Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Terms of Service between WAppoint ("Processor") and the business or organisation using WAppoint to take customer appointments ("Controller") and applies where WAppoint processes personal data of the Controller's end customers (for example people who book appointments through a WAppoint booking page) on the Controller's behalf. It is intended to meet the requirements of Article 28 of the UK GDPR.

For personal data about the Controller's own account users (staff who use the dashboard), WAppoint is the controller — see our Privacy Policy.

1. Subject matter, duration, nature and purpose

• Subject matter: processing of end-customer appointment data to provide the booking service.
• Duration: for as long as the Controller uses WAppoint and any retention period required afterwards for legal or dispute purposes.
• Nature and purpose: collection, storage, organisation, transmission (confirmations, reminders), retrieval, deletion and disclosure as instructed by the Controller through the use of the service.

2. Categories of personal data and data subjects

• Personal data: end-customer names, phone numbers, email addresses, appointment details (service, staff, date, time), booking notes and answers to any booking questions, waitlist preferences, and message delivery records.
• Data subjects: the Controller's current, prospective and former customers, and any guests they book for.

3. Controller instructions

WAppoint processes personal data only on documented instructions from the Controller (via configuration and normal use of the service), unless required by law — in which case we will notify the Controller before processing unless the law prohibits that.

4. Confidentiality

Persons authorised to process personal data under this DPA are bound by confidentiality obligations.

5. Security

WAppoint implements appropriate technical and organisational measures under Article 32 UK GDPR, described on our Security page (HTTPS, password hashing, tenant isolation, rate limiting, security headers, encrypted credentials, environment-based secret separation). We continuously review measures against the risk.

6. Sub-processors

The Controller authorises WAppoint to engage the sub-processors listed on our Sub-processors page. WAppoint remains liable for each sub-processor's performance as required by Article 28(4) UK GDPR.

7. International transfers

Where personal data is transferred outside the United Kingdom, WAppoint ensures an approved transfer mechanism is in place (for example the UK IDTA or an adequacy regulation).

8. Assist with data subject requests

Taking into account the nature of the processing, WAppoint will assist the Controller by appropriate technical and organisational measures, so far as possible, in fulfilling the Controller's obligations to respond to data subject requests. End customers should normally contact the Controller first; WAppoint will forward or support requests that reach us directly, where the requester is associated with a known booking.

9. Breach assistance

WAppoint will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's end-customer data, and will provide information and assistance reasonably required for the Controller to meet its own breach-notification obligations.

10. Deletion and return

At the end of the provision of services, and at the Controller's choice, WAppoint will delete or return all end-customer personal data, unless retention is required by applicable law. Controllers can export or delete data from the dashboard; account closure triggers deletion in line with our retention schedule in the Privacy Policy.

11. Audits and information

WAppoint will make available to the Controller all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and confidentiality. Controllers should first use the information published on this site (Security and Subprocessors pages) before requesting an audit.

12. Controller responsibilities

The Controller is responsible for the lawfulness of the end-customer data it instructs WAppoint to process, for its own privacy notices to end customers, and for responding to end customers about how their data is used.

13. Contact

Questions about this DPA can be submitted through /contact using the "Privacy or data request" category.