Bookout Data Processing Addendum (DPA)

DRAFT — NOT YET IN EFFECT. Working draft prepared without legal review. A qualified lawyer must review this document before it is published or relied on. Placeholders in [brackets] must be filled in first.

Version: 1.0-draft-2026-07-25 · Effective date: [TBD]

This DPA is part of the Terms of Service between
[Operator legal name] ("Bookout", the processor) and each site owner
(the "Owner", the controller). It applies whenever Bookout processes
personal data of the Owner's clients, subscribers, buyers and visitors
("Member Data") on the Owner's behalf. Owners accept it when they create an
owner account.

1. What processing this covers

- Subject matter & duration — hosting and operating the Owner's site,
for as long as the Owner has an account.
- Nature & purpose — storing and displaying site content; handling
bookings, contact messages, journal subscriptions and email delivery;
recording orders and subscription status.
- Categories of data — names, email addresses, phone numbers, booking
requests and notes, messages, subscription/order records and Stripe
identifiers. No card numbers (they go directly to Stripe).
- Data subjects — the Owner's clients, members, buyers, subscribers and
site visitors.

The Owner instructs Bookout to process Member Data as needed to run the
platform's features; the platform's behavior, this DPA and the Owner's
settings are the complete instructions. Payment data processed by Stripe is
governed by the Owner's own agreement with Stripe.

2. Bookout will

1. Process Member Data only on the Owner's instructions (above), unless the
law requires otherwise — in which case we tell the Owner first where
permitted.
2. Keep Member Data confidential and ensure anyone we authorise to access it
is bound by confidentiality.
3. Protect it with appropriate technical and organisational measures:
encryption in transit (TLS), encrypted storage at rest with our
providers, row-level security isolating each tenant's data, hashed
passwords, access limited to the operator, and secrets kept out of the
codebase.
4. Tell the Owner without undue delay, and within 72 hours of becoming
aware, about any personal data breach affecting their Member Data, with
the information the Owner needs for their own notifications.
5. Help the Owner respond to data-subject requests (access, deletion,
correction) and, taking into account the nature of the processing, with
the Owner's own compliance obligations.
6. Delete or return Member Data when the Owner closes their site, on the
schedule in the Data Retention Policy, except
where law requires longer keeping.
7. Make available the information reasonably necessary to demonstrate
compliance with this DPA. Given the size of the operation, audits are
satisfied by written responses and documentation up to once a year;
on-site audits only where a regulator requires one, at the Owner's cost.

3. Sub-processors

The Owner gives general authorisation for these sub-processors:

We will post changes to this list here and notify Owners by email at least
14 days before adding a sub-processor; an Owner whose reasonable objection
can't be resolved may terminate and export their data.

4. International transfers

Where Member Data leaves the EEA/UK, transfers rely on the sub-processors'
standard contractual clauses or Data Privacy Framework participation.
[Confirm per provider before go-live.]

5. The Owner will

Have a lawful basis and a privacy notice for the Member Data they collect,
use the platform consistently with the
Acceptable Use Policy, and not upload special-category
data the platform is not designed for (e.g. health records — booking notes
are for scheduling context, not medical files).

6. Liability

Liability under this DPA is subject to the limitations in the
Terms of Service.