Data processing agreement

Last updated: 30 October 2026

This data processing agreement (the “DPA”) forms part of the terms of service between the Shopify merchant that installs BookSlot (the “Controller”, “you”) and Fenloft FZE (the “Processor”, “we”). It sets out how we process personal data on your behalf, as Article 28 of the GDPR and the UK GDPR and equivalent laws require. It is concluded when you install BookSlot and needs no signature. You can print or save this page for your records; we will countersign a copy on request.

1. Parties, scope and precedence

1. The Processor is Fenloft FZE, a free zone establishment incorporated in the United Arab Emirates and licensed by the Sharjah Publishing City Free Zone Authority (licence no. 4431620.01), registered at Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates, contact support@fenloft.com. The Controller is the legal entity that operates the Shopify store on which BookSlot is installed, identified by that store’s domain and contact details in Shopify.
2. This DPA applies to all personal data that the Processor processes on the Controller’s behalf in providing the Service (“Customer Data”). It does not apply to data the Processor processes as a controller (the Controller’s account, billing and support records), which the privacy policy covers.
3. If this DPA conflicts with the terms of service, this DPA prevails for Customer Data. If the Standard Contractual Clauses incorporated in section 13 conflict with this DPA, the Clauses prevail for the transfers they govern.

2. Definitions

• “Data Protection Law”: the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other law that applies to the processing of Customer Data, including US state privacy laws.
• “Personal data”, “data subject”, “processing”, “controller”, “processor”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR.
• “Standard Contractual Clauses” or “SCCs”: the clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
• “UK Addendum”: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0, in force 21 March 2022) issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, available at ico.org.uk.
• “Sub-processor”: a third party engaged by the Processor to process Customer Data.
• “Service”: BookSlot as defined in the terms of service.

3. Roles of the parties

1. The Controller determines the purposes and means of processing Customer Data: which services it offers, what it asks customers, which features it turns on, who on its team may see bookings, and how long it keeps its store. The Controller warrants that it has a lawful basis for the processing it instructs, that it has given data subjects the information Data Protection Law requires, and that its instructions comply with Data Protection Law.
2. The Processor processes Customer Data only on the Controller’s behalf, as this DPA describes. Where a US state law applies, the Processor is a “service provider” or “processor” and certifies that it understands and will comply with the restrictions in section 4.
3. Shopify is an independent processor (or, for its own purposes, controller) engaged by the Controller under the Controller’s agreement with Shopify. Data that the Service writes to the Controller’s Shopify store (customer records, tags, consent, orders) is thereafter processed under that agreement.

4. Processing on documented instructions

1. The Processor processes Customer Data only on the Controller’s documented instructions, including with regard to transfers to a third country, unless required to do otherwise by law to which the Processor is subject; in that case the Processor informs the Controller of the legal requirement before processing, unless the law prohibits it on important grounds of public interest.
2. The Controller’s instructions are: this DPA, the terms of service, the settings and features the Controller chooses in the Service, the actions its users take in the Service, and the privacy webhooks Shopify sends on the Controller’s behalf. Additional instructions must be in writing (email suffices) and may be subject to a reasonable fee if they go beyond the Service’s functionality.
3. The Processor will inform the Controller without delay if, in its opinion, an instruction infringes Data Protection Law. The Processor may then suspend the instruction until the Controller confirms or changes it.
4. The Processor does not sell Customer Data, does not share it for cross-context behavioural advertising, does not retain, use or disclose it outside the direct business relationship with the Controller or for any purpose other than providing the Service, and does not combine it with personal data it receives from or on behalf of others, except as Data Protection Law expressly permits (for example to detect security incidents or to improve the Service without building profiles).

5. Confidentiality

1. The Processor ensures that every person it authorises to process Customer Data is bound by a contractual or statutory duty of confidentiality, has received appropriate training, and accesses Customer Data only to the extent needed to provide the Service, give support the Controller asked for, investigate security incidents or comply with law.
2. The Processor keeps the Controller’s Customer Data confidential during and after the term of this DPA, except for disclosures required by law (section 13.5) or authorised by the Controller.

6. Security of processing

1. The Processor implements and maintains the technical and organisational measures in Annex II, which take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risk to data subjects, so as to ensure a level of security appropriate to the risk, as Article 32 GDPR requires.
2. The Processor may update the measures from time to time provided the overall level of security does not decrease. Material reductions are treated as changes to this DPA (section 15).
3. The Controller is responsible for security within its own control: the Shopify staff accounts it creates, the permissions it grants them, the confidentiality of calendar feed links, the devices its team uses, and the content of the booking questions it designs.

7. Sub-processors

1. The Controller gives the Processor general written authorisation to engage the Sub-processors listed in Annex III and, subject to this section, further Sub-processors.
2. The Processor will tell the Controller of any intended addition or replacement of a Sub-processor at least 30 days before it takes effect, by email to the store’s contact address and by updating Annex III. The Controller may object on reasonable data protection grounds within that period by writing to support@fenloft.com. The parties will then discuss the objection in good faith; if no solution is found within 30 days, the Controller may terminate the Service by uninstalling it, and the Processor will refund any prepaid fees for the period after termination through Shopify where its billing rules allow.
3. The Processor imposes on each Sub-processor, by written contract, data protection obligations that are substantially the same as those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures, and remains fully liable to the Controller for the performance of the Sub-processor’s obligations.
4. Emergency replacement: if a Sub-processor must be replaced urgently for security or continuity reasons, the Processor may do so and will inform the Controller as soon as possible, with the same right to object.

8. Data subject requests

1. Taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, portability, objection).
2. The Service does this largely by design: Shopify’s customers/data_request webhook produces a full export of a customer’s data for the Controller to pass on, customers/redact anonymises the customer, the Controller can edit or delete bookings and customers itself, and the Controller can export all bookings and customers as CSV. The Processor acts on these automatically and at no charge.
3. If a data subject contacts the Processor directly, the Processor will not respond on the merits (except to direct the person to the Controller) and will forward the request to the Controller within 5 business days, unless the law requires the Processor to respond itself.

9. Personal data breaches

1. The Processor notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data, by email to the store’s contact address.
2. The notification describes, to the extent known at the time and supplemented as information becomes available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a point of contact.
3. The Processor cooperates with the Controller and takes reasonable steps the Controller directs to assist in investigating, mitigating and remediating the breach. Notification is not an admission of fault or liability.

10. Assistance with your obligations

1. Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR: security of processing, breach notification, data protection impact assessments and prior consultation with a supervisory authority.
2. This DPA, the privacy policy and Annexes I to III are intended to give the Controller the information it needs for a data protection impact assessment of its use of the Service. Further reasonable assistance is given on request; the Processor may charge a reasonable fee for assistance that goes beyond providing existing documentation.

11. Deletion and return of data

1. The Controller can retrieve all Customer Data at any time during the term by exporting bookings and customers as CSV files from the Service.
2. When the Controller uninstalls the Service, the Processor deletes all Customer Data as described in the privacy policy: the store is deactivated at once, Shopify sends its deletion request 48 hours later, and the Processor deletes everything it holds for the store 48 hours after that, including backups as they expire within 7 days. Reinstalling before deletion restores the store.
3. The Processor may retain Customer Data after deletion only to the extent and for the period required by law to which it is subject, in which case it keeps the data confidential and processes it only for that purpose.
4. On the Controller’s written request the Processor confirms deletion in writing.

12. Information and audits

1. The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and this DPA: this DPA and its annexes, the privacy policy, its security incident response policy and data loss prevention strategy, the current sub-processor list, the most recent restore-drill record, and written answers to reasonable security questionnaires, all on request to support@fenloft.com.
2. The Processor allows for and contributes to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller and bound by confidentiality, provided that: the Controller gives at least 30 days’ written notice; audits take place no more than once in any twelve-month period unless a supervisory authority requires one or a personal data breach has occurred; the audit is conducted during business hours with minimal disruption; the Controller first relies on the documentation in paragraph 1 and on the Sub-processors’ own certifications and audit reports where they cover the point; and the Controller bears its own costs and reimburses the Processor’s reasonable costs for time spent beyond one business day.
3. The Processor will inform the Controller immediately if, in its opinion, an audit instruction infringes Data Protection Law.

13. International transfers

1. The Processor is established in the United Arab Emirates and processes Customer Data in the United States (AWS us-east-1, North Virginia), as Annex I describes. The Controller authorises these transfers and the onward transfers to the Sub-processors in Annex III.
2. EU transfers. For Customer Data subject to the GDPR, the parties conclude the Standard Contractual Clauses, Module Two (transfer controller to processor), which are incorporated into this DPA by reference as if set out in full. The Controller is the “data exporter” and the Processor the “data importer”. The options are: Clause 7 (docking clause) applies; Clause 9(a), Option 2 (general written authorisation) with a 30-day notice period; the optional language in Clause 11 is not used; Clause 13: the supervisory authority of the EU Member State in which the data exporter is established or, where the data exporter is not established in the EU, the authority of the Member State where its representative under Article 27 GDPR is based or where its data subjects are located; Clause 17: the law of Ireland; Clause 18: the courts of Ireland. Annex I of this DPA is Annex I.A and I.B of the Clauses and names the competent supervisory authority (Annex I.C); Annex II of this DPA is Annex II of the Clauses; Annex III of this DPA is Annex III of the Clauses. Where the Processor engages a Sub-processor, the corresponding onward transfer is covered by the Sub-processor’s own Clauses as noted in Annex III.
3. UK transfers. For Customer Data subject to the UK GDPR, the Standard Contractual Clauses as completed above apply as amended by the UK Addendum, which is incorporated by reference. Table 1 of the Addendum is completed with the parties’ details in Annex I; Table 2 selects the Clauses as completed in paragraph 2; Table 3 points to Annexes I to III of this DPA; in Table 4, either party may end the Addendum as set out in its section 19.
4. Swiss transfers. For Customer Data subject to the Swiss Federal Act on Data Protection, the Clauses apply with these adaptations: for transfers subject to the Swiss Federal Act on Data Protection (FADP), references to the GDPR are read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner is the competent authority, and data subjects in Switzerland may enforce their rights in Switzerland; and the term “Member State” is not read so as to exclude data subjects in Switzerland from the possibility of suing for their rights in Switzerland.
5. Government access. The Processor has not received, and as at the date above is not subject to, any request from a public authority for access to Customer Data. If it receives one it will, unless legally prohibited, notify the Controller promptly, review the legality of the request, challenge it where there are reasonable grounds, disclose only the minimum required, and document the request and its response, in accordance with Clauses 14 and 15 of the Standard Contractual Clauses.
6. If a transfer mechanism relied on above is invalidated or the Processor can no longer comply with it, the Processor will inform the Controller, and the parties will cooperate in good faith to put an alternative mechanism in place; failing that, the Controller may terminate by uninstalling.

14. Liability

1. Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations in section 12 of the terms of service, except to the extent Data Protection Law does not permit them to apply (for example Article 82 GDPR as between the parties and data subjects, and the third-party beneficiary rights under the Standard Contractual Clauses, which are not limited by this DPA).
2. Each party is liable to data subjects as Data Protection Law provides. Where both parties are liable for the same damage, each may claim back from the other the part of the compensation corresponding to the other’s responsibility.

15. Term, changes and governing law

1. This DPA takes effect when the Controller installs the Service and lasts as long as the Processor processes Customer Data on the Controller’s behalf, including the deletion period in section 11.
2. The Processor may update this DPA to reflect changes in Data Protection Law, in regulatory guidance or in the Service, provided the changes do not reduce the protection of Customer Data. The Processor will tell the Controller by email at least 30 days before a material change takes effect; the Controller may object by uninstalling before that date. The date at the top identifies the version in force.
3. Except for the Standard Contractual Clauses, which are governed by the law and courts stated in section 13, this DPA is governed by the federal laws of the United Arab Emirates as applied in the Emirate of Sharjah and the parties submit to the exclusive jurisdiction of the courts of the Emirate of Sharjah, United Arab Emirates. Nothing in this paragraph limits a data subject’s or supervisory authority’s rights under Data Protection Law.
4. If any provision of this DPA is held invalid, the rest remains in force and the provision is replaced by a valid one that comes closest to the parties’ intent.

Annex I: Description of the processing

A. List of parties

B. Description of the transfer

C. Competent supervisory authority

Clause 13: the supervisory authority of the EU Member State in which the data exporter is established or, where the data exporter is not established in the EU, the authority of the Member State where its representative under Article 27 GDPR is based or where its data subjects are located.

Annex II: Technical and organisational measures

Measures implemented by the data importer to ensure an appropriate level of security, including measures to assist the data exporter with data subject requests (section 8) and to be imposed on Sub-processors (section 7.3).

Annex III: Sub-processors

The Controller has authorised the use of the following Sub-processors. The same list appears in section 6 of the privacy policy and is updated there first; the notice period in section 7 applies to every change.

Questions about this DPA, objections to a Sub-processor, audit requests and breach notifications: support@fenloft.com.