Version 2026-10-18 · Last updated: 18 October 2026
This data processing agreement ("DPA") is part of the terms of service between the studio ("you", the controller) and DUNGARD SRL, which provides GetBooking ("we", the processor). It sets out how we process personal data for you, as Article 28 of the EU General Data Protection Regulation (GDPR) requires. It applies whenever we process personal data on your behalf, and it is accepted together with the terms. Words such as "personal data", "processing", "controller", "processor" and "personal data breach" have their GDPR meanings.
1. What we process, and why
We process personal data for you only to provide GetBooking under the terms. Annex 1 describes the processing: its purpose, the people it concerns, the kinds of data and how long it lasts.
This DPA does not cover data we handle as a controller ourselves, such as your staff's sign-in accounts, our billing of your studio, and the security of our service. Our privacy policy covers those.
2. Your instructions
We process the data only on your documented instructions. The terms, this DPA, and the way you set up and use GetBooking (your settings, and what you and your staff do in the admin) are those instructions. If we are required by EU or Romanian law to process the data in another way, we tell you first, unless that law forbids it. If we think an instruction breaks data protection law, we tell you.
You are responsible for your instructions being lawful, for having a lawful basis for the processing, and for informing your customers about it.
3. Confidentiality
Only people who need access to provide, support or secure GetBooking can access the data, and they are bound to keep it confidential. Our staff enter your studio's admin only when you allow it, and you see each visit.
4. Security
We take appropriate technical and organisational measures to protect the data, taking into account the state of the art, the cost, and the risks to the people concerned (GDPR Article 32). Annex 2 describes them. We may improve them over time, but will not lower the overall level of protection.
5. Sub-processors
You give us general authorisation to use other processors (sub-processors) to provide GetBooking. The current list, with what each does and where, is in section 6 of our privacy policy.
We tell you at least 30 days before we add or replace a sub-processor, by email or in the admin. You can object on reasonable data protection grounds within that time. We will then try to find a solution together; if we cannot, you can end the agreement before the change takes effect, without a charge for ending it.
We bind each sub-processor by a written contract to data protection obligations that are at least as protective as this DPA. We remain responsible to you for their work.
6. Transfers outside the EU
Your studio's database and files are stored in the EU, with Scaleway in France. Where a sub-processor processes data outside the European Economic Area, we make sure the transfer is protected as GDPR Chapter V requires: by an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies), or by the Commission's standard contractual clauses with the additional safeguards they require.
7. Helping you
- Your customers' requests: GetBooking lets your customers download their data and ask for erasure from their account, and lets you handle those requests in the admin. If a customer sends a request to us, we pass it to you without delay and do not answer it ourselves unless you ask us to.
- Your other obligations: taking into account what we know, we help you with security, breach notifications, data protection impact assessments and consulting the supervisory authority (GDPR Articles 32 to 36).
8. Personal data breaches
If we become aware of a personal data breach affecting your data, we tell you without undue delay, and in any case within 48 hours. We tell you what we know about what happened, the data and people affected, the likely consequences, and what we have done and propose to do, and we keep you updated as we learn more. This lets you notify the supervisory authority and the people concerned where you need to. Telling you about a breach is not an admission of fault.
9. At the end
When the agreement ends, you can export your data before your studio closes. 90 days after it closes, we automatically erase the personal data we process for you: customer accounts are anonymised, and their contact details, sign-in details, answers, notes, messages and conversations, and your uploaded files are deleted. We keep only what EU or Romanian law requires, such as bookings, payments and invoices for accounting, linked to no named person, only for as long as required, and process it only for that purpose. Copies in our backups are deleted as the backups expire, within 14 days after that.
10. Information and audits
We give you the information you reasonably need to show that we meet this DPA, and answer your questions about it in writing. If that is not enough, or a supervisory authority requires it, you or an independent auditor bound to confidentiality may audit our compliance once a year, with at least 30 days' notice, during working hours and without disrupting the service or accessing other studios' data. Each of us bears our own costs.
11. General
This DPA lasts as long as we process personal data for you. If it conflicts with the terms on data protection, this DPA prevails. The liability limits in the terms apply to this DPA, as far as the law allows. It is governed by Romanian law. If the Romanian and English versions differ, the Romanian version prevails.
Annex 1: Description of the processing
| Subject matter and purpose | Providing GetBooking to the studio: its website, timetable, bookings and waitlists, attendance, passes, memberships and gift cards, payments and invoices, messages to customers, customer conversations, reports, and the optional AI assistants. |
|---|---|
| Nature of the processing | Collecting, storing, organising, retrieving, using, sending, displaying, exporting and deleting data, as the studio sets up and uses the service. |
| People concerned | The studio's customers and prospective customers, including guests who book without an account, attendees booked by others, and parents or guardians booking for children; people who contact the studio through its connected channels. |
| Kinds of personal data | Name, email address, phone number, language; sign-in details (password hash, or a Google account ID); bookings, attendance, cancellations and no-shows; passes, payments, refunds and invoices (card details are held by Stripe, not by us); answers to the studio's own questions; consents; messages and conversations. |
| Special categories | Only if the studio chooses to collect them, for example health information such as injuries in its own questions. The studio is responsible for having a valid reason and a lawful basis to do so. |
| Duration | As long as the studio uses GetBooking, and afterwards as section 9 says. |
Annex 2: Security measures
- Hosting: the database and files are hosted by Scaleway in France, in the EU. The database is encrypted at rest.
- Encryption in transit: all connections to GetBooking and between its parts use HTTPS.
- Separation: each studio's data is kept separate from other studios', and every request is checked against the studio it belongs to.
- Access: staff access is limited by role and permission, which the studio controls. Two-step sign-in and passkeys are available, and a studio can require two-step sign-in. Passwords are stored only as strong one-way hashes, and repeated failed sign-ins are slowed down.
- Credentials: the keys a studio gives us to connect its own services, such as messaging or invoicing, are stored encrypted.
- Records: changes in the admin are recorded with who made them and when. Visits by our staff to a studio's admin need the owner's permission and are shown to the owner.
- Backups: the database is backed up automatically every day, and backups are kept for 14 days.
- Development: changes to GetBooking are reviewed and pass automated tests, including tests that check studios' data stays separate, before they are released.
- Minimisation: we do not use advertising or analytics trackers, and we do not use studios' data to train AI models.