Data Processing Agreement

1. Parties and roles

This DPA is between Set Booking Ltd Co (“Set”, the processor), registered in Arizona, United States, and the professional or business that uses Set to manage bookings (the controller).

For client personal data that you collect and manage through Set — such as your clients’ names, contact details, appointment history, and notes — you are the controller and Set acts as your processor, handling that data only to provide the platform to you.

For account data of professionals themselves, and for data Set needs to operate, secure, and bill for the platform, Set acts as an independent controller as described in our Privacy Policy.

2. Subject matter, duration, and nature of processing

Set processes personal data for the duration of your use of the platform, solely to provide booking, scheduling, client management, messaging, and payment features. The categories of data processed include client identification and contact details, appointment and service information, communications, and payment-related metadata (card details are handled directly by Stripe and never stored by Set). Data subjects are your clients and staff.

3. Instructions

Set processes personal data only on your documented instructions, which consist of your use of the platform’s features and this DPA, unless processing is required by applicable law. Set will inform you if it believes an instruction infringes applicable data protection law.

4. Confidentiality and security

Set ensures that persons authorized to process personal data are bound by confidentiality obligations. Set implements appropriate technical and organizational measures, including encryption in transit, access controls, hashed credentials, and isolation between business accounts, to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access.

5. Sub-processors

You authorize Set to engage sub-processors to provide the platform. Current sub-processors include our cloud hosting provider (United States), Stripe (payment processing), Twilio SendGrid (transactional email), and Expo (mobile app delivery and push notifications). Set imposes data protection obligations on its sub-processors that are no less protective than those in this DPA, and remains responsible for their performance. Set will give notice of material changes to its sub-processors, and you may object on reasonable data protection grounds by stopping your use of the platform.

6. International transfers and Standard Contractual Clauses

Set stores and processes personal data in the United States. Where personal data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to Set in the United States, the parties rely on the European Commission’s Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914), which are hereby incorporated into this DPA by reference:

• Module Two (controller to processor) applies, with you as data exporter and Set as data importer.
• Clause 7 (docking clause) applies; Clause 9 option 2 (general authorization of sub-processors) applies with the notice period in Section 5; the optional language in Clause 11 does not apply.
• Clause 17: the clauses are governed by the law of Ireland. Clause 18: disputes are resolved before the courts of Ireland.
• Annex I is completed by Section 2 of this DPA (parties, data subjects, categories, purposes); Annex II is completed by Section 4 (security measures); Annex III by Section 5 (sub-processors).
• For transfers from the UK, the UK International Data Transfer Addendum to the SCCs applies; for Switzerland, the SCCs are adapted as required by the Swiss FDPIC.

7. Assistance and data subject rights

Taking into account the nature of processing, Set assists you in responding to requests from data subjects to exercise their rights (access, rectification, erasure, portability, restriction, and objection). The platform provides self-service tools — including editing and deleting client records and exporting your client list — and Set will provide reasonable further assistance on request via support@set-booking.com.

8. Personal data breaches

Set will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide information reasonably required to help you meet your own breach notification obligations.

9. Deletion and return of data

Upon termination of your account, Set will, at your choice, delete or return the personal data processed on your behalf, and delete existing copies unless applicable law requires further storage. You can export your client data at any time from your dashboard before closing your account.

10. Audits and information

Set will make available the information reasonably necessary to demonstrate compliance with this DPA and, where required by applicable law, allow for and contribute to audits conducted by you or an auditor mandated by you, subject to reasonable notice, confidentiality, and frequency limits.

Contact

Questions about this DPA or requests for a countersigned copy can be sent to support@set-booking.com.