Chairtime — data processing terms

Who is who

When you, the artist, keep records about your clients on Chairtime — enquiries, messages, quotes, bookings, payments, notes, consent forms and the health information in them — you are the controller of those records under UK data protection law, and we are your processor. These terms are the contract Article 28 of the UK GDPR requires between us. They form part of the terms & conditions, and you accept them by creating an account or, when they change, by pressing Accept on your dashboard or your studio's pages.

If you run a studio on Chairtime, these terms apply to you as well, for the one kind of client record a studio holds: an enquiry a client sends to the studio as a whole rather than to one artist. The studio is the controller of that enquiry until one of its artists takes it on, when it becomes that artist's record and they are its controller. The studio's artists can read what it asks, never who sent it, while it waits; the studio's owner sees only how many there were. One nobody takes on within 30 days is deleted, and the client told. A studio sees nothing else of its artists' clients: its artists stay the controllers of their own records.

Your own account with us — your name, email, sign-ins, subscription — is different: there we are the controller, and the privacy policy covers it.

What we process, and why

Subject matter and purpose: providing the booking, messaging, payment-recording, consent-form and book-keeping software you use to run your business, and nothing else.
Duration: for as long as your account exists, and then as set out under "When the contract ends".
People: your clients and prospective clients, and anybody whose details they give you, such as an emergency contact.
Data: names, email addresses, phone numbers, home addresses, dates of birth, messages and reference photos, appointment and payment records, and consent-form answers — which include health information, a special category of data, encrypted at rest.

What we promise you

Your instructions only. We process your clients' data only to provide the service as you use and configure it, which is your documented instruction, unless the law requires otherwise — in which case we tell you first, unless the law forbids that. We tell you if we think an instruction breaks data protection law.
Confidentiality. Everybody we allow to access the data is bound to keep it confidential. Our staff do not read your clients' records in the ordinary course of running the service; an administrator investigating a fault can sign in as you, which is recorded with a reason.
Security. We keep appropriate technical and organisational measures in place: encryption in transit, health answers encrypted at rest, private files served only after a check of who is asking, enforced second-factor sign-in for administrators, and a record of administrative actions.
Sub-processors. You give us general authorisation to use the sub-processors listed below. We bind each to data protection terms at least as protective as these, remain responsible to you for them, and give you notice on this page and by email before adding or replacing one, so you can object; if we cannot resolve an objection, you may close your account.
Transfers. Where a sub-processor handles data outside the UK, the transfer is covered by UK adequacy regulations (including the UK–US data bridge) or the ICO's International Data Transfer Addendum.
Your clients' rights. The service lets you find, export and correct a client's records, and we help you with any request — erasure included — you cannot answer with it.
Breaches. We tell you without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting your clients' data, with what we know about it, and help you with your own duties to report it.
Help with the rest. We give you the information you reasonably need for a data protection impact assessment or a consultation with the ICO about the service.
Proof. We make available the information needed to show we keep these terms, and answer reasonable audit questions in writing.

Sub-processors

Only those in the second column receive your clients' data, and only for that job:

Our server hosting provider — runs the application and its database. United Kingdom. Named on request.
Amazon Web Services (Amazon SES and S3) — delivers the emails the service sends and stores uploaded files and backups. London region.
Cloudflare — the network every visit passes through, and the bot check on public forms. Global network, United States company.
Stripe — client payments, which go to your own Stripe account, and identity checks when you ask a client to verify their age. Stripe is also a controller of payment data in its own right. United States and Ireland.
The SMS Works — text reminders: the client's mobile number and the message. United Kingdom.
Anthropic — only if you turn on the AI assistant: the text of an enquiry, up to three of its reference photos, and your past quotes, to draft a reply for you to review. United States.
Google — Google Places, where the platform has address search switched on: what a client types into the address search on your consent form, and the suggestion they pick, to fill in their address. It is asked from our servers, so Google is not told who is asking. And only if you connect Google Calendar: the client's name and the appointment's time, place and reference, written into a calendar in your account. United States.
Meta — only if you connect Instagram or WhatsApp: messages between you and your clients pass through Instagram's or WhatsApp's API, and with WhatsApp your appointment reminders — the client's mobile number, your name, the time and the reference — are sent from your own number. United States and Ireland.
Intuit (QuickBooks) — only if you connect QuickBooks: payments and refunds, with the client's name, posted to your company. United States.

When the contract ends

Before you close your account you can download everything you keep here, consent forms included, from Settings → Closing your account. When the account is closed we delete your clients' records, except where the law requires us to keep something, and backups age out on their normal cycle. If your account is closed some other way, ask us within 30 days and we will return what we still hold.

Your side

As controller you decide what you collect and why, tell your clients how you use their information, and have a lawful basis for it — explicit consent, usually, for the health questions on a consent form. We have written a privacy notice template you can adapt and give to your clients.