Data processing agreement
Last updated 29 October 2026
This agreement is part of the terms of service between you, the business using Pawsome Booking ("you"), and SCH Ventures Ltd, a company registered in England and Wales, number 17020630, trading as Pawsome Booking ("we"). You accept it when you create your account. It sets out how we handle your customers' personal data on your behalf, as required by Article 28 of the UK GDPR.
1. Roles
For the personal data of your customers and their pets that you collect or hold using Pawsome Booking ("Customer Data"), you are the controller and we are your processor. For your own account and billing data, we are the controller, as explained in our privacy notice.
2. What we process
- Subject matter and purpose: providing Pawsome Booking to you: your booking page, diary, customer records, grooming records and photos, booking emails and reminders, groom reports and rebooking invitations you choose to send, deposit and refund records, and calendar feed.
- Duration: for as long as you use Pawsome Booking, plus the deletion period in section 9.
- Nature of processing: collecting, storing, organising, displaying, emailing, erasing and deleting.
- People concerned: your customers (pet owners), their emergency contacts, and anyone else whose details you add.
- Types of data: names, email addresses, phone numbers, postal addresses, emergency contacts, pet details (including veterinary, vaccination and behaviour notes), grooming records and before and after photos of pets, appointment history, notes, and payment and refund records (not card numbers).
- Special category data: none intended. Pet health information isn't special category data, but you agree not to record health or other sensitive information about people unless you have a lawful reason and it's necessary.
3. Your instructions
We only process Customer Data on your documented instructions. Your use of Pawsome Booking's features, your settings, and this agreement are your instructions. We'll tell you if we think an instruction breaks data protection law. We may also process Customer Data where UK law requires it; if so, we'll tell you first unless the law forbids that.
4. Confidentiality
Anyone we allow to access Customer Data is bound to keep it confidential, and only accesses it where needed to run, support or fix the service.
5. Security
We take appropriate technical and organisational measures to protect Customer Data, including:
- encrypted connections (HTTPS) for all traffic, and encryption of stored data and backups by our database provider;
- each business's data kept separate, with checks in the database itself, and automated tests that one business can't see another's data;
- passwords stored only as salted hashes, email verification, sign-in rate limiting and signed links for customers' booking management;
- restricted administrator access, granted only from a machine with database access and recorded in an audit log;
- database backups with point-in-time recovery, and a documented recovery process.
6. Sub-processors
You authorise us to use the sub-processors below. Each is bound by written terms giving at least the same protection as this agreement, and we remain responsible to you for their work.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the website and app | Runs in London (UK). US company |
| Neon (Databricks, Inc.) | Database storage and backups | Stored in London (UK) on Amazon Web Services. US company |
| Resend (Plus Five Five, Inc.) | Sending emails (confirmations, reminders, account emails) | Sent from Ireland (EU). US company |
| postcodes.io (Ideal Postcodes Ltd) | Finding where a postcode is, for mobile groomers' travel areas and routes. Only the postcode is sent | UK |
| Sentry (Functional Software, Inc.) | Error alerts, so we can fix problems quickly. Personal details are removed before sending | Stored in Germany (EU). US company |
| Stripe Payments UK Ltd | Collecting the £9.99 subscription from businesses | UK, with processing in the EU and US |
Card payments from your customers go through your own Stripe account under your own agreement with Stripe, so Stripe isn't our sub-processor for those.
We'll email you at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't address your concern, you may close your account and we'll refund any unused prepaid subscription.
7. International transfers
Customer Data is stored in the UK. Some sub-processors are US companies that may access it, for example for support or maintenance. We only allow this where the transfer is protected under UK data protection law: through the UK's data bridge with the US for certified companies, or the ICO's International Data Transfer Agreement or Addendum.
8. Helping you
- Your customers' rights: you can view, correct and erase a customer's data yourself from their customer page. If you need more help, for example a copy of a customer's data, we'll provide it within 10 working days of your request. If a customer contacts us directly, we'll pass the request to you rather than answering it ourselves.
- Data breaches: if we become aware of a breach affecting Customer Data, we'll tell you without undue delay, and aim to within 48 hours, with what we know, its likely effects and what we're doing about it. We'll keep you updated as we learn more, so you can meet your own duty to report it to the ICO where needed.
- Assessments: we'll give you reasonable information to help with data protection impact assessments or consultations with the ICO about our service.
9. When you leave
Before closing your account, you can ask us for a copy of your Customer Data in a standard format (such as a spreadsheet file), which we'll provide within 10 working days. Within 90 days of your account closing, we delete Customer Data from our live systems. It is then overwritten in backups within a further 30 days. We keep anonymised appointment records and our own billing records, and anything else UK law requires us to keep.
10. Information and audits
We'll make available the information reasonably needed to show we meet this agreement, and answer your reasonable questions in writing. If that isn't enough, you may audit our compliance (or appoint an independent auditor bound by confidentiality) once a year, with 30 days' notice and at your cost.
11. Your responsibilities
You are responsible for having a lawful basis for the Customer Data you collect and the emails you choose to send (rebooking invitations are marketing, so only send them to your own customers, who can opt out when they book and in every email), for telling your customers how you use their data (you can point them to our privacy notice for the part we handle), and for the accuracy of what you enter. You also handle any data held in your own Stripe account.
12. General
If this agreement and the terms of service conflict on data protection, this agreement wins. Liability under this agreement is subject to the limits in the terms of service, except where the law doesn't allow liability to be limited. We may update this agreement to reflect changes in law or in our sub-processors, with notice as above. This agreement is governed by the laws of England and Wales. Questions go to hello@pawsomebooking.co.uk.