least-privilege access for our staff, secrets kept out of the app and the code.
No client data in logs or analytics; health notes never in notifications.
Encrypted backups and a tested restore process.

The full list is Annex 2 of the final addendum.

6. Sub-processors

The Business gives general authorisation for the sub-processors on our sub-processors page.
We tell Businesses about a new or replaced sub-processor at least 30 days before it starts, by email and on that page. The Business can object on reasonable data protection grounds; if we can't resolve it, the Business can end the Terms and get a refund of prepaid fees for the unused period.
We impose the same data protection duties on every sub-processor and remain responsible for them.

7. Personal data breaches

We tell the Business without undue delay, and within 48 hours of becoming aware of a breach affecting its data, with what we know, the likely consequences and what we are doing. We update it as we learn more.

8. Audits

We answer the Business's reasonable security questionnaires once a year, and share summaries of our providers' certifications. If that is not enough, or an authority requires it, the Business may audit us with 30 days' notice, at its own cost, in a way that protects other Businesses' data.

9. End of processing

When the Business deletes its account or the Terms end, it can export its data first. After a 30-day grace period we delete the client records, and they leave our backups within a further 30 days, unless the law requires us to keep them.

10. International transfers

We store the data in the EU. Where a sub-processor processes it outside the EU or the UK, we use an adequacy decision or the Standard Contractual Clauses (and the UK Addendum), with extra measures where needed.

11. Annexes in the final text

Details of processing (section 2).
Technical and organisational measures (section 5, in full).
Sub-processors (our sub-processors page).
Standard Contractual Clauses, where needed.