Tickbook

Data processing agreement

Last updated: 2 October 2026

This agreement forms part of the Tickbook terms of service. It covers personal data about your customers that Tickbook processes for you. It's written to meet Article 28 of the UK GDPR (and the EU GDPR where it applies).

  1. Roles. You are the controller and we are the processor of your customers' personal data processed through Tickbook.
  2. What we process. Subject matter and duration: providing Tickbook while it's installed, plus the deletion periods below. Nature and purpose: recording and managing customer accounts, sending statements, receipts and reminders, applying your credit rules at the till and checkout, and syncing with accounting software you connect. Data subjects: your customers who have an account, and your staff who use Tickbook. Personal data: names, email addresses, phone numbers, account activity (sales, payments, references), credit limits and status, notes you add, and records of consent to texts. No special category data, and no card or bank details.
  3. Your instructions. We process the data only on your documented instructions: these terms, this DPA and your settings in Tickbook. If the law requires other processing, we'll tell you first unless the law forbids it. We'll tell you if we think an instruction breaks data protection law.
  4. Confidentiality. Anyone we authorise to process the data is under a duty of confidentiality.
  5. Security. We keep appropriate technical and organisational measures, including: encryption in transit and at rest; encrypted accounting connections; a database role that can't alter records' protections; two-factor authentication on our systems; access limited to named people; nightly encrypted backups. These are described in our privacy policy and may improve over time.
  6. Sub-processors. You authorise the sub-processors listed on tickbook.uk/privacy: Shopify, Railway, Neon, Cloudflare (encrypted backups), Resend, Twilio (if you use texts), and Xero or Intuit (only if you connect them). We'll give you at least 30 days' notice of any new sub-processor. You can object, and if we can't address the objection you may stop using Tickbook. We impose data protection terms on each sub-processor that are no less protective than these, and remain responsible for them.
  7. International transfers. Where a sub-processor processes data outside the UK/EEA, we rely on adequacy regulations or appropriate safeguards (such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses).
  8. Helping you. We'll help you answer requests from your customers exercising their rights. Shopify's data-request and deletion webhooks are handled automatically, as described in the privacy policy. We'll help you with security, breach notification, data protection impact assessments and prior consultation, where relevant to Tickbook.
  9. Breaches. We'll tell you without undue delay, and aim for within 48 hours, after becoming aware of a personal data breach affecting your data. We'll tell you what we know and what we're doing, and update you as we learn more.
  10. Deletion. When you uninstall, we keep your data for 48 hours in case you reinstall, then delete it when Shopify asks (shop/redact), except where the law requires us to keep it. Backups age out within 30 days.
  11. Audits. We'll make available the information reasonably needed to show we comply with this agreement. We'll allow audits by you or an auditor you appoint, on reasonable notice, at your cost, no more than once a year, unless a breach or a regulator requires more.
  12. Liability. The liability limits in the terms of service apply to this agreement, except where the law doesn't allow it.