With regard to the personal data of the business end customers (people who book appointments, receive notifications or appear in the Customer diary):

• The Customer is the Controller. It determines the purposes and means, decides what data it collects, on what legal basis and for how long it is retained, and is responsible for informing its own customers and handling their rights requests.
• BookflowR is the Processor. It processes that data solely to provide the contracted service and in accordance with the Customer instructions.

With regard to the Customer own data as a platform user (account, billing, support and service usage data), BookflowR acts as Controller, and that processing is governed by the Privacy Policy, not by this DPA.

BookflowR shall process the personal data supplied or generated by the Customer for the sole purpose of providing the booking management and customer communication service described in the Terms: creating and managing appointments, diary and schedules, customer records, sending confirmations and reminders through the enabled channels, handling conversations through the automated assistant, publishing the booking page, generating statistics for the Customer, and technical support.

BookflowR shall not use end customer data for its own purposes, nor sell, assign or make it available to third parties for commercial purposes, nor use it to train its own or third-party artificial intelligence models.

This DPA remains in force for as long as the contractual relationship lasts and the Customer maintains an active BookflowR account. The confidentiality and security obligations survive termination for as long as the Processor retains data on behalf of the Controller.

Categories of data subjects: end customers and prospective customers of the business, as well as staff and collaborators the Customer registers on the platform.

Types of personal data processed on behalf of the Customer:

• Identification and contact data: name and surname, phone number, email and, where applicable, channel identifier (WhatsApp number, Telegram username, Messenger or Instagram identifier).
• Booking data: service requested, date and time, assigned professional or table, location, amount, status and appointment history, together with any notes and custom fields the Customer chooses to configure.
• Communication content exchanged with the business through the connected channels, including conversations with the automated assistant.
• Technical data associated with use of the public booking page (IP address, session identifiers, access logs).

Special categories of data (GDPR art. 9). BookflowR neither requests nor requires health data or any other special category. However, certain sectors (clinics, physiotherapy, advanced aesthetics, psychology) may enter such data in free-text fields, notes or even in the service name itself. The Customer is solely responsible for deciding whether to enter such data, for having a valid legal basis under Article 9(2) GDPR, and for applying any additional safeguards that may apply to it. The Customer undertakes not to enter special categories of data in publicly displayed fields or in the subject line of automated communications.

In accordance with Article 28(3) GDPR, BookflowR undertakes to:

• Process the data only on documented instructions from the Controller, including with regard to international transfers. The Terms, this DPA and the settings the Customer configures in its panel constitute documented instructions. If BookflowR considers that an instruction infringes data protection law, it shall inform the Customer immediately.
• Ensure confidentiality: every person authorised to process the data has committed to confidentiality on an indefinite basis, including after their relationship with BookflowR ends.
• Implement the technical and organisational measures required by Article 32 GDPR, as described in Annex II.
• Not engage sub-processors other than in accordance with clause 6.
• Assist the Controller, as far as possible and through the platform functionality, in responding to data subject requests to exercise their rights of access, rectification, erasure, restriction, portability and objection.
• Assist the Controller in complying with Articles 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation), taking into account the nature of the processing and the information available.
• Make available to the Controller the information necessary to demonstrate compliance with these obligations.
• Retain no copy of the data once clause 9 has been complied with.

The Customer grants general authorisation for BookflowR to engage the sub-processors listed in Annex III, which are necessary to provide the service (hosting, message delivery, payment processing and the artificial intelligence assistant).

BookflowR shall enter into a contract with each sub-processor imposing data protection obligations equivalent to those in this DPA, and shall remain fully liable to the Customer for the sub-processor performance of its obligations.

BookflowR shall notify the Customer of any addition or replacement of a sub-processor at least thirty (30) days in advance, by email or through a notice in the panel. During that period the Customer may object on reasonable and substantiated data protection grounds; if the objection cannot be resolved, the Customer may terminate the contract without penalty and receive a pro-rata refund of the unused portion of its subscription.

Customer activation. Some sub-processors are only involved if the Customer voluntarily enables the corresponding feature (for example connecting WhatsApp, Telegram, Messenger or Instagram, or enabling the artificial intelligence assistant). By enabling it, the Customer expressly instructs BookflowR to disclose to that provider the data strictly necessary.

Processing location. BookflowR core infrastructure (application servers, database and backups) is located within the European Union. End customer data is stored in the EU.

Access from the United States. BK Modules is incorporated in the State of New Mexico (USA). Authorised personnel may access the systems remotely for administration, maintenance and support purposes, which constitutes an international transfer. That transfer is based on the Standard Contractual Clauses (Module 2: Controller to Processor) approved by Commission Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference and supplemented by the additional measures described in Annex II. In the event of any conflict between this DPA and the Standard Contractual Clauses, the latter shall prevail.

Sub-processors outside the EEA. Transfers to the Annex III sub-processors established outside the EEA are likewise based on Standard Contractual Clauses or on the EU-US Data Privacy Framework where the provider is certified under it.

BookflowR shall notify the Customer without undue delay and in any event within forty-eight (48) hours of becoming aware of a personal data breach affecting data processed on the Customer behalf.

The notification shall be sent to the account contact email address and shall include at least: the nature of the breach, the categories and approximate number of data subjects and records affected, contact details for further information, the likely consequences, and the measures taken or proposed to mitigate it.

It is for the Customer, as Controller, to decide whether to notify the competent supervisory authority (in Spain, the AEPD) within 72 hours and, where applicable, to communicate the breach to data subjects. BookflowR shall provide reasonable assistance for that purpose.

On termination of the contractual relationship, and at the Customer choice, BookflowR shall delete or return the personal data processed on its behalf.

• The Customer may export its business data at any time in a structured, commonly used format from its own panel, free of charge and without BookflowR involvement.
• After cancellation, data remains recoverable for a grace period of thirty (30) days, after which it is permanently deleted from production systems.
• Encrypted backups are retained in line with the applicable retention policy and are automatically overwritten within a maximum of twelve (12) months. During that interval they remain encrypted, isolated and inaccessible for any processing.
• BookflowR may retain data strictly necessary to comply with its own legal obligations (for example, tax and accounting records relating to invoicing), acting as Controller and for the legally required periods.

BookflowR shall make available to the Customer the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by it.

Audits shall be requested in writing at least thirty (30) days in advance, shall take place during business hours without disrupting BookflowR operations, shall be limited to once per year — save where required by a supervisory authority or following a substantiated security breach — and shall be subject to a confidentiality undertaking. BookflowR may satisfy such a request by providing technical documentation, certifications or its providers audit reports where these allow compliance to be reasonably verified.

The Customer warrants that it:

• Has a valid legal basis for processing the data it enters or collects through BookflowR and, where applicable, the consent of data subjects to receive communications through the channels it enables.
• Has informed its end customers in accordance with Articles 13 and 14 GDPR, including the existence of BookflowR as processor.
• Maintains its own record of processing activities and handles data subject rights requests, using the functionality the platform provides for that purpose.
• Uses the service in accordance with applicable law, in particular regarding commercial communications and the use of messaging channels, complying with the relevant providers policies.
• Safeguards its credentials appropriately and diligently manages the permissions of the staff it registers on its account.

Each party shall be liable for damage caused by processing which infringes data protection law where it has not complied with the obligations specifically incumbent upon it, in accordance with Article 82 GDPR. The limitation of liability agreed in the Terms and Conditions applies to this DPA to the extent permitted by mandatory law, and may not limit liability towards data subjects or supervisory authorities.

• Subject matter: provision of the BookflowR booking, diary and customer communication service.
• Duration: the term of the contractual relationship, plus the deletion periods set out in clause 9.
• Nature and purpose: collection, recording, organisation, storage, retrieval, disclosure by transmission, erasure and other operations necessary to provide the contracted service.
• Types of personal data: as described in clause 4.
• Categories of data subjects: as described in clause 4.
• Controller: the business holding the account, whose identification details appear in its billing profile.
• Processor: BK Modules, 102 Gold Ave SW Albuquerque - NM - 87102. Data protection contact: bookflowr@bookflowr.com.

BookflowR applies at least the following measures, reviewed periodically in accordance with Article 32 GDPR:

• Encryption in transit: all traffic is served exclusively over HTTPS with TLS and automatic certificate renewal.
• Encryption at rest for sensitive data: third-party integration credentials and channel access tokens are stored encrypted in the database. Passwords are stored using resistant key derivation functions (salted hashes), never in plaintext or in a reversible form.
• Encrypted backups: automated daily backup of the database and uploaded files, encrypted with AES-256 before leaving the server, replicated to external storage, with periodic automated verification that restoration works.
• Access control: multi-tenant isolation, so each account can only access its own data; role and permission system; administrative access restricted to strictly necessary personnel.
• Traceability: logging of access and of relevant operations on appointments, communications and configuration.
• Pseudonymisation and minimisation: only data necessary for the purpose is collected; channel identifiers are kept separate from content where technically feasible.
• Resilience: error and availability monitoring, rate limiting against abuse, and automated failure recovery.
• Vulnerability management: regular updates of the operating system, framework and third-party dependencies.
• Organisational measures: staff confidentiality undertakings, least-privilege principle and a documented security incident response procedure.

The current version of this list is always available on this page. Last reviewed: 22/08/2026.