Data processing terms
Last updated: 5 October 2026
These terms apply when your business uses Booked by Sandbanks Digital, called Booked here. They set out how Sandbanks Digital Ltd ("we") handles the personal information that you, the business, put into Booked or collect with it. They are part of your agreement with us, and they are the contract that data protection law requires between a controller and its processor.
If your agreement with us says something different about personal information, your agreement comes first. We can agree changes to these terms with you in writing.
1. Who does what
You decide why and how your clients' and staff's information is used in Booked: you are the controller. We handle it for you to provide Booked: we are your processor. For the accounts people sign in with, and for keeping the service secure, we are a controller in our own right, as the privacy notice explains.
2. What is handled
| What for | Providing Booked to you: taking, managing and recording bookings, and telling the people involved |
|---|---|
| How | Collecting, storing, organising, sending (emails, texts, calendar entries, payment requests) and deleting |
| For how long | While you use Booked, and afterwards only as section 10 says |
| Whose information | The people who book with you, and your staff |
| What information | For people who book: name, email address, phone number, time zone, language, the appointment, their answers to the questions you ask, and payment references. For staff: name, email address, role, working hours, connected calendar and video accounts, and what they do on bookings |
| Sensitive information | Only what you choose to ask for. If you ask about health, legal matters or anything similar, you are responsible for having a proper reason to |
3. Your instructions
We handle the information only on your instructions. Your instructions are your agreement with us, these terms, the settings you choose in Booked and the way you use it, and anything else you ask of us in writing that Booked can do. If the law requires us to do something else with it, we will tell you first unless the law forbids that. If we think an instruction breaks data protection law, we will tell you.
4. What you are responsible for
- Having a lawful reason for the information you collect, and collecting no more than you need.
- Telling the people who book what you do with their information. You can link your own privacy notice from your booking form in Settings.
- Choosing how long bookings are kept, and who on your staff can see them.
- Who you invite, the roles you give them, and the accounts they connect.
- Answering the people who ask you about their information. Section 8 says how we help.
5. Our people
Only our staff who need to in order to run or support Booked can see your information, and they are bound to keep it confidential.
6. Security
We protect your information with the measures described in section 9 of the privacy notice: encrypted connections; encryption of answers and of the tokens for connected accounts; sign-in without passwords; roles that limit what each member of staff sees; separation between organisations; an audit log of exports, deletions and changes to settings. We keep them under review and will not make them weaker.
7. Other companies we use
You agree to our using the companies listed in section 7 of the privacy notice, and the services your staff choose to connect. We have data protection terms with each company we choose, and we remain responsible to you for what they do with your information.
Before we add or replace one, we will update that list and email your organisation's owner at least 30 days ahead. If you object on data protection grounds and we cannot find another way, you may stop using Booked and we will refund anything you have paid for the time after you stop.
8. Where it is kept, and helping you
Booked and its database are in the European Union. Where one of the companies in section 7 handles information outside the United Kingdom and the European Economic Area, it does so under the safeguards described in section 8 of the privacy notice. If your business is outside the United Kingdom, you are responsible for telling your clients where their information is kept.
Requests from people. Booked can export everything held about one person and delete it. Your organisation's owner can do both through the API, and we will do either for you on request. If someone asks us directly about information you control, we will pass the request to you and tell them we have.
Assessments and regulators. If you need to assess the risks of using Booked, or to answer a regulator, we will give you the information about Booked that you reasonably need.
9. If something goes wrong
If we learn of a breach of security that affects your information, we will tell your organisation's owner without undue delay. We will say what happened, what information and roughly how many people are affected, and what we are doing about it, and we will keep you informed and help you tell a regulator or the people affected where you have to.
10. When you stop using Booked
On request we will give you an export of your bookings. We will delete your organisation's information within 3 months of the end, or sooner if you ask. Copies in backups go within 30 days after that. We keep only what the law requires us to keep, and will tell you what that is.
11. Checking that we do what we say
We will answer reasonable written questions about how we meet these terms. You, or an auditor you appoint, may also inspect how we handle your information: on at least 30 days' notice, during working hours, not more than once a year unless there has been a breach of security or a regulator requires it, under a duty of confidentiality and at your cost.
12. Everything else
Liability under these terms is as your agreement and our general terms of service provide. These terms are governed by the laws of England and Wales. Questions: [email protected]. Sandbanks Digital Ltd, company number 17268570, 457 Ashley Road, Poole, BH14 0AX, United Kingdom.