Data Processing Agreement
Between Yasin Bokhari trading as Beautrix and you, the artist Version 1.0 · 10 September 2026
Why this exists
When a client books you through Beautrix, she gives you her details. In data protection law that makes you the controller — you decided to collect it, you decided what it is for, you decide how long to keep it. Beautrix holds it for you, and that makes us your processor.
The law requires the two of us to have a written contract saying what we may and may not do with it. This is that contract. It is part of the Terms of Service at https://beautrix.app/terms and you accepted it when you subscribed.
The practical upshot: your clients' data is yours. We hold it, we protect it, and we only ever do what you tell us to do with it.
1. What we process, and for how long
| Subject matter | Providing the Beautrix booking software to you |
| Duration | For as long as you have a subscription, plus the 90-day window afterwards |
| Nature and purpose | Storing, displaying, transmitting, backing up and deleting your clients' details so you can take and manage bookings, and so your clients can be told about their appointments |
| Types of personal data | Name; email address; phone number; the address where the appointment happens; appointment date, time and service; amount paid and payment status; any note you or your client added to the booking; the client's booking history with you |
| Categories of data subject | Your clients, and anyone whose details you or they enter — for example a person booking on behalf of someone else |
| Special category data | We do not ask for any. If you type health information into a note — an allergy, a skin condition, a medication — that becomes special category data and you need a lawful basis for it under Article 9. We would rather you did not put it in free text. |
2. Your obligations
You confirm that:
- you have a lawful basis for collecting your clients' data and for asking us to hold it;
- you have told your clients what happens to their details, in a privacy notice of your own — we provide a template at https://beautrix.app/booking-terms-template;
- your instructions to us will not put us in breach of UK data protection law;
- you will not put special category data into free-text fields without a lawful basis for it.
3. Our obligations
3.1 We act only on your instructions
We will process your clients' personal data only on your documented instructions, unless UK law requires otherwise — and if it does, we will tell you before we act, unless the law forbids us from telling you.
Your instructions are: these terms, the Terms of Service, and what you do in the app. Configuring a setting, sending a confirmation, exporting a client list and deleting a booking are all instructions.
We will not use your clients' data for our own purposes. We will not market to your clients. We will not sell it, share it, mine it, or use it to train anything. We will not contact your clients except to send the messages you asked us to send on your behalf.
3.2 Confidentiality
Everybody who can reach your clients' data is bound by a duty of confidence, in writing, that survives them leaving.
3.3 Security
We take the technical and organisational measures required by Article 32. They are listed in full at https://beautrix.app/security and summarised as: encryption in transit and at rest, row-level access control so one artist can never see another's data, multi-factor authentication on every administrative account, least-privilege access, logging, backups tested for restore, and a named person accountable.
3.4 Sub-processors
You give us general authorisation to use the sub-processors listed at https://beautrix.app/sub-processors. That list is current and we maintain it.
If we want to add or replace one, we will tell you at least 30 days beforehand by email. If you object on reasonable data protection grounds, tell us within those 30 days and we will either find another way or, if we cannot, you may cancel without penalty and get a refund for the time you have paid for and will not use.
Every sub-processor is bound by written terms at least as protective as these, and we remain fully liable to you for what they do.
3.5 Helping you with your clients' rights
If a client asks us directly for access, correction, deletion, restriction, portability, or objects to processing, we will not act on it ourselves. We will pass it to you without undue delay and tell the client we have done so, because acting without your instruction would breach this agreement.
We will help you respond: the app lets you find, export, correct and delete any client's data yourself, at any time, without asking us. If you need something the app cannot do, ask and we will help at no charge.
3.6 Helping you with breaches, assessments and the ICO
We will help you with your obligations under Articles 32 to 36 — security, breach notification, data protection impact assessments, and consulting the ICO — taking account of what we know and what you do not.
3.7 Telling you about a breach
If there is a personal data breach affecting your clients' data, we will tell you without undue delay after becoming aware, and in any event within 48 hours.
We commit to 48 hours because your 72-hour clock for telling the ICO starts when we tell you, and you need time. We will tell you what happened, what data and roughly how many people are affected, the likely consequences, and what we have done — and if we do not have all of that yet, we will send what we have and follow up rather than wait.
3.8 What happens at the end
When your subscription ends, we keep your clients' data for 90 days so you can export it or come back. After that we delete it, including from backups within a further 30 days, unless UK law requires us to keep something — which for your clients' booking data it does not, though it does for our own invoice records.
You can tell us to delete sooner, and we will.
3.9 Audits
We will make available everything you need to show that we are meeting these obligations, and we will allow for and contribute to audits and inspections by you or an auditor you appoint.
In practice, for a business of our size: ask us anything and we will answer, and our security measures, sub-processor list and breach history are published. If you need something more formal, tell us what and why — we will do what is reasonable, and we may ask you to cover the cost of anything that is not.
4. International transfers
Your clients' data is stored in the United Kingdom and the European Economic Area.
Some sub-processors are US-based. Where personal data reaches them we rely on the UK's adequacy regulations for the US where the company is certified under the UK Extension to the EU–US Data Privacy Framework, and on the ICO's International Data Transfer Addendum where it is not. We check certification status rather than assume it, because a company can withdraw from the framework. The current position for each sub-processor is in the list at https://beautrix.app/sub-processors.
5. Liability, and law
Our liability under this agreement is subject to the limits in the Terms of Service at https://beautrix.app/terms — except that nothing limits either party's liability to a data subject or to the ICO, which the law does not allow us to contract out of.
Governed by the law of England and Wales.
6. If this and the Terms of Service disagree
On anything about personal data, this agreement wins.