Data Processing Terms

Scope, subject matter and duration

These Data Processing Terms form part of the Terms of Service. They apply for the duration of the business customer's use of Dubbl7 One and any agreed period needed to close the service relationship. The subject matter is the provision, maintenance and support of the service and the processing needed to provide its booking, business-management and communication features.

Nature, purpose and data

Processing may include collecting, recording, organising, storing, retrieving, using, disclosing through authorised service features, and deleting or returning data where applicable. Its purpose is to provide and support Dubbl7 One, protect its security, and meet applicable legal requirements.

The personal data may include names, contact details, bookings, appointments, service records, form responses, notes, communications, payment-related records and other information entered by the business customer. Data subjects may include the customer's clients, prospective clients, staff and other users. The business customer may choose to enter health or other special-category information; Dubbl7 does not determine the customer's lawful basis or Article 9 condition for that processing.

Customer instructions and responsibilities

Dubbl7 processes personal data on the business customer's documented instructions, including through the customer's use of the service, unless processing is required by applicable law. The business customer is responsible for ensuring that its instructions are lawful, for giving appropriate privacy information, for determining its Article 6 lawful basis and, where applicable, Article 9 condition, and for using forms and free-text fields in accordance with data-minimisation and other applicable requirements.

Confidentiality and security

Dubbl7 will ensure that people authorised to process personal data are subject to appropriate confidentiality obligations. Dubbl7 will implement proportionate technical and organisational measures designed to protect personal data, taking account of the nature of the service and processing. Dubbl7 does not claim that any particular measure, certification or security outcome is guaranteed.

Subprocessors

The business customer gives general authorisation for Dubbl7 to use subprocessors needed to provide the service. Current subprocessors are Vercel for application hosting and deployment infrastructure, Supabase for database, authentication, storage and backend infrastructure, and Resend for transactional and application email delivery.

Dubbl7 will remain responsible for its subprocessor arrangements as required by applicable law and will make reasonable information about material changes to this schedule available to business customers. Each subprocessor may process personal data only as needed to provide its services to Dubbl7.

Assistance and personal-data incidents

Taking account of the nature of processing and the information available to Dubbl7, we will provide reasonable assistance to the business customer with data-subject requests and with its applicable security, breach, data-protection-impact-assessment and prior-consultation obligations. If Dubbl7 becomes aware of a personal-data incident affecting customer-controlled data, it will notify the affected business customer without undue delay and provide relevant information available to it for the customer's assessment and response.

Return, deletion and information

On termination, Dubbl7 will handle personal data in accordance with the customer's documented instructions, the service's documented manual closure and deletion processes, and applicable legal, security and retention requirements. We may retain data where required or permitted by applicable law, or where necessary for legitimate security, dispute or operational purposes.

Dubbl7 will make available information reasonably necessary to demonstrate compliance with these terms and will provide proportionate assistance with audits or inspections, taking account of the service's size, security, confidentiality and the need to avoid disruption to other customers. Any audit request must be reasonable, appropriately scoped and coordinated in advance.

International transfers

Where processing involves a transfer of personal data outside the UK, Dubbl7 will use safeguards required by applicable data-protection law. The appropriate safeguard depends on the circumstances and may include recognised adequacy arrangements or contractual protections. Dubbl7 does not state a particular transfer mechanism unless it is confirmed for the relevant processing arrangement.

Contact

For questions about these Data Processing Terms or privacy matters, contact privacy@dubbl7.com.