Your shop is the data controller for personal data belonging to your customers
(people who book appointments or join your walk-in queue). BarberBot (Matt Goodman, trading as
BarberBot, siamlekbot.com) is the data processor, acting only on your
instructions as set out here. This follows the shape of UK GDPR Article 28.
Name, mobile number, email address (where given), and booking details (service, date, time, barber if selected) — used only to take and manage bookings and walk-ins, send booking confirmations/reminders by SMS or email, show your live queue and schedule, and keep booking records you can view in your owner panel. Never for marketing, profiling, or resale.
Individual booking records are retained only while current or upcoming — once an appointment's date has passed, its record is automatically deleted the following day. BarberBot doesn't keep a history of past bookings.
BarberBot uses the following sub-processors, each for the stated purpose only. You're giving general authorisation for these as of when you accept this agreement — BarberBot will give you reasonable notice before adding or replacing one, so you can object on reasonable grounds.
Password/PIN-protected owner access, HTTPS in transit, and hosting (Render) that encrypts data at rest on its persistent disk.
Your owner panel lets you view, edit, and cancel a customer's current booking directly, so you can respond to most access/correction/deletion requests yourself — and since past bookings are already deleted automatically (see "How long we keep it" above), there's nothing left to look up once an appointment's date has passed. BarberBot will assist with anything the panel doesn't cover.
BarberBot will notify you without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting your data.
At your choice, BarberBot will delete or return all your customers' personal data at the end of the service, and delete existing copies, unless retention is required by law.
Sub-processors above may process data outside the UK. BarberBot only uses sub-processors that provide appropriate safeguards (UK/EU adequacy or Standard Contractual Clauses) for any such transfer.