Legal
Data processing agreement
1. Parties and roles
Controller: the business named in the subscription order. Processor: [legal name to be confirmed], Belgium. The processor acts only on the controller's documented instructions, which are given through the use of the Service and this agreement.
2. Subject matter, duration, nature and purpose
Processing of customer and staff personal data needed to take, manage and seat business bookings, communicate with customers about their booking, and produce statistics for the business, for as long as the subscription runs and during the wind-down period of 30 days afterwards.
3. Categories of data and data subjects
- Customers
- Name, phone number, e-mail address, number of people, date and time, what was booked (for example a table, chair or room), booking status, arrival and departure times, the message left when booking, internal notes, visit history.
- Business staff
- Name, work e-mail, role, hashed credentials, sign-in events.
4. Obligations of the processor
- Process data only on instruction; inform the controller if an instruction would break the law.
- Bind everyone with access to confidentiality; give access on a need-to-know basis.
- Apply the technical and organisational measures in section 6.
- Engage sub-processors only under section 5.
- Help the controller answer data-subject requests (access, rectification, erasure, restriction, portability, objection) with the built-in export and erasure tools, and help with security, breach notification and impact assessments.
- Notify the controller of a personal data breach without undue delay and at the latest within 72 hours of becoming aware of it, with the information needed for the controller's own notification.
- Delete or return all personal data at the end of the service, except where the law requires storage; anonymise bookings after the retention period chosen by the controller (default 24 months).
- Make available the information needed to demonstrate compliance and allow audits, at most once a year unless a breach or a supervisory authority requires more.
5. Sub-processors
The controller gives general authorisation for hosting, database and e-mail delivery providers established in the European Union. The current list is:
| Provider | What for | Where |
|---|---|---|
| Vercel | hosting and delivery of the website | [region to be confirmed] |
| Supabase | database for contact-form enquiries | EU (eu-west-1, Ireland) |
| Resend | delivering the e-mail we send you | EU |
The processor informs the controller of intended changes at least 30 days in advance; the controller may object on reasonable grounds, in which case the parties look for a solution and, failing that, the controller may terminate the affected service. Questions: privacy@bookancy.online.
6. Security measures
- Encryption in transit (TLS); passwords stored as salted hashes; optional two-factor sign-in; PIN lock for shared devices; automatic sign-in pause after repeated failures; sessions that expire.
- Role-based access (owner, manager, staff); activity log of security-relevant actions.
- Browser hardening headers (content security policy, no framing, no referrer leakage).
- Encrypted backups, retention and anonymisation controls, data export and erasure tools.
7. International transfers
No transfers outside the European Economic Area. Should one become necessary, the parties will first put in place the European Commission's standard contractual clauses and any supplementary measures.
8. Liability and term
The liability rules of the terms of service apply. This agreement lasts as long as the processor processes personal data for the controller and prevails over the terms in case of conflict on data protection matters.