Data processing addendum

1. Roles and scope

For personal data the Customer puts into its workspace or that its members create by using it ("Customer Personal Data"), the Customer is the controller and we are the processor. Annex 1 describes the processing. For account, billing and website data we are a controller, as described in our privacy policy.

2. The Customer's instructions and responsibilities

The Terms, the Customer's settings and its administrators' actions in the Service are the Customer's documented instructions. The Customer is responsible for:

• having a lawful basis for the processing, and telling its people about it;
• deciding whether features such as check-in, "who's in" and reports are proportionate for its people, and carrying out any data protection impact assessment it needs (we will help: clause 3(f));
• not putting special category data into the Service unless it needs to and has a lawful basis.

3. Our obligations (Article 28(3))

We will:

1. process Customer Personal Data only on the Customer's documented instructions, including about international transfers, unless the law requires otherwise (we will tell the Customer first unless the law forbids it), and tell the Customer if we think an instruction breaks Data Protection Law;
2. make sure anyone we authorise to process it is bound by confidentiality;
3. take the security measures in Annex 2, as required by Article 32;
4. use subprocessors only as clause 4 allows, under written contracts that give the same data protection obligations, and remain responsible for them;
5. help the Customer, by appropriate technical and organisational measures, to answer requests from people exercising their rights: the Service lets administrators view, correct, export and delete member data, and we pass on any request we receive about the Customer's data within 5 working days;
6. help the Customer meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation (Articles 32 to 36), taking into account what we know; in particular clause 5;
7. at the end of the service, delete Customer Personal Data (the Customer can export it first), unless the law requires us to keep it, as described in clause 7;
8. make available the information needed to show we meet these obligations, and allow for and contribute to audits (clause 8).

4. Subprocessors

The Customer gives general authorisation for the subprocessors in Annex 3. We will email the Customer's owners at least 30 days before adding or replacing a subprocessor and update the subprocessors page. The Customer may object on reasonable data protection grounds within that time; if we can't address the objection, the Customer may end the affected service and get a pro-rata refund of prepaid fees for it.

5. Personal data breaches

We will tell the Customer without undue delay, and aim to do so within 24 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give what the Customer needs for its own notification (Article 33(3)): what happened, the categories and approximate numbers of people and records, likely consequences, and what we have done or propose to do, adding details as we learn them. We will not notify the Customer's people or regulator on its behalf unless it asks us to or the law requires.

6. International transfers

The Service is hosted in Frankfurt, Germany. Where a subprocessor processes Customer Personal Data outside the UK and EEA, we make sure the transfer is covered by an adequacy decision or regulations (including the EU–US Data Privacy Framework and its UK extension for certified providers) or by the EU standard contractual clauses (Commission Decision 2021/914) with the UK International Data Transfer Addendum, and by any supplementary measures needed. We (in the UK) receive EU data under the European Commission's adequacy decision for the UK.

7. Return and deletion

The Customer's owners can export its data at any time (Settings › Danger zone). When the Customer deletes its workspace, or its subscription ends and it asks us to, we delete Customer Personal Data from the live systems at once, with no grace period, except billing records the law requires us to keep. It remains in our database backups for up to 30 days; backups are used only for disaster recovery, and if one is restored we repeat the deletions made since.

8. Information and audits

On request we will provide written answers to reasonable security and data protection questionnaires, and a summary of our most recent security review. If that is not enough to show compliance, or a regulator requires it, the Customer (or an independent auditor bound by confidentiality) may audit us once a year on 30 days' notice, during working hours, at its own cost, without access to other customers' data.

9. General

The Terms' limits of liability apply to this DPA. If this DPA conflicts with the Terms, this DPA wins for Customer Personal Data. The EU standard contractual clauses, where they apply, win over both.

Annex 1: Description of the processing

Subject matter and duration

Providing the booking service to the Customer for as long as it uses it, then deletion (clause 7).

Nature and purpose

Hosting, storing and displaying Customer Personal Data; making, changing and cancelling bookings; waitlists and fair-booking rules; check-in and automatic release; showing who is in; reports; sending booking emails and in-app notifications; adding bookings to connected calendars; kiosk displays; activity logs; support.

Data subjects

The Customer's members and invitees (for example employees, contractors, students, teachers, club members) and visitors or others booked on their behalf.

Categories of data

Name, email address, profile picture; role, location and groups; bookings (bookable, time, title, notes, participants), check-ins, waitlist entries, assigned bookables; notes administrators keep; notifications; activity (audit) log entries; calendar connection tokens (encrypted); technical data (IP address, browser) in logs.

Special category data

None intended. Free-text fields (booking notes, member notes) could contain it if people type it; the Customer should tell its people not to.

Frequency

Continuous.

Annex 2: Security measures

• Hosting in the EU (Frankfurt) on providers with independent security certifications; database encrypted at rest; all traffic over TLS with HSTS.
• Passwords stored as salted PBKDF2 hashes; sign-in links, API keys and display tokens stored only as hashes; calendar tokens encrypted with AES-256-GCM.
• Every query scoped to one organisation, with foreign keys checked against it; role-based permissions checked in the application for every administrative action; administrative changes recorded in an activity log.
• Rate limits and bot checks on sign-in and public forms; a strict content security policy; secure, HTTP-only session cookies.
• Secrets held in the hosting provider's secret store, never in code; production access limited to the operator.
• Nightly database backups to separate storage; error reports stripped of tokens, links and email content.
• Security checks on every change (static analysis, dependency audit); a full internal security review (application, access control and infrastructure) in September 2026.
• A written breach response plan, and a security contact published in /.well-known/security.txt.

Annex 3: Subprocessors

As at 28 September 2026. The live list is on the subprocessors page.