Data processing agreement

When you put your customers' details into Olou, they are still your customers and your responsibility. We hold that data for you and only do what you tell us with it. This document is the legal version of that promise, and UK data protection law requires us to have one.

You are the controller: you decide what customer data to collect and why. Sajib Ahmed, trading as Olou, trading as Olou, is the processor: we store and handle it on your instructions.

Your instructions are the act of using the service — everything you do in the app, plus anything you ask us in writing.

• Subject matter: providing the Olou business management service.
• Duration: for as long as your account is open, plus up to 90 days afterwards.
• Categories of people: your customers, your staff, and anyone who submits a request through your public booking page.
• Types of data: names, phone numbers, email addresses, postal addresses, job details and notes, appointment times, prices and payment status, and any free text you choose to enter.

The service is not designed for special category data — health records, for example. If your work means you record such information, tell us first so we can agree what additional measures are needed.

• Only processing personal data on your documented instructions, unless the law requires otherwise — in which case we'll tell you first unless we're legally barred from doing so.
• Keeping it confidential, and making sure anyone with access is under the same obligation.
• Applying appropriate technical and organisational security measures (section 5).
• Helping you respond to requests from individuals exercising their rights.
• Helping you with data protection impact assessments and consultations with the ICO, where relevant.
• Telling you without undue delay if we become aware of a personal data breach affecting your data, with enough detail for you to meet your own notification duties.
• Deleting or returning your data at the end of the agreement, as you choose.
• Making available the information you need to demonstrate we're meeting these obligations, and allowing audits as described in section 7.

You give us general authorisation to use the sub-processors listed below. We remain responsible to you for what they do.

If we intend to add or replace one, we'll give you at least 30 days' notice by email. If you reasonably object on data protection grounds, you may end your subscription without penalty for the remainder of the term.

• Each business's data is isolated at the database level using row-level security, so separation does not depend on the interface behaving correctly.
• Data is encrypted in transit (TLS) and at rest.
• Passwords are stored only as salted hashes and are never visible to us.
• Access within your business is limited by role — engineers, for example, cannot alter job details or see the tools their role does not need.
• Access to production data by us is limited to the smallest number of people necessary to operate and support the service.
• The database is backed up daily by our hosting provider.

Your business records are stored in the United Kingdom. Where a sub-processor is outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

On reasonable written notice, and no more than once a year unless there has been a breach or the ICO requires it, we will provide the information you reasonably need to verify our compliance with this agreement. Where a supplier publishes independent certifications, we may provide those instead of granting direct access to systems containing other customers' data.

You can download your customer list as a spreadsheet from the Customers page at any time, without asking us. For a complete copy of everything else — jobs, tasks, expenses, notes — email privacy@olou.co.uk and we will provide it within 30 days.

When your account closes, tell us whether you want your data returned or deleted; if we hear nothing within 90 days we will delete it. Backups are overwritten on their normal cycle.

You are responsible for having a lawful basis to collect your customers' data in the first place, for telling them how you use it, for keeping it accurate, and for who you give access to inside your business. Removing a staff member's access when they leave is your job, and the Staff page exists so you can do it.