How to read this page
This document is designed to work with the other QuickBooking legal pages instead of repeating the same information everywhere.
1. Purpose
This DPA supplements the QuickBooking Terms of Service. It applies when a Customer uses QuickBooking to collect or process personal data relating to people making a booking.
2. Parties
Controller: the organizer Customer using QuickBooking determines why data is collected, what data is requested, how it will be used and how long it must be retained according to its own obligations. For this processing, the Customer generally acts as controller. In this DPA, it is referred to as the Customer or Organizer.
Processor: the QuickBooking platform is operated by DOGOOLLE LTD, Carlyle House, Lower Ground Floor, 235 Vauxhall Bridge Road, London SW1V 1EJ, United Kingdom. Company Number: 16357520. Contact: support@dogoolle.com. For data processed by QuickBooking on behalf of the Organizer, DOGOOLLE LTD generally acts as processor.
3. Subject matter and nature of processing
QuickBooking provides a platform allowing the Organizer to create Booking Events, publish booking forms, create time slots, receive and manage bookings, manage information provided by people making a booking, send notifications, export data and manage payments when the relevant features are enabled.
QuickBooking processes the data only as part of providing these services and according to the Customer documented instructions, unless a legal obligation requires other processing.
4. Duration of processing
Processing begins when the Customer uses QuickBooking to collect or import personal data. It continues for as long as necessary to provide the service.
QuickBooking standard policy provides for booking-related data to be retained for 30 days after the relevant operational period. This period must be read together with the settings available in QuickBooking, the Customer legitimate instructions and applicable legal obligations.
At the end of the applicable period, data is deleted or anonymized unless a legal obligation requires further retention.
5. Data subjects
Categories of data subjects may include people making a booking, candidates, casting participants, audition participants, people registered for an event, recruitment candidates, customers or prospects booking an appointment.
The exact category depends on how the Organizer decides to use QuickBooking.
6. Categories of data
The data processed depends on the form configured by the Customer. It may include first name, last name, email address, phone number, date of birth, category, group, Booking Event, booking date and time, social networks, submitted files, answers to custom fields, booking status, notification history and technical information needed for operation and security of the service.
When candidate payments are enabled, QuickBooking may also process the references and statuses needed to associate a payment with a booking. Full payment card information is processed by Stripe and is not intended to be stored by QuickBooking.
7. Organizer responsibilities
The Organizer is responsible for determining the lawfulness of the processing it carries out with QuickBooking. It is responsible for determining the purposes of processing, the appropriate legal basis, the data that is necessary, the mandatory information to provide to data subjects, appropriate retention periods, handling rights requests and having the necessary authorizations for files or documents it requests.
QuickBooking provides the technical tool but does not determine the specific purposes of each Booking Event.
8. Data minimization
The Organizer agrees to collect only the data necessary for its Booking Event. The presence of a configurable field in QuickBooking does not mean that its use is automatically necessary or legally justified.
The Organizer should assess in particular whether it is necessary to collect a date of birth, social media profiles, photographs, CVs, files or any other custom information.
9. Documented instructions
QuickBooking processes personal data according to the Customer instructions. These instructions result in particular from the Booking Event configuration, the configured form, actions performed in the dashboard, support requests and these contractual terms.
If QuickBooking considers that an instruction clearly infringes applicable data protection law, DOGOOLLE LTD may inform the Customer.
10. Confidentiality
DOGOOLLE LTD ensures that people authorized to process personal data are subject to appropriate confidentiality obligations.
Access to data must be limited to people who need it to provide the service, provide support, maintain the platform, ensure security or comply with a legal obligation.
11. Security
QuickBooking implements technical and organizational measures intended to protect personal data. Depending on the relevant components, these measures include access control, user authentication, customer data isolation, infrastructure protection, technical and security logging, backups needed for service continuity, secure connections where applicable and limitation of administrative access.
Measures are adapted according to risks, the nature of the data and the evolution of the service.
12. Customer team members
The Customer may authorize several team members to access QuickBooking. The Customer is responsible for creating these accesses, permissions granted, removing access that is no longer needed and keeping its users credentials confidential.
It is recommended to assign only the permissions necessary for each user responsibilities.
13. Sub-processors
QuickBooking uses providers needed to provide the service. They may provide hosting, communications, payments and support.
The main providers currently used include Contabo for infrastructure and hosting, Postmark for transactional emails when this feature is used, Twilio for communications and SMS when Messaging features are used, Chatwoot for QuickBooking customer support and Stripe for payments, subscriptions and booking-related payments depending on the plan used.
QuickBooking ensures that its use of providers is governed in accordance with applicable obligations.
14. Changes to sub-processors
QuickBooking may add, replace or remove a provider where necessary for the operation or evolution of the service.
Where required by applicable law, Customers will be informed of changes concerning sub-processors in order to allow them to exercise the rights provided by regulation and their contractual agreements.
15. Rights requests
The Organizer is generally responsible for handling requests made by people who have made a booking. These requests may concern access, rectification, erasure, restriction, portability and objection where that right applies.
QuickBooking provides reasonable assistance to the Customer so that it can respond to these requests where the relevant data is present in the platform.
16. Request received directly by QuickBooking
When a person contacts QuickBooking directly about data collected by an Organizer, QuickBooking normally does not make a decision on the request instead of the Organizer.
Where appropriate, QuickBooking informs the person that they should contact the Organizer, forwards the request to the relevant Customer or assists the Customer in handling it. This procedure respects the Organizer role as controller.
17. Export and portability
QuickBooking may provide functions allowing the Customer to export booking data. These functions may be used to respond to certain rights requests, keep information needed for organization or perform administrative operations.
Once data is exported from QuickBooking, the Customer becomes responsible for storing and protecting it in its own environment.
18. Rectification and deletion
The Customer may use available QuickBooking features to correct or delete data when it is no longer needed or when a legitimate request requires it.
QuickBooking may also assist the Customer where the operation cannot reasonably be performed directly from the dashboard.
19. Personal data breach
Where a personal data breach affecting data processed on behalf of a Customer is identified, DOGOOLLE LTD informs the relevant Customer without undue delay after becoming aware of it, in accordance with applicable obligations.
QuickBooking provides, insofar as information is available, the elements reasonably necessary to allow the Customer to assess the incident and comply with its own obligations. Depending on the situation, this information may include the nature of the incident, categories of data concerned, measures taken or planned and known potential consequences.
The Organizer remains responsible for determining whether notification to a supervisory authority or to data subjects is necessary where it acts as controller.
20. Impact assessment and supervisory authorities
Where required by regulation and reasonably necessary in view of the processing carried out in QuickBooking, DOGOOLLE LTD provides the Customer with the information it has to assist with a data protection impact assessment or consultation with a supervisory authority.
The Organizer remains responsible for determining whether such assessment or consultation is necessary for its processing.
21. Stripe payments
When QuickBooking Pro is used, the Organizer may connect its own Stripe account to receive payments related to bookings. Full payment card information is processed by Stripe.
Stripe responsibilities for data it processes according to its own obligations are governed by Stripe applicable terms and policies. QuickBooking processes only the information needed to integrate payment into the booking workflow.
22. Email and SMS communications
When the Organizer enables the corresponding communications, certain data may be transmitted to providers needed for delivery. This may include the email address for Postmark, the phone number for Twilio, message content and information needed to personalize the notification.
The Organizer must ensure that it has an appropriate legal basis for the communications it configures.
23. International transfers
QuickBooking is operated by a company established in the United Kingdom and may be used by organizations located worldwide. Some sub-processors may also process data from different countries.
Where restrictions on international transfers apply, QuickBooking uses mechanisms recognized by applicable regulation, including where necessary adequacy decisions or regulations, appropriate contractual safeguards and other legally recognized mechanisms.
24. End of service
When the contractual relationship between the Customer and QuickBooking ends, the Customer should retrieve any data it wishes to keep before deletion.
At the end of applicable retention periods, QuickBooking deletes or anonymizes personal data processed on behalf of the Customer unless a legal obligation requires retention.
Copies temporarily present in backup systems may remain for the time strictly necessary for the normal backup cycle before deletion or overwriting.
25. Audit and demonstration of compliance
DOGOOLLE LTD makes available to the Customer the information reasonably necessary to demonstrate compliance with its obligations as processor.
Where applicable law provides for it, the Customer may request additional information or a reasonable audit concerning processing covered by this DPA. Audits must relate to processing carried out for the Customer, respect the confidentiality and security of other customers, be organized with reasonable notice and not disproportionately disrupt the operation of the service. Practical terms may be agreed between the parties.
26. Deletion or return of data
At the end of the service, subject to available features and applicable legal obligations, the Customer may request export or deletion of data.
Where retention is no longer necessary, data is deleted or anonymized in accordance with the QuickBooking retention policy.
27. Contractual hierarchy
This DPA supplements the QuickBooking Terms of Service. In case of contradiction specifically concerning personal data processing carried out by QuickBooking as processor, the provisions of this DPA prevail for that matter.
Annex A - Description of processing
Subject matter: provision of the QuickBooking platform.
Nature: collection, storage, consultation, organization, modification, transmission, export and deletion.
Purpose: management of bookings and features requested by the Organizer.
Duration: duration of the service and applicable retention period.
Data subjects: people making a booking or participating in a Booking Event.
Data: contact details, booking information, custom fields, files and necessary technical data.
Controller: Organizer. Processor: DOGOOLLE LTD / QuickBooking.
Annex B - Technical and organizational measures
QuickBooking applies measures relating in particular to access management, authentication, customer data isolation, infrastructure security, logging, backups, limitation of administrative access, confidentiality of authorized persons and incident management.
These measures may evolve to maintain a level of security appropriate to risks and technical developments.
Annex C - Main sub-processors and services
Contabo: infrastructure and hosting.
Postmark: transactional emails.
Twilio: SMS and communications.
Chatwoot: customer support.
Stripe: payments and financial services.
The list may evolve depending on the features and providers used by QuickBooking.
Contact
For any question about this DPA: DOGOOLLE LTD, Carlyle House, Lower Ground Floor, 235 Vauxhall Bridge Road, London SW1V 1EJ, United Kingdom. Company Number: 16357520. Email: support@dogoolle.com.
Legal validation
These documents are operational templates for QuickBooking. Final review by a GDPR/privacy lawyer is recommended, especially for the DPA, legal bases and retention periods.