Data processing agreement — SimplyBook.me

Cited by

Facts read from this source

• DPA exists Report an error

  “The Data Processing Agreement of SimplyBook.me Ltd for the SimplyBook.me Online Solution.”

• DPA GDPR article28 Report an error

  “This Data Processing Agreement ("DPA") is entered into pursuant to Article 28 of the EU General Data Protection Regulation ("GDPR") and forms a legally binding contract between the Parties.”

• DPA appointed dpo Report an error

  “The Company has appointed a Data Protection Officer ("DPO") in accordance with European Data Protection Laws which may be contacted for any matters relating to this DPA or the Main Agreement at dpo@simplybook.me.”

• DPA version Report an error

  “Version: 4.1 Last updated: 16/04/2026 Effective date: 16/05/2026”

• DPA electronic acceptance Report an error

  “By clicking to accept, checking a box, or otherwise electronically agreeing to this DPA via the SimplyBook.me Platform, the User acknowledges and agrees to be legally bound by its terms.”

• DPA signed copy download Report an error

  “You can download and get a signed copy of this DPA.”

• DPA roles Report an error

  “The Parties acknowledge that, for the purposes of this DPA, the Company acts solely as Data Processor and the User acts as Data Controller.”

• DPA breach notification Report an error

  “The Company shall notify the Data Controller of any Personal Data Breach without undue delay and in any event no later than 72 hours after becoming aware of the breach, unless a longer period is expressly permitted by applicable Data Protection Laws due to law enforcement requirements or circumstances beyond the Company’s reasonable control.”

• DPA data deletion return Report an error

  “Such deletion or return shall be completed within sixty (60) days of termination or expiration, in accordance with the Company’s standard data deletion procedures, unless retention is required by applicable law. The Company shall provide written confirmation to the Data Controller upon completion of the deletion or return of Personal Data.”

• DPA ISO 27001 Report an error

  “These Security Measures, as detailed in Annex 3, will ensure a level of security appropriate to the risks involved and are in alignment with ISO/IEC 27001 standard as may be updated and in accordance with GDPR Article 32.”

• DPA ISO certification body Report an error

  “The Company shall ensure that the Security Measures form part of its implemented Information Security Management System (the "ISMS"), in line with the current ISO/IEC 27001 standard and maintained certification by an accredited certifying body.”

• DPA external audits annual Report an error

  “At least annually, external audits are conducted by accredited certification bodies for the maintenance of our ISO certification.”

• DPA subprocessor prior authorisation Report an error

  “The Company shall not engage any new Sub-Processor for the Processing of Personal Data pursuant to this DPA and Main Agreement unless it has obtained the prior written authorisation of the Data Controller.”

• DPA subprocessor objection period Report an error

  “The Company will notify the Data Controller in writing of any intention to appoint a new Sub-Processor or remove an existing Sub-Processor and they may object to the proposed change on reasonable and documented data protection grounds by providing written notice to dpo@simplybook.me within thirty (30) days of receiving the notification.”

• DPA scc Report an error

  “Where required, the parties hereby conclude Standard Contractual Clauses which shall be incorporated by reference and form part of this Agreement, as per applicable relevant provisions of Annex 5 below”

• DPA audit rights Report an error

  “The Company will make available all information reasonably necessary to demonstrate compliance with this DPA and may allow for audits, including but not limited to inspections, as reasonably requested by the Data Controller, subject to discretion of the Company.”

• DPA 2FA features Report an error

  “For users of our system, 2FA secure login is available with "Google Authenticator" and "HIPAA" custom features for the User; and Password Management is available with the "Strict Password" custom feature for the User.”

• DPA encryption transit Report an error

  “for data in transit, all external communications are supported via encrypted channels secured with robust standard protocols (up to TLS 1.3 with AES-128 / AES-256 encryption), depending on the software(s) involved and allowed compatibility circumstances; and”

• DPA encryption at rest Report an error

  “for data at rest data encryption is available for SOAP data and medical history with the "SOAP with Data Encryption" custom feature.”

• DPA background checks Report an error

  “background verification checks, such as criminal records checking for all employees and contractors with access to Personal Data;”

• DPA penetration testing Report an error

  “performing regular Vulnerability Assessment and Penetration test campaigns and addressing related remediations/mitigations according to vulnerabilities criticalities and priorities.”

• DPA liability cap Report an error

  “the Company’s aggregate liability arising out of or relating to this DPA, whether in contract, tort, or otherwise, shall not exceed the total fees paid by the Data Controller to the Company under the Main Agreement in the twelve (12) months preceding the event giving rise to the claim.”

• DPA termination notice Report an error

  “This DPA may be terminated by either party with thirty (30) days’ written notice, pursuant to the provisions of the Main Agreement and by cancelling the system in system settings.”

• DPA amendment notice Report an error

  “The Company may amend this DPA by giving You at least 30 days’ written notice and if the Data Controller does not accept the amendment, they may terminate this DPA and the Main Agreement by giving written notice within the notice period.”

• DPA subprocessor list annex4 Report an error

  “Entity Purpose of Processing/Service Location Live Agent Services & Support: live chat services via our website Slovakia (EU) Slack Services & Support: internal communication messaging system USA Linode Services & Support: emails provider outbound UK PandaDoc Services & Support: electronic signatures, where you sign our DPA or other agreements electronically USA Twilio Inc. Services & Support: SMS provider USA”

• DPA subprocessor list URL Report an error

  “Some Sub-Processors will apply as default, and some Sub-Processors will apply only if you integrate them to Your Account, as per the Sub-Processors section of the official website, as may be amended: https://simplybook.me/en/integrations.”

• DPA data categories Report an error

  “categories of Personal Data may vary in accordance with the usage of the System and bookings made by the User’s clients and may include: name, surname, email address and phone number.”

• DPA special category soap encryption Report an error

  “Such information may be submitted by Your clients via the System, at Your sole discretion and request, as notes/additional fields information and/or comments. Note that where you have our SOAP custom feature, data at rest will be encrypted.”

• DPA group entities authorised Report an error

  “The Customer expressly authorises the Company to process Personal Data with its Parent Company and any of its Affiliates (collectively, "Group Entities") provided that:”

• DPA group entity transfers scc Report an error

  “any transfer of Personal Data to Group Entities located outside the European Economic Area (EEA) or United Kingdom will be subject to appropriate safeguards, including the Standard Contractual Clauses (SCC) or UK International Data Transfer Addendum (IDTA), as applicable;”

• DPA dpia assistance Report an error

  “To the extent reasonably possible and where the Data Controller does not otherwise have access to the required information, the Company will provide reasonable assistance to the latter, in connection with any Data Protection Impact Assessments ("DPIA") and any prior consultations with Supervisory Authorities”

• DPA enterprise separate agreement Report an error

  “If you use our enterprise solutions under a separate Software Licensing and Services Agreement, that agreement’s DPA provisions will govern. In the absence of a separately signed DPA, the terms herein apply.”

• DPA previous version available Report an error

  “Previous version available here”

• DPA data subject controls Report an error

  “the Company shall provide them with controls in the Software via which the Data Controller can retrieve, correct, delete or restrict Personal Data”

• DPA data transfer GDPR chapter5 Report an error

  “the Company shall perform any and all Data Transfers subject to the provisions of Chapter 5 (Article 44-50) of the GDPR and always in compliance with the requirements of applicable Data Protection Laws”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Independent Consultant European sovereignty
• The Data Protection Officer European sovereignty
• The Practice Owner European sovereignty
• The Sales Team Lead European sovereignty
• The Salon Owner European sovereignty
• The Skeptic Reminders, payments & no-show protection
• The Skeptic European sovereignty