Data processing agreement

Last updated 9 October 2026 · Effective 9 October 2026

1. Scope and parties

This data processing agreement (“DPA”) is between the business using Calybee (“you”, the controller) and Mrutyunjaya Mishra, who operates Calybee (“we”, the processor). It applies whenever we process personal data on your behalf in providing Calybee, and it meets the requirements of Article 28 of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, and equivalent laws elsewhere where they apply. Words such as “controller”, “processor”, “personal data”, “processing” and “personal data breach” have the meanings given in the GDPR.

2. Roles

You decide why and how your clients’ personal data is processed; we process it on your behalf. For data about you as an account holder, we are an independent controller and our privacy policy applies. Payment providers you connect (Stripe, PayPal) and AI assistants you connect (such as Claude) are your own choices, under your own agreements with them, and are not our subprocessors.

3. Instructions

We process personal data only on your documented instructions, which are these terms, this DPA and the settings and actions you take in Calybee (including through apps you connect). If we are required by law to process data otherwise, we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks data protection law.

4. Confidentiality

Anyone we authorise to process your personal data is bound by confidentiality. Access to production data is limited to what is needed to run, support and secure Calybee.

5. Security

We keep appropriate technical and organisational measures in place to protect personal data, taking into account the nature of the data and the risks involved. They are described in Annex 2. We may improve them over time, but will not reduce the overall level of protection.

6. Subprocessors

You give general authorisation for us to use the subprocessors listed in Annex 3. We have written agreements with each that protect personal data at least as well as this DPA, and we remain responsible for them. We will tell account holders by email at least 14 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds and we cannot resolve it, you may close your account.

7. Helping you

Taking into account the nature of the processing, we will help you:

• respond to requests from your clients to exercise their rights. Most can be handled directly in Calybee (you can view, correct and delete client records); for anything else, email us;
• meet your obligations on security, breach notification, data protection impact assessments and prior consultation with authorities; and
• by passing on, without delay, any request we receive directly from one of your clients.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and in any case within 48 hours, with the information we have about what happened, the data and people affected, the likely consequences and what we are doing about it. We will update you as we learn more.

9. International transfers

Our subprocessors process personal data outside the European Economic Area and the United Kingdom, including in Australia and the United States. Where a transfer is to a country without an adequacy decision, it is covered by the European Commission’s Standard Contractual Clauses (2021/914), and for UK data by the UK International Data Transfer Addendum, as incorporated in our agreements with those subprocessors.

10. Deletion and return

When your account closes, we delete your clients’ personal data within 30 days, and copies in backups roll off within a further 30 days, unless the law requires us to keep it. Before closing, you can ask us for an export of your client and booking data.

11. Information and audits

We will make available the information reasonably needed to show that we meet this DPA, and answer reasonable written questions. If that is not enough, you may carry out an audit, at your own cost, with at least 30 days’ notice, during normal working hours, no more than once a year unless a breach or an authority requires it, and under confidentiality. Our subprocessors’ own certifications and audit reports may be used where they cover the question.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the terms of service, except where the law does not allow it. If this DPA and the terms conflict on the protection of personal data, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win.

Annex 1: the processing

Annex 2: security measures

• Encryption in transit: all connections to Calybee, its sites and its providers use TLS.
• Encryption at rest: provided by our database and storage providers.
• Separation of accounts: row-level security in the database, so each account can read and write only its own records; public pages can read only what a published site shows.
• Secrets: payment provider keys are held in an encrypted secrets vault; calendar credentials are held in columns the browser is not permitted to read.
• No card data: clients pay on Stripe’s or PayPal’s own pages; Calybee never receives card numbers.
• Connected apps: each connection to an AI assistant is a separate, revocable grant; it acts through the owner’s own access rules and cannot take payments or read payment keys.
• Access control: production access limited to the operator, protected by strong authentication.
• Resilience: managed backups by our database provider.
• Data minimisation: calendar sync stores busy windows only, never event titles or guests; page views are counted as totals, without cookies.

Annex 3: subprocessors

Questions about this DPA, or to request a signed copy: support@calybee.com.