Data Processing Agreement

1. About this agreement

This Data Processing Agreement (“DPA”) is between you, the business using Veyra (“you”), and Samuel Walton, a sole trader in England trading as Veyra(“we”, “us”). It forms part of our Terms of Service and applies for as long as we process Client Personal Data for you. If this DPA and the Terms disagree about data protection, this DPA wins.

It's written to meet Article 28 of the UK GDPR. You agree to it when you agree to the Terms — by ticking the box when you sign up, or when an owner presses “I agree” in Veyra.

Where we use personal data for our own purposes — like running your account and billing you — we're a controller, and our Privacy Policy applies instead.

2. Words we use

• Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any law that amends or replaces them.
• Client Personal Data means the personal data we process for you through Veyra, described in Annex 1.
• Sub-processor means another company we use that processes Client Personal Data, listed in Annex 3.
• “Controller”, “processor”, “data subject”, “personal data”, “personal data breach” and “processing” mean the same as in the UK GDPR.

3. Who does what

You're the controller of Client Personal Data, and we're your processor. You decide why and how it's processed; we process it for you. Annex 1sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the people it's about.

4. Your instructions

We only process Client Personal Data on your documented instructions. Your instructions are the Terms and this DPA, and what you set up and do in Veyra — for example your settings, switching the AI on or off, sending a campaign or connecting WhatsApp. Any other instructions must be in writing, such as by email, and fit what Veyra does.

If UK law requires us to process Client Personal Data in any other way, we'll tell you before we do, unless that law forbids it. We'll tell you straight away if we think an instruction breaks Data Protection Law.

We won't sell Client Personal Data, use it for our own marketing, or use it to train AI models. We may create anonymous, combined statistics that don't identify anyone, to run and improve Veyra.

5. Confidentiality

Only people who need it to run Veyra — currently Samuel Waltonhimself — can access Client Personal Data. They are bound to keep it confidential and only access it when needed to provide, support or secure Veyra, for example to fix a problem you've reported.

6. Security

We take appropriate technical and organisational measures to protect Client Personal Data, as Article 32 of the UK GDPR requires, taking into account the state of the art, the cost, the kind of data and the risks to the people it's about. Annex 2lists them. We may change them over time, but we won't lower the overall level of protection.

7. Sub-processors

You give us general permission to use sub-processors. The ones we use now are listed in Annex 3.

Before we add or replace a sub-processor, we'll give you at least 30 days' notice by email to the owner's email address, and update this page. You can object on reasonable data protection grounds during that time. If we can't resolve your concern, you can end your plan before the change takes effect and we'll refund anything you've paid for the time after it ends.

Each sub-processor is bound by written terms — usually its standard data processing terms — that protect Client Personal Data in the way this DPA does, and we remain responsible to you for how they process it. Meta also uses some WhatsApp and Instagram data for its own purposes, as a controller under its own terms, which you accept when you connect those accounts.

The push services that carry booking alerts to your team's devices can't read them, so they aren't sub-processors — Annex 3 explains.

8. Data sent outside the UK

Some sub-processors are based in, or process data in, the United States or other countries outside the UK. You authorise those transfers. We'll only make them with safeguards that Data Protection Law accepts — for example UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9. Helping you

Your clients' requests

Veyra shows you each client's record and marketing choice, and clients can opt out of marketing by replying STOP. An owner can erase a client from that client's page in Veyra: their name, contact details, booking account, notes, photos and messages are removed, while anonymised bookings and payments, and signed consultation forms and patch-test records, are kept. For anything else — like correcting a client's details, or giving them a copy of their data — email us at info@try-veyra.comand we'll do it for you promptly, in time for you to meet the one-month deadline.

If one of your clients contacts us about their data, we'll pass the request to you without undue delay and won't answer it ourselves, other than to tell them we've passed it on.

Other help

Taking into account what we do and the information we have, we'll help you meet your obligations on security, personal data breaches, data protection impact assessments (DPIAs) and consulting the ICO. Using AI with health information may call for a DPIA — we'll gladly share what you need about how Veyra works.

10. Personal data breaches

If we become aware of a personal data breach affecting Client Personal Data, we'll tell you without undue delay, and within 48 hours of becoming aware of it, by email to the owner's email address. We'll share what we know — what happened, the kinds and rough number of people and records affected, the likely consequences, and what we're doing about it — and send more as we find it out.

We'll take reasonable steps to contain the breach and limit any harm. As controller, you decide whether to tell the ICO (within 72 hours, where that's required) and the people affected, and we'll help. We won't tell your clients or the ICO on your behalf unless you ask us to or the law requires it.

11. When you leave

When you close your account, email us from the owner's email address. Within 30 days of your written request, we'll delete Client Personal Data from Veyra — or, if you ask, send you a copy first (for example as spreadsheet files) and then delete it. The only exception is anything UK law requires us to keep. Copies in our sub-processors' own records, like text message and email logs, are deleted under their own retention periods.

A lapsed account's data is kept so you can come back, as the Terms explain. We'll give the owner at least 30 days' notice before deleting it.

12. Information and audits

We'll make available the information you reasonably need to check that we're meeting Article 28 and this DPA — usually by answering your questions in writing and sharing relevant documents. If that isn't enough, you (or an independent auditor you choose, bound by confidentiality) may audit our compliance once a year — or more often if a regulator requires it or after a breach — with at least 30 days' notice, during UK business hours, at your own cost, and in a way that doesn't put other businesses' data at risk.

We keep a record of the processing we do for you, as Article 30(2) of the UK GDPR requires.

13. Your responsibilities

As controller, you're responsible for making sure your use of Veyra is lawful. In particular:

• Tell your clients.Your privacy notice should explain how you use their data, including that you use Veyra and its AI assistant to manage bookings and messages. You're welcome to link to section 3 of our Privacy Policy, which explains our part. Veyra doesn't show your privacy notice on your booking page or forms yet, so share it another way — for example on your website, or with a link in your booking policy.
• Have a lawful basisfor each thing you do with clients' data — for example, contract for managing their bookings.
• Take care with health information.Consultation, patch-test and health questionnaire answers are “special category” data. As well as a lawful basis, you need a condition under Article 9 of the UK GDPR. For most beauty and wellness businesses that's the client's explicit consent. Our form templates ask clients to agree to treatment, not to you keeping their health information — if you rely on consent, add a question asking for it to your forms in Veyra.
• Only market to people who've agreed.Marketing by text, email or message needs the client's consent. Veyra records each client's choice to help you.
• Keep it accurate and keep it to what you need. Never put full card numbers or passwords into Veyra.
• Look after your team's access. Give everyone their own login and remove logins when people leave.
• Give lawful instructions. Make sure what you ask us to do complies with Data Protection Law.

If you're not sure where to start, the ICO's guidance for small businesses at ico.org.uk is clear and practical.

14. Liability

Each of us is responsible for our own breaches of this DPA and of Data Protection Law. The limits of liability in our Terms of Serviceapply to this DPA too, except where the law says they can't.

Annex 1 — Details of the processing

Subject matter

Providing Veyra — booking, client management and AI assistant software — to your business.

Duration

For as long as you use Veyra, and afterwards until the data is deleted or returned as set out in section 11.

Nature and purpose

Storing, organising, showing and sending your clients' data so you can take bookings, message clients (including AI replies), keep client records and forms, take deposits, send reminders and campaigns, and see reports. This includes AI processing to write replies, briefings, tidied notes, campaigns, analyses and photo consultations; estimating how likely a booking is to be missed so your deposit rules can apply; and, when you mark a booking as a no-show, charging a no-show fee to a card the client saved with Stripe when paying a deposit.

Types of personal data

Names; contact details (mobile number, email address, WhatsApp and Instagram identifiers); bookings and visit history; missed-appointment counts and no-show likelihood scores; deposits, payments, payment references and references to cards saved with Stripe (never full card numbers); notes, preferences and photos; messages and chat history; marketing choices; packages, gift vouchers and waitlist requests; client booking account logins (passwords stored only as hashes); your team members' names, roles and working hours.

Special category data

Health information — for example in consultation, patch-test and health questionnaire answers, allergy details, notes, photos and messages.

Data subjects

Your clients and potential clients (including people who message you or use your web chat), gift voucher buyers and recipients, and your team members.

Annex 2 — Security measures

• Encrypted connections. Veyra is served over HTTPS, and sign-in cookies are only sent over secure connections.
• Passwords. Team and client passwords are stored only as salted scrypt hashes. Team passwords need at least 10 characters and easy-to-guess ones are turned away; client booking account passwords need at least 8 characters.
• Sign-in sessions.Sign-in cookies are signed and can't be read by scripts on the page (HTTP-only). Changing or resetting a team member's password signs them out on their other devices.
• Password resets and invites. Reset links work once and expire after 30 minutes; team invite links work once and expire after 7 days. For team logins, only a hash of each link is stored.
• Separating businesses.Every request is checked against the signed-in person's business, so no business can see another's data. Settings, billing and client exports are limited to owner logins.
• Rate limits. Repeated sign-in, sign-up and password attempts are limited.
• Checked webhooks. Messages from Stripe, Twilio and Meta are only accepted with a valid signature.
• Sealed secrets.A business's own WhatsApp access token is encrypted (AES-256-GCM) before it's stored.
• Card details.Clients enter card details on Stripe's own pages; they never reach Veyra.
• AI safeguards.Approve mode lets businesses check AI replies before they're sent, the AI hands medical and allergy questions to a person, and AI use has monthly and daily limits.
• People. Only those who need it can access Veyra's systems and data (currently Samuel Walton), under a duty of confidentiality.
• Providers. Sub-processors are bound by written terms, as set out in section 7.
• Breaches. Handled and reported as set out in section 10.

Annex 3 — Sub-processors

These are the companies that may process Client Personal Data for us:

• Railway

  Hosts the Veyra app and its database.

  Data: Everything stored in Veyra.

  When: Always.

• Anthropic (Claude)

  The AI behind client replies, briefings, tidied visit notes, campaigns, the Analyst, photo consultations and set-up drafts.

  Data: What the AI needs for each task: messages, booking details, client notes and preferences, and photos clients send.

  When: Whenever the AI is used. Switching off “Let the assistant answer clients” in Settings stops AI replies to clients, but briefings, weekly summaries and AI tools the team starts still run.

• Resend

  Sends emails: booking confirmations, forms, deposit details, password resets, team invites and weekly summaries.

  Data: Email address, name and the content of the email.

  When: Whenever an email is sent.

• Cloudflare

  Runs the domain name and DNS for try-veyra.com, forwards email sent to info@try-veyra.com, and (when it's switched on) checks that someone building a booking page at try-veyra.com/build is a person (Turnstile).

  Data: Technical connection data, including the IP address and browser details of someone using try-veyra.com/build, and the content of emails sent to us.

  When: Always.

• Twilio

  Sends and receives text messages (SMS).

  Data: Mobile numbers and message content.

  When: Only if the business has texting switched on.

• Meta (WhatsApp and Instagram)

  Sends and receives WhatsApp and Instagram messages. Meta also uses some of this data for its own purposes, under its own terms with the business.

  Data: Phone numbers or Instagram accounts, and message content.

  When: Only if the business connects WhatsApp or Instagram.

Booking alerts to team members who switch them on travel through their phone or browser's own push service — Apple, Google or Mozilla. Alerts are encrypted so the push service can't read them; it only carries them, like a postal service, and isn't one of our sub-processors.

Stripe:when you connect your own Stripe account, Stripe takes card payments for you under your own agreement with Stripe, so it isn't our sub-processor for those payments. We pass Stripe only what it needs to take each payment, like the amount and a booking reference. Stripe also handles Veyra's own billing, which our Privacy Policy covers.

Contact us

Veyra is provided by Samuel Walton, a sole trader in England, trading as Veyra. Email info@try-veyra.com or visit try-veyra.com. Our postal address is available on request from info@try-veyra.com.