Style Hub Pro
Data Processing Schedule
1. Parties and scope
This forms part of the Business Platform Agreement. For subscriber-controlled data, the subscriber is controller and the Style Hub Pro legal operator is processor. It applies during the subscription and deletion/return period.
2. Processing
Subject and purpose: hosting/operating diary, booking, client, staff, marketplace, support and notification functions. Nature: collection, storage, organisation, retrieval, authorised transmission, security, backup and deletion. People: clients, prospects, staff, contractors, applicants and contacts. Data: identity, contact, appointments, services, prices, preferences, photographs, communications, roles and limited health/treatment information where lawfully chosen. Do not submit unnecessary card details, criminal-offence data or identity documents.
3. Instructions
We process only on documented instructions in the agreement, configured actions and written support requests unless UK law requires otherwise. We will notify the controller before legally required processing unless prohibited and may suspend an apparently unlawful instruction.
4. Confidentiality and security
Authorised personnel are bound by confidentiality. Measures appropriate to risk include encrypted transport, access controls, tenant separation, least-privilege credentials, authentication, incident/change controls, input limits, backup and recovery. The controller must configure permissions, secure devices/accounts, minimise data and maintain continuity.
5. Sub-processors
The controller generally authorises Supabase, Vercel, Stripe, Resend and, when enabled by the controller, Xero and Twilio/WhatsApp, plus equivalent replacements. We impose equivalent duties and remain responsible as law requires. We will give reasonable notice of a material new sub-processor where practicable for objection on reasonable protection grounds.
6. Transfers
Restricted transfers use an applicable UK adequacy regulation, IDTA or UK Addendum and suitable supplementary measures.
7. Assistance and incidents
Taking account of processing/information available, we reasonably assist with rights requests, security, breach assessment/notification, DPIAs and consultation. We notify the controller without undue delay after becoming aware of a breach affecting its data and provide available assessment information. The controller decides regulatory/individual notices unless law assigns the duty otherwise.
8. Return/deletion
On termination/request we make reasonable existing export functions available. After the export period we delete/anonymise controller data unless law requires retention, subject to backup cycles and legal holds. Backup data remains protected and is not restored for ordinary use.
9. Compliance and audit
We provide information reasonably necessary to demonstrate Article 28 compliance. Audits first use documents/reports, protect other customers/security, occur on reasonable notice and are paid by the controller unless they reveal our material breach. Regulators’ powers are unaffected.
10. Controller duties
The controller warrants its instructions, notices, lawful bases, special-category conditions, consent, retention, permissions and service use comply with law and do not create avoidable harm.