booqoo

Trust

Data Processing Addendum

Last updated: October 14, 2026

This DPA applies when a business user ("Customer") uses booqoo to process personal data of its own customers and contacts, and forms part of the Terms. booqoo is the processor and the Customer is the controller. Where the GDPR, UK GDPR or similar laws apply, it works as follows.

  1. Scope. booqoo processes the personal data in the Customer's account only to provide the Services, for the term of the agreement. Data subjects include the Customer's customers, guests, leads, members and staff; data types are those the Customer enters or collects through the apps (contact details, bookings, messages, attendance, payment status, form answers).
  2. Instructions. We process data only on the Customer's documented instructions (the Terms, this DPA and use of the features), unless the law requires otherwise, and tell the Customer if an instruction looks unlawful.
  3. Confidentiality. People who access the data are bound by confidentiality.
  4. Security. We keep the measures described on our Security page.
  5. Subprocessors. The Customer authorizes the subprocessors listed on our Subprocessors page. We give 30 days' notice of new ones on that page and, if the Customer asks, by email, and the Customer may object on reasonable grounds; if we cannot resolve it, the Customer may stop using the affected app and receive a refund of prepaid fees for it. We stay responsible for our subprocessors.
  6. Assistance. We help the Customer answer data-subject requests and carry out impact assessments, using the tools in the apps and, if needed, at reasonable cost.
  7. Breach. We notify the Customer without undue delay, and within 72 hours where possible, after becoming aware of a personal-data breach, with the details we have.
  8. Return and deletion. When the Customer asks, during the agreement or after it ends, we delete or return the data within 30 days of the request, except where the law requires us to keep it, suppression lists kept so opted-out people are not contacted again, and booking and payment records kept for the period stated in the Calloo terms. Backups expire within 35 days.
  9. Audits. We provide information needed to show compliance, and allow reasonable audits once a year on 30 days' notice, at the Customer's cost.
  10. Transfers. For transfers outside the EEA/UK, the Standard Contractual Clauses (Module Two, controller to processor) and the UK Addendum apply and are incorporated here. The details the Clauses ask for (the parties, the data, our security measures and our subprocessors) are the ones set out in this DPA.
  11. Liability. Each party's liability under this DPA is subject to the limits in the Terms.
  12. Order of precedence. If this DPA conflicts with the Terms on data protection, the DPA applies.

A signed copy of this DPA is available on request at support@booqoo.com.