Data Processing Addendum

1. What this is

This Addendum forms part of the Terms & Conditions between GK Tools Ltd (company number 16434833, registered office 483 Green Lanes, London, N13 4BS, ICO registration ZB899192 (opens in a new tab) — “we”, “us”) and each Business using Appoint Me. It sets out how we process personal data on your behalf, as required by Article 28 UK GDPR.

2. The roles

For personal data about your customers that flows through Appoint Me — names, contact details, bookings, notes, payment references — you are the controller and we are your processor. (For your own account, billing and our marketing pages, we are the controller; see our Privacy Policy.)

3. Scope of processing

Subject matter: running your booking page and admin panel. Duration: while you hold an account, plus the retention window in our Privacy Policy. Nature and purpose: storing and displaying bookings, sending booking confirmations and reminders, recording deposits and gift-card payments, and the other features of the Service. Data types: identity and contact data, booking details and history, notes you or your customers add, reviews (rating, comment and any photos), and payment references. Data subjects: your customers and your staff.

Offers and news: when your booking page asks customers whether you may send them offers and news, we record each answer on your behalf, with the exact wording shown, its language, the date and time, the IP address and the browser, and keep that record for six years after the customer's last choice. Customers can withdraw at any time from their account or the link in your booking emails, and you can record a withdrawal they give you directly.

4. Our commitments as your processor

We will:

• process this data only on your documented instructions — using the Service is your instruction — unless UK law requires otherwise, in which case we'll tell you first where the law allows;
• make sure anyone we allow to access it is bound by confidentiality;
• protect it with appropriate technical and organisational measures, including encrypted connections, hashed passwords, and access controls that keep each Business's data private to that Business;
• help you, with reasonable assistance, respond to your customers' data-protection requests and meet your own security and breach-notification obligations;
• help you, with reasonable assistance, where you carry out a data protection impact assessment or consult the ICO;
• tell you if we think an instruction from you would break data protection law, so you can decide what to do;
• tell you without undue delay if we become aware of a personal-data breach affecting your data;
• on closure of your account, delete or return this data as described in our Privacy Policy, keeping only what the law requires us to keep; and
• make available the information reasonably needed to show we meet these commitments, and allow for audits where UK GDPR requires it.

5. Sub-processors

You give us general authorisation to use these sub-processors: allhost.io (the UK servers the Service runs on); Microsoft 365, Microsoft Ireland Operations Ltd (booking confirmations, reminders and sign-in emails); Google (Google reCAPTCHA bot protection on forms, and Firebase Cloud Messaging for Android notifications); Apple (Apple Push Notification service for iPhone and iPad notifications); and Voodoo SMS (sign-in codes, and appointment texts if you switch them on). Deposits, gift cards and other card payments you take are paid straight into your own Stripe account and processed by Stripe under your own agreement with Stripe, not as our sub-processor. An AI receptionist you connect is your own supplier, chosen and instructed by you.

We'll tell Businesses with reasonable notice before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds; if we can't resolve the objection, you may cancel under the Terms.

6. Transfers

Our servers are in the UK. Google and Apple may process notification and bot-protection data in the United States, and Microsoft may process email data outside the UK. Where a sub-processor transfers your customers' data outside the UK, we make sure the transfer is covered by the UK Extension to the EU-US Data Privacy Framework, the ICO's International Data Transfer Agreement or its Addendum to the EU Standard Contractual Clauses, and you instruct us to make those transfers by using the features concerned.

7. Contact

Questions about this Addendum? Email support@appointme.com, or write to GK Tools Ltd, 483 Green Lanes, London, N13 4BS.