Data Processing Agreement (DPA)

Version: July 19, 2026 (draft)

Introduction

This Data Processing Agreement ('Agreement') governs the processing of personal data by FlexBookz – VOF ('FlexBookz', 'Processor') on behalf of the salon or business using the FlexBookz platform ('Customer', 'Controller'). This Agreement supplements our Terms of Service and applies to all processing of personal data of the Customer's end customers via the FlexBookz platform.

1. Subject matter and duration of processing

FlexBookz processes personal data solely for the purpose of providing the booking software to the Customer, as described in the Terms of Service and Privacy Policy. Processing continues for as long as the Customer has an active FlexBookz account and ends in accordance with section 10 (Return and deletion of data) upon termination of the agreement.

2. Nature and purpose of the processing

FlexBookz processes personal data on behalf of the Customer for the following purposes:

• Managing appointments, bookings and calendars
• Managing customer profiles and customer history
• Processing payments and deposits via the payment provider chosen by the Customer
• Sending reminders, confirmations and, if enabled, marketing communications on behalf of the Customer
• Collecting answers to intake forms configured by the Customer
• Customer support and technical operation of the platform

3. Categories of data subjects and personal data

The processing relates to the following categories of data subjects:

• The Customer's end customers (the individuals who book an appointment with the salon)
• The Customer's staff members who use the FlexBookz platform

The following categories of personal data may be processed:

• Name, email address and phone number
• Appointment, booking and treatment history
• Payment status and payment references (no full card or bank details)
• Intake form data configured by the Customer
• Free-text fields such as customer or appointment notes entered by the Customer's staff

For some verticals (for example tattoo studios, pedicure practices and massage practices), the Customer may configure intake forms that contain special category personal data within the meaning of Article 9 GDPR, such as information about allergies, skin conditions or medical history. See our separate page on health data in intake forms for more explanation.

4. Roles and obligations

The Customer is the data controller and is responsible for, among other things:

• Having a lawful basis for all processing of its end customers' personal data
• Informing end customers about the processing, for example via its own privacy notice
• Obtaining any required explicit consent, for example when processing special category data via intake forms
• Managing user rights and access within its own account

FlexBookz is the data processor and commits to, among other things:

• Processing personal data only on the basis of the Customer's documented instructions
• Ensuring confidentiality among staff who have access to personal data
• Implementing appropriate technical and organizational security measures (see section 6)
• Engaging sub-processors only under the conditions set out in section 5
• Assisting the Customer with data subject requests (see section 7)
• Notifying the Customer of personal data breaches (see section 8)

5. Sub-processors

FlexBookz uses the following sub-processors to deliver the platform:

• Supabase — Hosting, database and authentication (servers within the EU)
• Stripe — Payment processing (optional, if enabled by the Customer)
• Mollie — Payment processing (optional, if enabled by the Customer)
• Pay.nl — Payment processing (optional, if enabled by the Customer)
• SumUp — Payment processing, including card readers (optional, if enabled by the Customer)
• Klaviyo — Email marketing and automated communications (optional, only for end customers who have given consent)
• Twilio — SMS notifications (optional, if enabled by the Customer)
• Expo, Apple and Google — Delivering push notifications in the FlexBookz app

This list is kept up to date as FlexBookz engages new sub-processors or replaces existing ones. FlexBookz will inform the Customer of material changes to this list, so the Customer can object in accordance with the GDPR.

6. Technical and organizational security measures

FlexBookz applies, among others, the following measures to protect personal data:

• Row Level Security (RLS) at the database level in Supabase: each Customer can only reach its own account's data, enforced through role and permission checks within the platform
• Access to sensitive features, such as intake forms, is restricted to the Customer's staff with the appropriate role or permission within the account
• Encrypted connections (TLS/HTTPS) for all data traffic between the user, the platform and the database
• Storage with Supabase, which applies encryption of data at rest as part of its standard infrastructure; this still needs to be confirmed against Supabase's own documentation and data processing agreement
• FlexBookz itself does not store full card numbers or bank details; payment data is processed by the payment provider

7. Assistance with data subject rights

To the extent the Customer cannot handle a request independently within the platform, FlexBookz will provide the Customer with reasonable assistance in responding to data subject requests, such as access, rectification, erasure or data portability, so the Customer can meet its obligations as controller.

8. Data breach notification

FlexBookz will notify the Customer without undue delay after becoming aware of a security incident resulting in a breach of personal data that FlexBookz processes on the Customer's behalf, so the Customer can assess whether and how a notification to the Dutch Data Protection Authority and/or data subjects is required. The exact notification timeframe and process will be further defined after legal review of this Agreement.

9. Audit rights

The Customer has the right, following reasonable prior consultation, to request information demonstrating FlexBookz's compliance with this Agreement. The precise form of this audit right, for example based on questionnaires, reports or an external audit, will be further worked out after legal review.

10. Return and deletion of data

After termination of the agreement between FlexBookz and the Customer, the Customer's personal data will be deleted within the period stated in the Privacy Policy (in principle within 30 days of cancellation), unless a longer retention period is legally required, for example for billing data. At the Customer's request, FlexBookz can, where technically feasible, make an export of the data available prior to deletion.

11. Liability

FlexBookz's liability under this Agreement is limited in accordance with the liability provisions in the Terms of Service.

This liability clause is generic and still requires specific legal input, in particular regarding the allocation of liability between Customer and FlexBookz for GDPR infringements.

12. Contact

FlexBookz – Zonnelaan 13, 7771ER Hardenberg, The Netherlands

legal@flexbookz.com | +31 618994895