Data processing agreement

Roles and scope

The business is the controller and Fabula the processor of the personal data of the business's customers and team members, for as long as the business uses Fabula.

The data covers names, contact details, bookings, notes the business records and consent choices, processed to take and manage bookings and send messages about them.

What Fabula commits to

Process the data only on the business's documented instructions, which are the business's use of the service.

Make sure everyone with access is bound by confidentiality, and protect the data with appropriate security: encryption in transit, access limited by role, each business's data kept separate from every other's.

Use only the sub-processors listed on our sub-processors page, give at least 30 days' notice before adding one, and hold each to the same obligations.

Help the business answer its customers' requests (copies, corrections, erasure), which it can do from the app, and with security incidents and impact assessments.

Tell the business without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data.

At the end, delete the business's data 30 days after it closes its account (it can export first), except where the law requires us to keep it.

Make available the information needed to show compliance with these terms.

Transfers

Data is stored in the United Kingdom. Where a sub-processor handles data abroad, the transfer is covered by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.