1. Parties and purpose
This Data Processing Agreement ("DPA") is between Upbeat Software Ltd, trading as Bookabee, a company registered in England and Wales with company number 17140434 ("Bookabee", "we", "us"), and the activity provider that has created a company on the Bookabee platform (the "Customer", "you").
It sets out the terms required by Article 28(3) of the UK GDPR for Bookabee's processing of personal data on your behalf. It forms part of, and is incorporated into, the Bookabee Terms of Service. By creating a company on Bookabee you accept this DPA on behalf of that company. If anything in this DPA conflicts with the Terms of Service, this DPA prevails for matters of data protection.
2. Definitions
- Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and the Data (Use and Access) Act 2025, each as amended and in force from time to time.
- Controller, processor, data subject, personal data, special category data, personal data breach and processing have the meanings given in the UK GDPR.
- Customer Data means personal data that you, or bookers acting through your public booking pages, submit to the platform and that Bookabee processes on your behalf. It does not include your own account data (your name, email, login), for which Bookabee is the controller under its Privacy Policy.
- Sub-processor means a third party engaged by Bookabee to process Customer Data.
3. Roles
For Customer Data you are the controller and Bookabee is the processor. You decide which information to collect for each class, the purposes it is used for and how long it is kept. Bookabee processes Customer Data only to provide the platform to you, as described in this DPA and the Terms of Service.
4. Details of processing
| Subject matter | Taking, managing and communicating about bookings for children's activities you run. |
|---|
| Duration | For as long as your company exists on the platform, and until the Customer Data is deleted under section 11. |
|---|
| Nature and purpose | Storing booking records; taking payment through Stripe; sending transactional emails (confirmations, cancellations, payment notices, waitlist offers) and the class emails you compose; showing registers, booking details and reports to your team; exporting your data on request; operating waitlists; and supporting the above. |
|---|
| Categories of data subjects | Parents and guardians who book (bookers); the children they book places for; people on your waitlists; members of your team. |
|---|
| Categories of personal data | Booker name, email address and phone number; booking reference, status, sessions and payment amounts; attendance records. About the child, only where you enable the field for a class: name, date of birth, year group, photo permission, and the answers to any custom questions you write. |
|---|
| Special category data | Only where you enable the field: medical conditions, allergies, dietary requirements and SEND (special educational needs and disability) information about the child. The platform requires the booker's explicit consent before any of these are submitted and records when it was given; you remain responsible for your own lawful basis under Article 9. |
|---|
| Your instructions | Your documented instructions are: the Terms of Service, this DPA, the configuration choices you make in the dashboard (which fields to collect, which emails to send, who is on your team) and the actions you take there (cancel, refund, export, delete). Any further instruction must be given in writing to hello@bookabee.co. |
|---|
5. Bookabee's obligations as processor
Bookabee will:
- process Customer Data only on your documented instructions, including with regard to transfers outside the UK, unless required to do otherwise by law, in which case Bookabee will tell you before processing unless the law prohibits it (Article 28(3)(a));
- ensure that every person authorised to process Customer Data is bound by a duty of confidentiality (Article 28(3)(b)) — see section 6;
- implement the technical and organisational security measures in section 7 (Articles 28(3)(c) and 32);
- engage sub-processors only as permitted by section 8 (Articles 28(2) and (4));
- assist you in responding to requests from data subjects exercising their rights (Article 28(3)(e)) — see section 9;
- assist you with security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the nature of the processing and the information available to Bookabee (Article 28(3)(f)) — see sections 9 and 10;
- delete or return Customer Data at the end of the service as set out in section 11 (Article 28(3)(g));
- make available the information needed to demonstrate compliance with Article 28 and allow for and contribute to audits as set out in section 12 (Article 28(3)(h));
- tell you immediately if, in Bookabee's opinion, an instruction infringes Data Protection Law;
- not sell Customer Data, use it for its own marketing, or combine one Customer's data with another's.
6. Confidentiality
Access to Customer Data within Bookabee is limited to named staff who need it to operate and support the platform, each bound by written confidentiality obligations. Support access is used only to resolve a problem you have raised or to keep the platform running.
7. Security
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, Bookabee maintains at least the following measures:
- encryption of all data in transit using TLS, and encryption at rest by the database and file-storage providers;
- the production database and application functions hosted in the United Kingdom (AWS London and Vercel's London region);
- passwords stored only as salted bcrypt hashes; signed session tokens in HttpOnly, Secure cookies;
- multi-tenant isolation: every dashboard page and API route checks the signed-in user's membership of the company before reading anything, and every query is scoped to that company;
- role-based access within your team (admin, member, assistant), with the assistant role limited to assigned classes and excluded from financial data;
- bookers' access to their own booking only through an unguessable access token or the booking reference together with their full name;
- card data handled entirely by Stripe and never stored by Bookabee; signature verification on every inbound webhook;
- class emails sent individually to each recipient, never with shared To, Cc or Bcc fields;
- database point-in-time recovery of 24 hours, after which deleted data cannot be recovered from backups;
- prompt patching of dependencies and structured logging of errors and security-relevant events.
Bookabee may update these measures from time to time provided the overall level of protection is not reduced.
8. Sub-processors
You give Bookabee general written authorisation to engage the sub-processors listed in section 6 of the Privacy Policy, which is the current list. Bookabee will:
- impose on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA;
- remain fully liable to you for the performance of each sub-processor's obligations;
- give the admin users of your company at least 30 days' notice by email before adding or replacing a sub-processor that will process Customer Data. If you object on reasonable data protection grounds within that period and the objection cannot be resolved, you may terminate the affected service by deleting your company, and Bookabee will refund any prepaid subscription fees for the remaining period.
9. International transfers
Customer Data is stored at rest in the United Kingdom. Some sub-processors that handle data in flight (for example to send an email or take a payment) operate from the United States. Bookabee will not transfer Customer Data outside the United Kingdom unless the transfer is covered by a mechanism recognised under Chapter V of the UK GDPR: an adequacy regulation, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
10. Assistance, data subject rights and personal data breaches
- Data subject requests. The dashboard lets you view, correct, export and erase a booker's and child's data yourself. If Bookabee receives a request directly from a data subject about Customer Data, it will pass it to you within 5 working days and will not respond substantively except on your instruction. Where you need help responding, Bookabee will assist so that you can meet the one-month statutory deadline.
- Personal data breaches. Bookabee will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data, by email to your company contact address and admin users. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point, and will be supplemented as further information becomes available, so that you can meet your own 72-hour obligation to the ICO where it applies.
- Impact assessments. Bookabee will provide the information about its processing that you reasonably need for a data protection impact assessment or a prior consultation with the ICO.
11. Deletion and return
- At any time you can export all Customer Data in CSV form from the Export tab, and delete it per booking or by deleting a class.
- Deleting your company from its Settings page deletes all Customer Data in it (classes, sessions, bookings, field answers, waitlists, email history, images) immediately, subject to the 24-hour backup window in section 7.
- If you stop using Bookabee without deleting your company, Bookabee will delete the Customer Data within 30 days of your written request to hello@bookabee.co, and will confirm when it has done so.
- Bookabee may retain Customer Data only to the extent and for the period required by law (for example, transaction records held by Stripe under financial regulation), and will continue to protect it under this DPA for as long as it is retained.
12. Audit and information
On written request, no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach, Bookabee will make available the information reasonably necessary to demonstrate compliance with Article 28, including answers to a written security questionnaire. Where this is not sufficient, Bookabee will allow and contribute to an audit, including an inspection, by you or an independent auditor you appoint, on at least 30 days' notice, during normal business hours, under reasonable confidentiality terms, and in a way that does not compromise the security or data of other customers.
13. Your obligations
As controller, you are responsible for:
- having a lawful basis for the Customer Data you choose to collect, including a condition under Article 9 for any special category fields you enable;
- providing bookers with a privacy notice that names Bookabee as a processor (there is a Privacy URL field in your company settings for this);
- registering with the ICO where required and paying the data protection fee;
- deciding and applying a retention period for Customer Data using the deletion tools provided;
- keeping your team's access appropriate: inviting only people who need it, assigning the lowest suitable role, and removing leavers promptly;
- ensuring your instructions to Bookabee comply with Data Protection Law.
14. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except that nothing limits either party's liability for anything that cannot be limited by law.
15. Term and changes
This DPA takes effect when you create a company on Bookabee and continues until all Customer Data has been deleted or returned under section 11. For a company created before 17 October 2026, it takes effect on the earlier of an admin accepting it in the dashboard and 30 days after Bookabee notifies the company's admins of it by email. Bookabee may update this DPA to reflect changes in law or in the platform; material changes will be notified to admin users by email at least 30 days before they take effect, and the version and date at the top of this page identify the current text. Continued use of the platform after that date constitutes acceptance.
16. Governing law
This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.
17. Contact
Data protection questions, instructions, sub-processor objections and audit requests: hello@bookabee.co. If you need a countersigned copy of this DPA for your own records, email the same address.