Last Updated: 1 October 2026
This Data Processing Agreement ("DPA") forms part of the agreement between BookedFlow ("BookedFlow", "Processor", "we", "us", or "our") and the customer using BookedFlow's services ("Customer", "Controller", or "you").
This DPA governs the processing of Personal Data by BookedFlow on behalf of the Customer in connection with the services provided by BookedFlow.
The purpose of this DPA is to establish the parties' respective obligations regarding privacy, data protection, confidentiality, security, international data transfers, subprocessors, and the processing of Personal Data.
BookedFlow provides digital services that may include lead capture and management, customer relationship management (CRM), appointment scheduling, automated follow-up, email communications, SMS communications, telephone communications, workflow automation, customer support, reporting, and related business services.
In providing these services, BookedFlow may process Personal Data on behalf of its customers.
This DPA applies to such processing and sets out the respective rights and responsibilities of BookedFlow and the Customer.
This DPA applies only to the extent that BookedFlow processes Personal Data on behalf of the Customer.
For the purposes of this DPA:
"Applicable Data Protection Law" means all privacy and data protection laws applicable to the processing covered by this DPA, including, where applicable, the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, the EU General Data Protection Regulation ("EU GDPR"), and applicable United States privacy legislation.
"Controller" means the person or organisation that determines the purposes and means of processing Personal Data.
"Customer" means the individual, company, organisation, or other legal entity using BookedFlow's services.
"Data Subject" means an identified or identifiable individual to whom Personal Data relates.
"Personal Data" means any information relating to an identified or identifiable individual.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
"Processing" means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, transmission, disclosure, restriction, deletion, or destruction.
"Processor" means a person or organisation that processes Personal Data on behalf of a Controller.
"Services" means the services provided by BookedFlow to the Customer.
"Subprocessor" means a third party engaged by BookedFlow to process Personal Data on behalf of the Customer in connection with the Services.
Where BookedFlow processes Personal Data on behalf of a Customer, the Customer generally acts as the Controller and BookedFlow acts as the Processor.
The Customer determines the purposes and means of processing Personal Data.
BookedFlow will process Personal Data only as necessary to provide the agreed Services and in accordance with the Customer's documented instructions, except where BookedFlow is required to process Personal Data by applicable law.
Where BookedFlow independently determines the purposes and means of processing certain Personal Data, BookedFlow may act as a Controller in relation to that processing.
The Customer is responsible for ensuring that its collection and processing of Personal Data complies with Applicable Data Protection Law.
The Customer is responsible for:
Ensuring Personal Data is collected lawfully, fairly, and transparently.
Providing appropriate privacy notices to Data Subjects.
Establishing a valid legal basis for processing Personal Data.
Obtaining consent where consent is required by applicable law.
Maintaining appropriate records of consent where required.
Ensuring Personal Data provided to BookedFlow is accurate and appropriate.
Ensuring that instructions provided to BookedFlow comply with Applicable Data Protection Law.
Responding appropriately to Data Subject requests where the Customer is responsible for doing so.
Complying with applicable email marketing, telephone, SMS, privacy, consumer protection, and electronic communications requirements.
Ensuring that it has the necessary rights and permissions to provide Personal Data to BookedFlow.
The Customer must not instruct BookedFlow to process Personal Data in a manner that violates Applicable Data Protection Law.
BookedFlow will:
Process Personal Data only on documented instructions from the Customer, except where otherwise required by applicable law.
Process Personal Data only as reasonably necessary to provide the Services.
Maintain appropriate confidentiality obligations.
Implement reasonable technical and organisational measures designed to protect Personal Data.
Limit access to Personal Data to persons who require access for legitimate purposes.
Take reasonable measures to prevent unauthorised access to Personal Data.
Provide reasonable assistance to the Customer with applicable data protection obligations where required by law and technically feasible.
Notify the Customer if, in BookedFlow's reasonable opinion, a Customer instruction infringes Applicable Data Protection Law.
The processing of Personal Data necessary for BookedFlow to provide its Services to the Customer.
Personal Data may be processed for the duration of the Customer's use of BookedFlow's Services and for any additional period required for legitimate business, contractual, security, backup, accounting, dispute-resolution, or legal purposes.
Processing activities may include:
Collection.
Recording.
Organisation.
Storage.
Retrieval.
Consultation.
Use.
Transmission.
Communication.
Matching.
Automation.
Modification.
Restriction.
Deletion.
Destruction.
Personal Data may be processed for purposes including:
Lead capture and management.
Customer relationship management.
Appointment scheduling.
Appointment confirmations.
Appointment reminders.
Customer enquiries.
Customer communications.
Email communications.
SMS communications.
Telephone communications.
Automated customer follow-up.
Workflow automation.
Customer support.
Reporting.
Service administration.
Service improvement.
Security and fraud prevention.
Depending on how the Customer uses BookedFlow, Personal Data processed may include:
Full names.
Email addresses.
Telephone numbers.
Business names.
Job titles or professional information.
Appointment information.
Lead information.
Customer information.
Form submissions.
Communications and correspondence.
Customer service records.
Marketing preferences.
Consent records.
Website interaction information.
Technical information associated with use of the Services.
IP addresses and device information where applicable.
Other Personal Data submitted by or on behalf of the Customer.
Customers should not submit special-category, highly sensitive, financial, medical, or other restricted Personal Data unless such processing has been expressly agreed and appropriate safeguards have been implemented.
Data Subjects may include:
Customers.
Prospective customers.
Leads.
Customer representatives.
Employees or representatives of Customer organisations.
Clients of BookedFlow customers.
Website visitors.
Individuals completing forms.
Individuals making enquiries.
Individuals booking appointments.
Individuals receiving communications.
Other persons whose Personal Data is submitted through the Services.
BookedFlow will ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations.
Access to Personal Data will be limited to authorised personnel and service providers who reasonably require access to perform their responsibilities.
Personal Data will not be disclosed to unauthorised third parties except where disclosure is required by applicable law.
BookedFlow will maintain reasonable technical and organisational measures appropriate to the nature of the Personal Data being processed and the risks associated with that processing.
Depending on the Services and systems involved, measures may include:
Access controls.
Authentication mechanisms.
Password protections.
Restricted access to Personal Data.
Secure systems and infrastructure.
Appropriate data storage protections.
Security monitoring.
Procedures for managing security incidents.
Backup and recovery measures where appropriate.
Measures designed to maintain confidentiality and integrity of information.
The Customer acknowledges that no electronic transmission, information system, or storage method can be guaranteed to be completely secure.
The Customer authorises BookedFlow to engage third-party service providers and Subprocessors where reasonably necessary to provide the Services.
Subprocessors may provide services including:
Customer relationship management systems.
Cloud hosting.
Website hosting.
Data storage.
Appointment scheduling.
Email delivery.
SMS communications.
Telephone services.
Payment processing.
Analytics.
Workflow automation.
Customer support technology.
Other infrastructure and technology services.
Where required by Applicable Data Protection Law, BookedFlow will require Subprocessors processing Personal Data on its behalf to provide appropriate privacy, security, and confidentiality commitments.
BookedFlow remains responsible for its obligations under this DPA regarding processing performed by its Subprocessors to the extent required by Applicable Data Protection Law.
BookedFlow may add, replace, or remove Subprocessors as its Services develop.
Where required by Applicable Data Protection Law or an applicable contractual commitment, BookedFlow will provide appropriate information regarding material changes to Subprocessors.
If a Customer has a legitimate data protection concern regarding a new Subprocessor, the parties will work reasonably and in good faith to address that concern.
The Customer acknowledges that BookedFlow and its service providers may process Personal Data in countries other than the country in which the Customer or Data Subject is located.
Where Personal Data is transferred internationally and Applicable Data Protection Law requires safeguards, BookedFlow will use an appropriate lawful transfer mechanism.
Depending on the circumstances, these mechanisms may include:
UK adequacy regulations.
European Commission adequacy decisions.
Standard Contractual Clauses.
The UK International Data Transfer Agreement.
The UK Addendum to approved Standard Contractual Clauses.
Another legally recognised transfer mechanism.
BookedFlow will take reasonable steps to ensure that applicable safeguards are maintained for international transfers where legally required.
Depending on applicable law, Data Subjects may have rights including:
The right to access Personal Data.
The right to correct inaccurate Personal Data.
The right to request deletion of Personal Data.
The right to restrict certain processing.
The right to object to certain processing.
The right to data portability.
The right to withdraw consent where processing is based on consent.
Rights relating to certain automated decision-making activities where applicable.
The Customer remains primarily responsible for responding to Data Subject requests where the Customer acts as Controller.
Taking into account the nature of the processing, BookedFlow will provide reasonable assistance to the Customer where necessary to enable the Customer to respond to valid Data Subject requests.
Where BookedFlow receives a request directly from a Data Subject concerning Personal Data processed solely on behalf of a Customer, BookedFlow may refer the Data Subject to the relevant Customer unless BookedFlow is legally required to respond directly.
The Customer is responsible for determining whether a request is valid and how it should be handled.
If BookedFlow becomes aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer, BookedFlow will notify the Customer without undue delay where required by Applicable Data Protection Law.
Where reasonably available, BookedFlow will provide information concerning:
The nature of the Personal Data Breach.
The categories of Personal Data affected.
The categories of Data Subjects affected.
The likely consequences of the breach.
Measures taken or proposed to address the breach.
BookedFlow will provide reasonable cooperation to assist the Customer in meeting applicable breach notification obligations.
Notification of a Personal Data Breach does not constitute an admission of fault or liability by BookedFlow.
Taking into account the nature of the processing and information available to BookedFlow, BookedFlow will provide reasonable assistance to the Customer with data protection impact assessments where such assistance is required under Applicable Data Protection Law.
Where legally required, BookedFlow will also provide reasonable assistance regarding consultations with relevant supervisory authorities.
Following termination or expiration of the Services, BookedFlow will, upon appropriate request and subject to applicable technical and legal requirements, delete or return Personal Data processed on behalf of the Customer.
BookedFlow may retain Personal Data where:
Retention is required by applicable law.
Retention is necessary for legitimate accounting or record-keeping obligations.
Information is required to establish, exercise, or defend legal claims.
Information remains temporarily within secure backup systems until deleted according to normal retention procedures.
Where Personal Data is retained under one of these circumstances, the protections contained in this DPA will continue to apply where appropriate.
Where required by Applicable Data Protection Law, BookedFlow will make reasonably necessary information available to demonstrate compliance with applicable processor obligations.
Any audit or inspection requested by the Customer must:
Be reasonable and proportionate.
Relate specifically to Personal Data processed on behalf of the Customer.
Be conducted with reasonable advance notice.
Avoid unnecessary disruption to BookedFlow's business.
Protect confidential information belonging to BookedFlow and other customers.
Comply with reasonable security requirements.
The parties may agree to use relevant third-party certifications, reports, assessments, or other compliance documentation where appropriate.
Where BookedFlow processes telephone numbers, email addresses, SMS information, or other communications data on behalf of a Customer, the Customer is responsible for ensuring that communications are lawful.
The Customer is responsible for obtaining appropriate consent or establishing another valid legal basis where required.
The Customer is also responsible for complying with applicable rules relating to:
Marketing communications.
SMS communications.
Telephone communications.
Automated communications.
Consent.
Opt-out requests.
Do-not-contact requests.
Applicable suppression lists.
SMS opt-in information and consent will not be sold or shared with third parties or affiliates for their own marketing or promotional purposes.
Service providers may process such information where necessary to deliver communications or provide supporting services.
Where BookedFlow processes email addresses or sends email communications on behalf of the Customer, the Customer is responsible for ensuring that it has an appropriate legal basis for those communications.
Where applicable, marketing emails should provide recipients with an appropriate mechanism for opting out or unsubscribing.
BookedFlow may use third-party email delivery providers to facilitate email communications.
The Customer's agreement to BookedFlow's Terms of Service, configuration and use of the Services, and other documented instructions provided to BookedFlow constitute instructions for processing Personal Data.
BookedFlow is not required to follow an instruction that would violate applicable law.
If additional processing outside the normal scope of the Services is requested, the parties may agree to additional instructions, safeguards, or fees as appropriate.
The Customer is responsible for the accuracy, quality, and legality of Personal Data supplied to BookedFlow.
BookedFlow is not responsible for independently verifying the accuracy of Personal Data provided by the Customer or Data Subjects.
Where appropriate and technically feasible, BookedFlow may provide functionality allowing Personal Data to be corrected or updated.
Personal Data will be retained only for as long as reasonably necessary to provide the Services or fulfil legitimate contractual, legal, security, accounting, dispute-resolution, or business requirements.
Retention periods may vary depending on:
The type of Personal Data.
The purpose of processing.
Customer instructions.
Contractual obligations.
Applicable legal requirements.
Security and backup requirements.
Each party is responsible for complying with the data protection and privacy laws applicable to its respective activities.
Nothing in this DPA requires either party to violate applicable law.
If changes in applicable law require modifications to this DPA, the parties may make such changes as reasonably necessary to maintain compliance.
The liability of each party arising from this DPA will be subject to the limitations and exclusions contained in the applicable Terms of Service or other agreement between BookedFlow and the Customer, except where such limitations or exclusions are prohibited by applicable law.
Nothing in this DPA excludes or limits liability that cannot lawfully be excluded or limited.
This DPA becomes effective when BookedFlow begins processing Personal Data on behalf of the Customer.
It remains effective for as long as BookedFlow processes Personal Data subject to this DPA.
Upon termination of the underlying Services, this DPA will terminate once BookedFlow has deleted or returned applicable Personal Data, except for provisions that are intended or legally required to survive termination.
Confidentiality, security, legal retention, and other continuing obligations will survive termination where applicable.
This DPA will be governed by the law applicable to the agreement between BookedFlow and the Customer, subject to mandatory requirements imposed by Applicable Data Protection Law.
Nothing in this section limits any mandatory rights or remedies available under applicable privacy or data protection legislation.
If there is a conflict between this DPA and BookedFlow's general Terms of Service concerning the processing and protection of Personal Data, this DPA will take precedence with respect to those data protection matters.
If another written agreement between BookedFlow and the Customer contains more specific data protection requirements, the parties will apply the provisions according to the order of precedence established in that agreement.
BookedFlow may update this DPA where reasonably necessary to reflect:
Changes to the Services.
Changes to privacy or data protection laws.
Changes to processing activities.
Changes to security or compliance requirements.
Changes to applicable international data transfer mechanisms.
The current version will be made available through BookedFlow's website or otherwise communicated to customers where appropriate.
Questions, requests, or concerns relating to this DPA or BookedFlow's processing of Personal Data may be directed to:
BookedFlow
Email:[email protected]
Website: https://bookedflowapp.com/
Business/Legal Entity: Patrick Willie
By entering into an agreement for Services under which BookedFlow processes Personal Data on behalf of the Customer, the parties agree that this DPA forms part of their agreement and applies to such processing.
The Customer's continued use of applicable BookedFlow Services constitutes acknowledgement of this DPA to the extent permitted by applicable law.
END OF DATA PROCESSING AGREEMENT