Data Processing Agreement (DPA)

Last updated: 14 November 2026

This Data Processing Agreement ("DPA") forms part of the Business Subscription Agreement between the legal operator of SPL Bookings and each business subscribing to the SPL Bookings platform.

It explains how personal data is handled when a business uses SPL Bookings to receive and manage customer bookings.

This DPA is intended to support compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Parties and roles

1.1 The Business — Data Controller

The subscribing business is the Data Controller for the customer booking information it collects through SPL Bookings.

The Business decides why it collects customer information and how it uses that information.

1.2 SPL Bookings — Data Processor

SPL Bookings is the Data Processor when it stores, organises and makes booking information available to the relevant Business on that Business's instructions.

The legal operator of SPL Bookings is:

• Legal operator: [Parent or guardian's full legal name]
• Trading name: SPL Bookings
• Business contact address: [Insert business contact address]
• Email: splbookings55@gmail.com
• Website: https://splbookings.co/

The parent or guardian named above must genuinely agree to operate and take responsibility for the business. Their details must not be inserted simply as a formality.

1.3 Separate purposes

SPL Bookings may also process information for its own purposes, such as managing business subscriptions, maintaining platform accounts, preventing fraud, handling support requests and meeting legal obligations.

Where SPL Bookings determines those purposes itself, it may act as a separate Data Controller rather than as the Business's Data Processor. This DPA applies to processing carried out on behalf of the Business.

2. Subject matter and duration

The subject matter is the processing of customer booking information through the SPL Bookings platform.

Processing begins when the Business starts using the platform and continues for the duration of its subscription, together with any reasonable period required to return or securely delete the information.

3. Nature and purpose of processing

SPL Bookings processes personal data to provide booking management services to the Business.

This may include:

• Receiving customer booking submissions.
• Storing booking details.
• Organising bookings for the relevant Business.
• Making booking information available to authorised users of that Business.
• Supporting appointment management.
• Providing booking-related notifications where enabled.
• Maintaining, securing and troubleshooting the platform.

SPL Bookings must not use the Business's customer information for unrelated purposes or sell that information.

4. Types of personal data

Depending on the booking form and services offered by the Business, personal data may include:

The platform is not intended for collecting special category personal data, such as medical information, or criminal conviction information through ordinary booking forms.

Businesses must not request sensitive information unless they have a lawful reason and appropriate safeguards.

5. Categories of data subjects

The information may relate to:

• Customers making bookings.
• Individuals contacting the Business.
• Authorised users of the Business's account, where applicable.

6. Documented instructions

SPL Bookings will process personal data only on the documented instructions of the Business, including instructions contained in:

• This DPA.
• The Business Subscription Agreement.
• Written instructions provided by the Business.
• Agreed platform settings and configuration.

If SPL Bookings is legally required to process information in a different way, it will inform the Business before doing so unless the law prevents that notification.

SPL Bookings will inform the Business if it believes an instruction infringes applicable data protection legislation.

7. Confidentiality

SPL Bookings will ensure that anyone authorised to access customer personal data is subject to appropriate confidentiality obligations.

Access to customer information must be limited to people who genuinely need it to operate, support or maintain the platform.

Customer information must not be disclosed to unauthorised individuals or businesses.

8. Security measures and separation between businesses

SPL Bookings will implement appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, destruction, alteration, disclosure or access.

These measures are intended to include, where appropriate:

• Password-protected accounts.
• Appropriate authentication and account permissions.
• Secure storage and transmission of information.
• Server-side access restrictions between businesses.
• Protection against one Business accessing another Business's customer records.
• Restricted administrative access.
• Appropriate software updates and security maintenance.
• Backups and recovery arrangements.
• Monitoring and investigation of suspected security incidents.

8.1 Separation of business information

Each Business must only be able to access its own booking information through its authorised account.

Business A must not be able to view, retrieve, change or delete Business B's customer information, and the same restriction applies between all other businesses.

These restrictions must be enforced by the platform's underlying access controls and not merely by hiding information on the website's screens.

SPL Bookings may access information where reasonably necessary for authorised technical support, security, maintenance or legal obligations. Such access must be appropriately restricted and protected.

8.2 Accuracy of security statements

SPL Bookings will only describe a security measure as implemented once it has been configured and appropriately checked. The operator should periodically test that one Business cannot access another Business's information.

9. Sub-processors and third-party providers

SPL Bookings may use third-party providers to host, maintain and operate the platform.

The Business gives general written authorisation for SPL Bookings to use the sub-processors identified in the current sub-processor register, provided the requirements in this section are followed.

9.1 Emergent

• Provider: Emergent
• Service: Application development and platform infrastructure, potentially including application hosting and database services.
• Personal data: May include customer booking information and account information, depending on the services and infrastructure used.
• Processing locations: Must be confirmed using Emergent's current data processing documentation and sub-processor register.

SPL Bookings uses Emergent in connection with building and operating the platform. The exact services, processing locations and providers involved must be checked against the current Emergent agreement and documentation.

9.2 GoDaddy

• Provider: GoDaddy
• Service: Domain registration and related domain services, where applicable.
• Personal data: Domain registration and account information may be processed.

If GoDaddy only provides domain registration or DNS services and does not process customer booking information, it will not be treated as a sub-processor of that booking information under this DPA.

If GoDaddy is also used for hosting, email or another service that processes customer booking information, the relevant service and processing must be assessed and added to the register where appropriate.

9.3 Other providers

Any additional provider that processes customer booking information on behalf of SPL Bookings must be assessed and added to the sub-processor register.

SPL Bookings must not treat a provider as an approved sub-processor merely because it is used somewhere in the business.

9.4 Changes to sub-processors

SPL Bookings will inform the Business in writing of intended additions or replacements of sub-processors, giving the Business a reasonable opportunity to object before the change takes effect.

SPL Bookings will impose written data protection obligations on its sub-processors that provide an appropriate level of protection for the information they process.

SPL Bookings remains responsible for the performance of its sub-processors to the extent required by applicable law and its contractual obligations.

10. International transfers

Some providers used to operate SPL Bookings may process information outside the United Kingdom.

Before any restricted international transfer of customer personal data takes place, SPL Bookings will ensure that the transfer complies with applicable UK data protection legislation.

This may require an adequacy regulation, an appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum, and any required transfer risk assessment.

The relevant processing locations and transfer arrangements must be checked against the providers' current documentation.

11. Assistance with individual rights

The Business is responsible for responding to requests from its customers concerning their personal information.

These requests may include requests to:

• Access personal information.
• Correct inaccurate information.
• Delete information.
• Restrict processing.
• Object to processing.
• Receive portable information, where applicable.

SPL Bookings will provide reasonable assistance to the Business, taking into account the nature of the processing and the information available to it.

If SPL Bookings receives a request relating to information it processes on behalf of a Business, it will refer the request to that Business where appropriate rather than independently deciding how to respond.

12. Personal data breaches

SPL Bookings will notify the affected Business without undue delay after becoming aware of a personal data breach involving information processed on that Business's behalf.

Where reasonably possible, the notification will include:

• A description of the incident.
• The types of personal information affected.
• The approximate number of individuals affected, where known.
• The likely consequences.
• Measures taken or proposed to address the incident.

SPL Bookings will cooperate with the Business in investigating and addressing the incident.

The Business remains responsible for deciding whether it must report a breach to the Information Commissioner's Office (ICO) or notify affected individuals.

13. Assistance with compliance obligations

Taking into account the nature of the processing and information available to it, SPL Bookings will provide reasonable assistance to the Business with applicable data protection obligations, including:

• Security of personal data.
• Personal data breach notifications.
• Data protection impact assessments, where required.
• Regulatory consultations, where required.
• Requests from individuals exercising their data protection rights.

14. Retention, return and deletion

When a Business's subscription ends, the Business may request either:

• Return of its customer personal data in an appropriate available format; or
• Secure deletion of its customer personal data.

The Business should make its choice in writing.

SPL Bookings will carry out the agreed process within a reasonable period, unless retention is required by law.

Information held in backups may remain temporarily until the relevant backup deletion cycle. During that period, it must be protected and not used for ordinary business purposes.

SPL Bookings may retain information it is legally required to keep, or information it processes separately for its own lawful purposes, subject to applicable data protection requirements.

15. Audits and compliance information

SPL Bookings will make available information reasonably necessary to demonstrate compliance with this DPA and applicable processor obligations.

The Business may request reasonable information about the platform's data protection and security arrangements.

Where necessary, SPL Bookings will allow reasonable audits or inspections by the Business or an authorised auditor, subject to reasonable notice, confidentiality requirements and safeguards protecting other businesses' information.

Audits must not unnecessarily expose another Business's customer information or compromise platform security.

16. Responsibilities of the Business

The Business agrees to:

• Have a lawful basis for collecting and processing customer information.
• Provide appropriate privacy information to its customers.
• Collect only information necessary for its services.
• Ensure that booking forms are appropriate for the services offered.
• Keep its account credentials secure.
• Give account access only to authorised personnel.
• Respond to customer data protection requests.
• Notify SPL Bookings of relevant changes to its processing instructions.
• Use customer information only for lawful purposes.
• Decide how long it needs to retain its customer booking information.

The Business remains responsible for deciding why and how it processes its customer information.

17. Responsibilities of SPL Bookings

SPL Bookings agrees to:

• Process customer personal data in accordance with documented instructions.
• Maintain appropriate technical and organisational security measures.
• Protect the confidentiality of customer information.
• Maintain appropriate access restrictions between businesses.
• Notify affected businesses of relevant personal data breaches without undue delay.
• Assist with applicable data protection requests and obligations.
• Manage authorised sub-processors appropriately.
• Return or delete customer information as agreed.
• Provide reasonable compliance information.

18. Liability

Each party is responsible for its own obligations under applicable data protection legislation and this DPA.

Nothing in this DPA excludes or limits liability where doing so would be unlawful.

Any additional contractual allocation of liability must be set out in the Business Subscription Agreement or another written agreement between the parties.

19. Changes to this DPA

SPL Bookings may update this DPA where necessary to reflect changes to the platform, processing arrangements, providers or applicable legislation.

Businesses will be notified of material changes.

Where a change materially affects the processing of customer personal data, SPL Bookings will provide the Business with appropriate information and an opportunity to raise relevant concerns.

20. Governing law

This DPA is governed by the laws of England and Wales, subject to applicable legal requirements.

21. Contact information

For data protection enquiries, requests or concerns, contact:

SPL Bookings

Website: https://splbookings.co/

Email: splbookings55@gmail.com

Legal operator: Sajan Patel

Business contact address: splbookings55@gmail.com

Schedule 1 — Processing details

Schedule 2 — Sub-processor register

This register must be checked and completed against the providers actually used before the DPA is put into use.

Important: A provider's appearance in this schedule does not by itself prove that it has been authorised, that it processes booking data, or that the listed security and transfer arrangements are in place. The operator must verify the actual services and current provider documentation.

This DPA is intended to supplement the SPL Bookings Business Subscription Agreement and Privacy Policy. It should be reviewed by the adult legal operator before it is offered to businesses or treated as a signed legal agreement.