Data processing
Businesses using CaliDiary often ask whether they need a data processing agreement with us. This page explains who is responsible for which data, and sets out our data processing terms for the few cases where we might handle personal data on your behalf. These terms form part of our terms of service and apply automatically, without anything to sign.
The short version. Your bookings and your customers' details stay on your website, so for that data we are not your processor: we never receive it. We act as your processor only in the limited cases below, such as when you give us access to your website so we can help, and then these terms protect your data.
1. Who is responsible for what
| Data | Who is the controller | Our role |
|---|---|---|
| Your bookings, your customers' details, form answers, uploads, notes, invoices and payment records, stored by CaliDiary on your website | You | None. It stays on your website and hosting, and is never sent to us |
| Data sent to services you connect (such as Stripe, PayPal, Mollie, calendars, video meetings, text messages) | You | None. You connect them with your own accounts; they are your providers, under your agreements with them |
| Customer data we see or receive while helping you (see section 2) | You | Processor, under the terms in section 3 |
| Your CaliDiary account, licence and support details | Us | Controller, as our privacy policy explains |
What CaliDiary Pro sends to us for licence checks and updates (your licence key, website address and software versions) identifies your website, not your customers, and is covered by our privacy policy.
CaliDiary helps you meet your own obligations: it adds suggested wording to WordPress's privacy policy guide, connects to WordPress's tools for exporting and erasing a person's data, and keeps uploaded files in a private folder only your staff can open.
2. When we might handle your customers' data
- Support. If you send us screenshots, exports, log files or other material that contains your customers' details.
- Setup and support services. If we work on your website on a screen-share, or through a temporary WordPress login you create for us (see our support policy).
Please send us only what we need to help you, and remove personal data from files where you can. We never copy your bookings or customers' details from your website to our own systems.
3. Our data processing terms
These terms meet the requirements of Article 28 of the UK GDPR and the EU GDPR.
Details of the processing
| Item | Details |
|---|---|
| Subject matter and purpose | Giving you the support or service you asked for |
| Nature | Viewing data on your website while helping you, and receiving and storing material you send us with a support request |
| Duration | For as long as the support request or service lasts, and then until the material is deleted as described below |
| Types of personal data | What your website holds or you send us: typically names, contact details, booking details, form answers and notes. Possibly special category data (such as health details), if your booking forms collect it |
| Categories of data subjects | Your customers, your staff and other people whose details are in your CaliDiary data |
When we process personal data for you, we:
- process it only to provide the help or service you asked for, and on your documented instructions (your request, and these terms), unless the law requires otherwise, in which case we tell you first unless the law forbids it. We tell you if we think an instruction breaks data protection law;
- make sure everyone who can see it is bound to keep it confidential;
- protect it with appropriate technical and organisational security measures, including encryption in transit, access limited to the staff helping you, two-step sign-in for our staff, and never copying your website's data to our own systems;
- use only the sub-processors listed below. You give us general permission to use them. We will tell you, by updating this page and emailing account holders, at least 30 days before adding or replacing one, so you can object; if you object on reasonable data protection grounds and we cannot resolve it, you can end the affected service and receive a refund of the unused part. We put the same data protection obligations on each sub-processor and remain responsible for them;
- transfer it outside the UK or the European Economic Area only with the safeguards the law requires, as described in our privacy policy;
- help you respond to people using their data protection rights, and with your own obligations on security, breach notification, data protection impact assessments and consulting regulators;
- tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting it, with the information you need to meet your own obligations;
- delete it when the support request or service is complete: material you sent us is deleted within 2 years of the conversation ending (or sooner if you ask), and any login you gave us is no longer used. We keep it longer only if the law requires;
- make available the information you need to show that these terms are met, and allow and contribute to reasonable audits, including inspections, by you or an auditor you appoint, with reasonable notice and confidentiality.
Your part. You confirm that you have a lawful basis for the data, and that your instructions follow data protection law. Please do not give us access to more data than we need.
Liability. Each of us is responsible for its own compliance with data protection law. The limits in our terms of service apply to these terms, except where the law does not allow it.
If these terms and other terms differ, these terms apply to the processing of personal data.
4. Sub-processors
| Sub-processor | What they do | Where |
|---|---|---|
| LightNode | Hosts the server for https://calidiary.com, which holds your CaliDiary account | United Kingdom |
| Our email hosting provider, on a server run by Akamai (Linode) | Receives and stores support emails and the material you attach to them | India (Mumbai) |
| Cloudflare | Protects and delivers https://calidiary.com; data passes through it in encrypted form | Worldwide, nearest to you |
If we hold a screen-share with you, we use a service you choose or agree to, and we do not record the call unless you ask us to.
5. Signed agreement
These terms apply automatically. If your organisation needs a signed copy, email [email protected] and we will send you these terms to sign.
6. Contact
Data protection questions: [email protected].