Parties and scope
These Data Processing Terms form part of the Terms of Service between the business using Braider Booking AI, as controller, and SAMSON ESHIEBOR trading as Braider Booking AI, as processor, where UK data-protection law applies.
Processing details
Subject matter: storefront, appointment, waitlist, reminder, customer communication and booking-management services.
Duration: while the business uses the service and for any limited period needed for deletion, backups, disputes or legal obligations.
Nature and purpose: collecting, storing, organising, retrieving, transmitting, displaying, updating and deleting information to provide the contracted platform functionality.
Data subjects: customers and prospective customers of the business, and relevant staff or representatives included in booking records.
Personal data: names, email addresses, optional phone numbers, service selections, appointment and waitlist details, booking history, communication records, payment status and related identifiers, plus limited technical security records.
Instructions
We will process controller personal data only on documented instructions from the business, including instructions inherent in its use and configuration of the platform, unless applicable law requires otherwise.
Confidentiality
People authorised to process controller personal data will be subject to appropriate confidentiality obligations and will access that data only where needed for their role.
Security
We maintain measures appropriate to the service and risk, including HTTPS, access controls, password hashing, secure session configuration, tenant separation, CSRF protection, rate limiting, signed access links and controlled production deployment.
Sub-processors
The business gives general authorisation for us to use sub-processors reasonably necessary to provide the service. Current material infrastructure providers include Render, Resend and Cloudflare R2. Stripe is used for payment services and may act under its own data-protection terms rather than solely as our sub-processor.
Where required by law, appropriate data-protection obligations will be put in place with sub-processors. Material changes will be reflected in these terms or related privacy information.
Data-subject requests
Taking account of the nature of the processing, we will provide reasonable assistance to help the business respond to valid data-subject requests. A request concerning business-controlled booking data may be referred to that business.
Personal-data breaches
We will notify the business without undue delay after becoming aware of a personal-data breach affecting controller data and will provide information reasonably available to us that is needed for the business to meet its legal obligations.
Compliance assistance
Taking account of the nature of processing and the information available to us, we will provide reasonable assistance with security obligations, breach assessment, data-protection impact assessments and prior consultation where these relate to processing carried out through the platform.
Return and deletion
On termination or a valid request, we will delete or return controller personal data as reasonably supported by the service unless the law requires retention. Residual backup copies may remain for a limited period until overwritten or securely deleted through the normal backup cycle.
Audit information
We will make available information reasonably necessary to demonstrate compliance with these processor obligations. Any audit must be proportionate and protect the security and confidentiality of other customers.
International transfers
Where processing involves a restricted transfer from the UK, we will use an appropriate transfer mechanism where required by law.
Business responsibilities
The business is responsible for having a lawful basis for customer processing, giving appropriate privacy information, configuring the service lawfully, responding to data-subject requests and ensuring that information entered into the platform is relevant and lawful.
Contact
Data-processing enquiries can be sent to braiderbookingai@gmail.com.