purebookData Processing Agreement
Last updated 13 November 2026
Terms of Service Privacy Notice
1. Roles and scope
This agreement forms part of the Purebook Terms of Service between your business and Vangarde Limited, trading as Purebook.
- You are the controller of your clients' and staff's personal data that you put into Purebook. You decide what is recorded and why.
- Purebook is your processor. We process that data only to provide Purebook to you, on your documented instructions. The Terms, your settings and your use of the app are your instructions.
- Where we use data for our own purposes, such as billing your account or keeping Purebook secure, we act as a separate controller under our Privacy Notice.
- If anything here conflicts with the Terms on data protection, this agreement wins.
2. The data we process for you
We process it for as long as you use Purebook, to provide booking, client records, payments, messages and reports.
| Whose data | What data | Why |
|---|---|---|
| Your clients | Name, phone, email, date of birth, address, booking history, payments, notes, marketing choices | Bookings, reminders, checkout, marketing you send |
| Your clients | Allergy alerts, patch test results, consultation form answers (health data) | Safe treatment, as recorded by you |
| Your staff | Name, contact details, photo, working hours, pay rate, commission, PIN (stored scrambled) | Diary, permissions, commission and tips reports |
| People who book online | Details entered on your booking pages | Making the booking and taking deposits |
3. What we promise as your processor
We will:
- process your data only on your instructions, and tell you if we think an instruction breaks data protection law;
- make sure everyone at Purebook who can access your data is bound to keep it confidential;
- keep it secure, as set out in section 4;
- use sub-processors only as set out in section 5;
- help you answer your clients' requests and meet your own legal duties (section 8);
- tell you about data breaches (section 7);
- return or delete your data when the service ends (section 9);
- give you the information you need to show we keep to this agreement (section 10).
We will never sell your data, use your clients' details to market to them ourselves, or share them with another salon.
4. Security
Because client records can hold health data, we protect all client data to the standard that health data needs.
- Kept in London. Your database and the servers that run Purebook are in London. Uploaded files, such as client files, photos and logos, are stored in the United States, protected as set out in section 6.
- Encrypted when it travels over the internet and when it is stored.
- Each salon walled off. Every request is checked against the signed-in salon, and an automated test tries to reach other salons' data on every code change.
- Private files. Uploaded files are kept in private storage and are never public web links.
- Staff access in your salon follows the permissions you set. Staff PINs are stored scrambled, never in readable form.
- Our own access is limited to the people who need it to run and support Purebook, and is used only to help you or keep the service running.
5. Sub-processors
You agree that we use the providers below. Each is bound by data protection terms at least as strict as this agreement. We will email you at least 30 days before adding or replacing one. If you have a reasonable objection and we cannot solve it, you may cancel and we will refund any fees paid for the time after you leave.
| Provider | What it does | Where data is held |
|---|---|---|
| Vercel | Runs the app and stores uploaded files | London (app); United States (files) |
| Neon | Database | London |
| Resend | Sends emails | Ireland |
| PureSMS | Sends texts | UK |
| SwiftComplete | Address look-up as you type | UK |
| Anthropic | Answers questions in Ask | United States |
Card payments go through Stripe or Dojo under your own agreement with them (Terms, section 4); they act for you, not as our sub-processors.
6. Transfers outside the UK
We keep your data in the UK where we can. Some providers are based in, or reach data from, the EEA or the United States. Transfers to the EEA rely on UK adequacy regulations. Any transfer elsewhere uses the UK International Data Transfer Addendum or another safeguard UK law allows, and we will give you details on request.
7. Data breaches
If your data is lost, stolen or seen by someone who should not see it, we will tell you within 48 hours of finding out. We will say what happened, what data and how many people are affected, and what we are doing about it, adding details as we learn them. This gives you time to report to the ICO within the 72 hours the law allows you.
8. Helping you with clients' rights
Your clients can ask you to see, correct or delete their data. Purebook lets you do this yourself: find a client, export their record, correct it, merge duplicates, or delete them. If a client contacts us instead, we will pass the request to you and not answer it ourselves. We will also give you reasonable help with data protection impact assessments and with questions from the ICO.
9. When the service ends
You can export your client and booking data at any time, and for 30 days after your account ends. On day 31 we delete your data from Purebook, so it can no longer be exported. Copies in our backups are cleared within 90 days and are never restored for export. We keep only what the law requires, such as our invoices to you, and tell you on request what was kept.
10. Audits, liability and law
- Information first. On request, we will give you the information you reasonably need to check we keep to this agreement. If that is not enough, or the ICO asks you to, you may audit us once a year with 30 days' notice, at your own cost.
- Liability under this agreement falls within the limits in the Terms of Service.
- Law. This agreement is governed by the law of England and Wales.