1. Parties and roles

Controller: the business customer that uses getbookedin.app to manage bookings and related customer records (“Customer”).

Processor: Brandon Grech trading as GetBookedIn, VAT MT30149124, Sierra Court, Flat 7, Triq Dwardu Buttigieg, Ghaxaq GXQ1240, Malta (“Processor”, “we”, “us”).

For personal data that Customers enter about their clients and staff in the course of using the service, the Customer is the controller and we act as processor. For our own account, billing, support, and platform security data, we act as an independent controller as described in our Privacy Policy.

2. Incorporation and acceptance

This DPA is incorporated into the Terms of Service. By creating a business account or otherwise using getbookedin.app as a business customer, the Customer accepts this DPA. If there is a conflict between this DPA and the Terms on data-protection matters, this DPA prevails.

3. Subject matter, duration, nature and purpose

• Subject matter: hosting and processing of personal data that the Customer (and its authorised users) submit to getbookedin.app so we can provide booking and scheduling tools.
• Duration: for the term of the Customer’s use of the service, and thereafter only as required to delete or return data or to meet legal retention duties (including Malta fiscal rules for invoices and receipts).
• Nature: collection, storage, retrieval, transmission, and deletion of personal data according to the Customer’s documented instructions (including configuration of the service).
• Purpose: to provide, maintain, secure, and support the getbookedin.app service for the Customer.

4. Categories of data subjects and personal data

Typical categories include:

• Data subjects: the Customer’s staff and authorised users; the Customer’s end clients and booking contacts.
• Personal data: identity and contact details; appointment and scheduling details; optional notes the Customer chooses to store; communications metadata for emails/SMS the Customer configures; account and authentication data; optional calendar connection data when the Customer enables that feature.

The Customer must not instruct us to process special categories of data unless lawful and necessary, and must ensure any such processing complies with applicable law.

5. Instructions

We process personal data only on documented instructions from the Customer, including instructions given through the Customer’s use and configuration of the service, unless Union or Maltese law requires otherwise. In that case we will inform the Customer before processing where legally permitted.

6. Confidentiality

Persons authorised to process personal data on our behalf are bound by confidentiality obligations or an appropriate statutory duty of confidentiality.

7. Security

Taking into account the nature, scope, context, and purposes of processing, we implement appropriate technical and organisational measures under Article 32 GDPR. A high-level description is in Annex II.

8. Sub-processors

The Customer gives general written authorisation for us to engage sub-processors listed in Annex III (as updated from time to time). We will impose data-protection obligations on sub-processors that are no less protective than those in this DPA, so far as applicable to the services they provide. We remain responsible to the Customer for sub-processor performance of those obligations.

We will give the Customer notice of intended additions or replacements to Annex III (for example via the service, email, or an updated DPA page). The Customer may object on reasonable data-protection grounds within 14 days of notice. If we cannot reasonably accommodate the objection, either party may terminate the affected service as its sole remedy.

9. International transfers

Where a sub-processor processes personal data outside the EEA, we will ensure a Chapter V GDPR transfer mechanism applies (such as an adequacy decision or Standard Contractual Clauses), together with any supplementary measures required.

10. Assistance

Taking into account the nature of processing and information available to us, we will assist the Customer, by appropriate technical and organisational measures, in responding to data-subject requests under Chapter III GDPR, and in meeting obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments, and prior consultation), insofar as they relate to processing under this DPA.

11. Personal data breaches

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA, and provide information reasonably available to us to help the Customer meet its own notification duties.

12. Return or deletion

At the end of the provision of processing services, we will delete or return personal data processed under this DPA at the Customer’s choice, and delete existing copies, unless Union or Maltese law requires storage (including retention of fiscal invoices and receipts). Deletion from active systems is completed within a reasonable period after verification of a valid request, subject to those legal retention requirements.

13. Information and audits

We will make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR. Audits or inspections will be limited to what is necessary, subject to confidentiality, security, and operational constraints, and may be satisfied by providing up-to-date security and compliance summaries where appropriate. Unreasonable or overly frequent audits may be charged at cost.

14. Customer responsibilities

The Customer is responsible for the lawfulness of its instructions, for providing any required notices to data subjects, and for ensuring it has a valid legal basis for processing personal data submitted to the service.

15. Governing law

This DPA is governed by the laws of Malta. Disputes are subject to the courts of Malta, without prejudice to mandatory data-protection remedies.

Annex I — Processing details

• Processing activities: storage, retrieval, and transmission of booking and related business data as configured by the Customer; delivery of transactional messages the Customer enables; optional calendar sync when connected by the Customer.
• Frequency: continuous while the Customer uses the service.
• Retention: as set out in section 3 and our Privacy Policy.

Annex II — Technical and organisational measures

• Encryption in transit for traffic between clients and our systems.
• One-way hashing of account passwords.
• Encryption of sensitive third-party connection tokens before storage.
• Access to production systems and stored data limited to authorised personnel who need it to operate, maintain, or secure the service.
• Use of reputable cloud infrastructure providers with industry-standard physical and logical controls.

Annex III — Sub-processors

Current sub-processors (as of the effective date):

• Railway — cloud hosting and related infrastructure.
• Resend — transactional email delivery.
• Twilio — SMS delivery (when enabled).
• GoSMS — SMS delivery (when enabled).
• Google — optional calendar sync; optional AI-assisted catalog import when used.
• Expo — optional mobile push delivery.

Contact

Questions about this DPA: hello@getbookedin.app.