Data Processing Agreement

1. Parties and roles

• The business using RefinedOS is the controller of the personal data it puts into RefinedOS about its customers, staff and others (“Customer Data”).
• RefinedOS Ltd, a company incorporated in the United Kingdom (“RefinedOS”, “we”, “us”), is the processor of Customer Data.
• RefinedOS is a separate controller for limited processing it decides itself, such as account administration, billing, security, fraud prevention, support and running the platform. That processing is described in the Privacy Notice and is not covered by this DPA.

2. Subject matter and duration

The subject matter is providing the RefinedOS booking and customer management service to you. Processing lasts for as long as you use the service, and afterwards only as set out in section 14.

3. Nature and purpose of processing

Storing, organising, displaying, transmitting and deleting Customer Data in order to:

• take and manage bookings, calendars, services and staff schedules;
• keep customer records and booking history, including data imported via CSV files;
• send booking messages for you by email, SMS, and push notification (and WhatsApp once connected), and manage waitlists;
• send customer marketing campaigns on your instructions to customers who have opted in;
• derive operational indicators from booking history for your team;
• provide reports and analytics about your business;
• keep the service secure and working, and support you.

4. Types of personal data

• identity and contact details: name, phone number, email address;
• booking data: services, times, staff, price, status, cancellations, reschedules, no-shows and notes you enter or import;
• waitlist requests;
• notification and marketing preferences, message content for booking and campaign messages, delivery status and replies;
• staff details: name, role, working hours, permissions, device notification address;
• derived customer indicators such as “Regular” and “Needs attention”.

5. Categories of data subjects

• your customers and prospective customers;
• your staff and other users you give access to;
• other people you choose to record, for example someone named in a booking.

6. Your responsibilities and rights

• You decide the purposes and means of processing Customer Data and are responsible for having a lawful basis, giving people the required privacy information, and the accuracy of what you enter.
• You may give instructions and ask us for information on how we comply with this DPA.
• You must not instruct us to do anything that would breach data protection law.

7. Documented instructions

We process Customer Data only on your documented instructions, which are this DPA, the Terms and your use of the service’s settings and features, unless the law requires otherwise (in which case we will tell you first where we lawfully can). We will tell you if we think an instruction breaches data protection law.

8. Confidentiality

We ensure that anyone we authorise to process Customer Data is bound by a duty of confidentiality, and limit access to what is needed to run and support the service.

9. Security

We apply technical and organisational measures appropriate to the risk, including:

• separation of each business’s data, enforced in the database and in the application;
• role-based access control for business users and restricted access for RefinedOS administrators;
• encrypted connections and managed authentication;
• verification of signed messages from billing and messaging providers;
• provider credentials kept out of the application code;
• logging of administrative and security-relevant actions.

You are responsible for the security of your own accounts, devices and the access you grant to your team.

10. Subprocessors

You give us general authorisation to use subprocessors. We bind each one to data protection terms that give equivalent protection to this DPA, and we remain responsible for their performance. We will tell business users of changes to this list in advance, by email or in the service, and you may object on reasonable data-protection grounds. If we cannot resolve it, you may stop using the service. The current subprocessors are:

11. Helping with data subject rights

We will, taking account of the nature of the processing, help you respond to people exercising their data protection rights. If we receive a request about Customer Data directly, we will not respond except to refer the person to you, unless you instruct us or the law requires it. You can remove a customer from your customer list in the Customers area, which archives the record. Permanent erasure and exports are not self-service: there is no automated request portal at present, and we handle requests manually and may need reasonable time and information to do so.

12. Security incidents

We will tell you without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information we have to help you meet your own duties to notify the ICO and affected people, and keep you updated as we learn more.

13. Impact assessments and regulators

We will give reasonable help with data protection impact assessments and with consultations with the ICO where they relate to our processing of Customer Data, taking account of the information available to us.

14. Deletion or return

When the service ends, or earlier on your written request, we will delete Customer Data or return a copy to you at your choice, unless the law requires us to keep it. At present deletion and return are done manually on request, within a reasonable period. Copies in backups are held by our database provider for its backup retention period, are removed as the backups expire, and are not used for any other purpose in the meantime.

15. Information and audits

We will give you the information reasonably needed to show we comply with this DPA and allow for reasonable audits, which can be carried out by us answering written questions and giving relevant documents. A further on-site audit may be requested where required by law or after a security incident, on reasonable notice, during normal business hours and without harming other customers’ data. Each party bears its own costs unless agreed otherwise.

16. International transfers

We and our subprocessors may process Customer Data outside the United Kingdom. Where that happens and the law requires it, we will make sure an appropriate transfer mechanism or safeguard is in place. You can ask us for further information.

17. Priority

If this DPA conflicts with the Terms on the processing of Customer Data, this DPA takes priority. Otherwise the Terms apply, including as to governing law.

18. Liability and commercial terms

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it.

Summary of processing