1. Parties and roles
You, the business using Zumos, are the controller. We are the processor:
- Company: [company name to be added], trading as Zumos
- Registered in England and Wales, company number [company number to be added]
- Registered address: [registered address to be added]
- Email: [contact email to be added]
- ICO registration: [ICO registration number to be added]
2. What we process
- People: your clients, people who book with you, and your team members
- Data: names, email addresses, phone numbers, appointment details, notes, marketing preferences, and staff working hours and leave
- Purpose: providing the Zumos booking, calendar and client management service
- Duration: for as long as you have a Zumos account
You should not use free-text notes to store special category data (such as detailed health information) unless you have a lawful basis to do so and need it for the service you provide.
3. Our commitments
We will:
- only process the data on your documented instructions, which are these terms and how you use Zumos
- make sure anyone with access to the data is bound by confidentiality
- keep appropriate technical and organisational security measures in place, including encryption in transit and per-business access controls
- only use sub-processors under written terms that give the same protection, and tell you before adding new ones
- help you respond to requests from people using their data protection rights
- tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data
- help you with data protection impact assessments and contact with the ICO where reasonably needed
- delete your data within 90 days of your account closing, unless the law requires us to keep it; you can export it before closing
- give you the information needed to show we meet these obligations and allow reasonable audits
4. Your commitments
- You have a lawful basis for the data you put into Zumos and have told your clients how you use it.
- You only send marketing to clients who have agreed to it.
- You keep your account access secure and remove access for staff who leave.
5. Sub-processors
- Lovable and its infrastructure providers — hosting, database, sign-in and email delivery
- Google — optional sign-in with Google
Where sub-processors handle data outside the UK, we rely on UK adequacy regulations or approved safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. Contact
Questions about this agreement: [contact email to be added]. See also our privacy policy.