Terms of Service

1. Agreement

These terms are an agreement between you (the business or individual using Bookwick) and Vioscale Technologies Ltd (company number 14751646, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom), which provides Bookwick (“we”, “us”). If you use Bookwick on behalf of an organisation, you confirm you are authorised to accept these terms for it. These terms include Schedule 1, the Data Processing Agreement, which forms part of them.

2. The service

Bookwick provides online booking, scheduling, payments and related tools. We may add, change or remove features over time, and we aim to give reasonable notice of significant changes.

3. Your account

You are responsible for the activity under your account and for keeping your login details secure. You must give accurate information and keep it up to date. You must be at least 18 years old to hold an account.

4. Plans, billing and cancellation

• The Free plan is free and includes one staff member, one location and up to 50 bookings per calendar month.
• The Pro plan is charged at £10 per staff member per location per month (one charge for each location each staff member works at, plus any applicable taxes), billed in advance. Adding or removing staff, locations or a staff member's locations adjusts your charge on a pro-rata basis. Subscribers who joined at an earlier price keep that price.
• Subscriptions renew automatically until cancelled. You can cancel at any time; your Pro features continue until the end of the paid period, after which the Free plan limits apply.
• Fees are non-refundable except where required by law or set out in these terms. We may change pricing on reasonable notice.

5. Payments you take from customers

Where you enable card payments, these are processed through your own Stripe or PayPal account and are subject to that provider’s terms. You are responsible for your own tax, refunds and chargebacks. Bookwick does not take a percentage of your bookings.

6. Acceptable use

You agree not to:

• Use Bookwick for anything unlawful, fraudulent or harmful;
• Send marketing messages to people who have not agreed to receive them or have asked you to stop, or any other content you have no right to send;
• Attempt to break, overload, reverse-engineer or gain unauthorised access to the service;
• Resell or white-label the service except as expressly permitted by your plan.

7. Your data and content

You retain ownership of the data and content you put into Bookwick, and you grant us the licence needed to host and process it to provide the service.

For the personal data of your clients, staff and other people that you or your clients put into Bookwick, you are the controller and we are your processor. We process that data under Schedule 1. For your own account details, billing, and how people use our website, we are the controller, as described in our Privacy Policy.

8. Availability

We work hard to keep Bookwick available and reliable, but the service is provided “as is” without warranties of uninterrupted or error-free operation. We may carry out maintenance and will aim to minimise disruption.

9. Liability

Nothing in these terms limits liability that cannot be limited by law, or limits the rights that individuals have under data protection law. Subject to that, our total liability arising from the service, including under Schedule 1, is limited to the fees you paid us in the 12 months before the claim, and we are not liable for indirect or consequential loss.

10. Termination

You may stop using Bookwick at any time, and the account owner can delete the business from the dashboard. We may suspend or terminate accounts that breach these terms. If we close your account, you can export your data for 30 days before it is deleted, as set out in paragraph 9 of Schedule 1.

11. Changes to these terms

We may update these terms, for example when the law or our service changes. We will tell the account owner by email at least 30 days before a material change takes effect. If you do not agree to the change, you can close your account before it takes effect. If you keep using Bookwick after that date, the updated terms apply.

12. Governing law

These terms are governed by the laws of England and Wales, and the courts of that jurisdiction have exclusive jurisdiction, unless local law requires otherwise.

13. Contact

Questions about these terms or data protection? Email info@bookwick.com.

Schedule 1: Data Processing Agreement

This Data Processing Agreement (“DPA”) sets out how we process personal data on your behalf. It meets the requirements of Article 28 of the UK GDPR. If anything in this DPA conflicts with the rest of these terms, this DPA takes priority for the processing of personal data.

1. Definitions

• Data Protection Laws means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and, where it applies to your processing, the EU General Data Protection Regulation.
• Customer Personal Data means personal data that we process on your behalf in providing Bookwick, as described in Annex A.
• Sub-processor means a third party we engage to process Customer Personal Data.
• “Controller”, “processor”, “personal data”, “personal data breach”, “data subject” and “processing” have the meanings given in the UK GDPR.

2. Roles

You are the controller of Customer Personal Data and we are your processor. Where you are yourself a processor for someone else, we act as your sub-processor and you confirm that your own controller has authorised you to use us.

3. Your responsibilities

As controller, you are responsible for:

• having a lawful basis for the personal data you collect and ask us to process;
• telling your clients and staff how their data is used, including that you use Bookwick, in your own privacy notice;
• where you collect health or other special category data (for example in intake forms or notes), meeting the extra conditions that apply under Article 9 of the UK GDPR, and only collecting what you need;
• getting any consent needed under PECR before sending marketing emails or text messages, and respecting requests to stop;
• making sure your instructions to us comply with Data Protection Laws.

4. Processing on your instructions

We process Customer Personal Data only on your documented instructions, including for transfers outside the UK, unless the law requires us to do otherwise. In that case we will tell you before processing, unless the law prevents us from doing so. Your instructions are these terms, your use and configuration of Bookwick, and any other written instructions you give us that we agree to. We will tell you promptly if we believe an instruction breaks Data Protection Laws.

5. Confidentiality

Everyone at Bookwick who can access Customer Personal Data is bound by a duty of confidentiality. Access is limited to people who need it to provide, support or secure the service, or to comply with the law. Our platform administrators can view a business’s account to give support; they do so only when needed for support, security or a legal requirement.

6. Security

We take appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR, including the measures in Annex B. We may improve these measures over time, but we will not reduce the overall level of protection.

7. Sub-processors

• You give us general authorisation to use sub-processors. Our current sub-processors are listed in Annex C.
• We will tell the account owner by email at least 30 days before we add or replace a sub-processor, and update Annex C. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may close your account, and we will refund any fees you paid in advance for the period after closure.
• We impose data protection obligations on each sub-processor that give at least the same protection as this DPA, and we remain responsible to you for their performance.

8. Helping you meet your obligations

• Data subject requests. Bookwick includes tools to export a client’s data, export all of your data, correct records and erase a client. If we receive a request from one of your clients or staff directly, we will pass it to you without undue delay and will not respond ourselves unless you ask us to.
• Personal data breaches. We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will tell you what happened, the data and people likely to be affected, the likely consequences, and what we are doing about it, and give you further information as it becomes available. This helps you meet the 72-hour deadline for reporting to the Information Commissioner’s Office (ICO) where reporting is required.
• Impact assessments. We will give you reasonable information to help with a data protection impact assessment, or a prior consultation with the ICO, that relates to your use of Bookwick.

9. Deletion and return of data

• You can export your data at any time from the dashboard.
• When the account owner deletes the business, we delete Customer Personal Data, including uploaded files, from our live systems straight away. Copies held in backups are overwritten within 30 days.
• If your account is closed in any other way, you can export your data for 30 days, after which we delete it in the same way.
• We keep a copy only where the law requires us to, and then only for as long as required and protected under this DPA.

10. Information and audits

We will make available the information reasonably needed to show that we meet our obligations under Article 28, and answer your reasonable written questions about our processing. Where that is not enough, we will allow an audit by you or an independent auditor bound by confidentiality, on at least 30 days’ written notice, during business hours, no more than once a year (unless a regulator requires it or after a personal data breach), and at your cost.

11. International transfers

Customer Personal Data is stored in the United Kingdom. Some sub-processors in Annex C may process it in the United States. Where personal data is transferred outside the UK, we make sure the transfer is protected as required by Chapter V of the UK GDPR: by relying on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified), or otherwise by the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

12. Services you connect

If you connect your own Stripe or PayPal account, or a staff member connects their own Google Calendar, we send the data needed for that service to the provider on your instruction. Those providers are not our sub-processors: they act under their own terms with you, and you are responsible for that relationship.

13. Our own use of data

We do not sell Customer Personal Data or use it for our own marketing. We may use it in the following limited ways, which you authorise: to keep the service secure and prevent abuse; to fix problems and improve the service; and to create anonymised, aggregated statistics that do not identify you, your clients or any individual (for example, average no-show rates across all businesses).

14. Duration

This DPA applies for as long as we process Customer Personal Data on your behalf, and its obligations continue until that data has been deleted or returned.

Annex A: Details of processing

• Subject matter: providing the Bookwick booking, scheduling, payments and messaging service to you.
• Duration: while you use Bookwick, and until deletion under paragraph 9.
• Nature and purpose: collecting, storing, organising, displaying and transmitting data so that your clients can book and pay, you can manage your diary, clients and team, and Bookwick can send confirmations, reminders and the messages you set up.
• Data subjects: your clients and people who book with you; your staff and other users of your account; and visitors to your booking page.
• Types of personal data: names, email addresses, phone numbers and addresses; appointment, purchase and payment records (not full card numbers); notes and intake form answers; messages sent; staff names, photos, working hours and login details; and technical data such as IP addresses.
• Special category data: only what you choose to collect, for example health information in intake forms or notes for a clinic or therapist. See paragraph 3.
• Frequency: continuous, while you use Bookwick.

Annex B: Security measures

• All connections to Bookwick are encrypted in transit with HTTPS (TLS).
• The database is hosted in London and encrypted at rest by our hosting provider, with point-in-time backups.
• Payment provider keys and other integration credentials are encrypted with AES-256-GCM before they are stored, and are never shown again after saving.
• Passwords are hashed with bcrypt and checked against known breached passwords. Two-step verification is available for every login.
• Every business’s data is kept separate, and every request is checked against the business it belongs to.
• Role-based access (owner, admin, staff) limits what each team member can see and do, and an activity log records important changes.
• Public endpoints are rate limited to slow down abuse.
• Card details are entered directly with Stripe or PayPal and are never stored by Bookwick.
• Access to production systems is limited to named Bookwick administrators who need it.

Annex C: Sub-processors