Data Processing Agreement (DPA)

Last updated: October 2026 — version 2026-10-studio.3. Change: § 3.3 also names the signal when the booking panel is opened (the studio's identifier and the page opened, nothing personal). Nothing else changed.

Version 2026-10-studio.2: § 3.3 (new) describes what the booking panel tells the Controller's own website when a booking is made or a checkout is started (kind of offer, amount, technical reference; no cookies, nothing stored on the device). The sub-processors, data categories, retention periods, technical and organisational measures and the allocation of liability are unchanged.

Version 2026-10-studio.1: the wording of § 3 and § 4 is condensed; descriptions of how individual app features work were removed (they remain in the Privacy Policy). § 3 now also names internal notes, vouchers and invoices explicitly, which the platform already processed. The sub-processors, retention periods, technical and organisational measures and the allocation of liability are unchanged.

Version 2026-10-studio: § 3.2 (new) sets out how a Controller's client list is migrated from a previous booking system (Google Drive folder per Controller, AI-assisted conversion, export files deleted no later than 14 days after the import); § 5.10 (new) covers answering the Controller's questions about its own data; § 6 extends Google to Google Workspace and adds Anthropic as a sub-processor.

Earlier versions: 2026-09-studio.3, 2026-09-studio.2, 2026-09-studio.1, 2026-09-studio, 2026-08-studio.3, 2026-08-studio.2, 2026-08-studio, 2026-07-studio. Their texts and change notes are available on request.

This Data Processing Agreement ("DPA") forms an integral part of the Terms of Service between the studio owner ("Controller") and StudioBook ("Processor") and governs the processing of personal data by the Processor on behalf of the Controller in accordance with Art. 28 GDPR.

1. Scope and Parties

This DPA applies between:
- Controller: The studio owner who uses StudioBook to manage their studio, classes, and member bookings.
- Processor: StudioBook, operated by Marcel Jurna, Am Glockenberg 52, 51515 Kürten, Germany. Contact: hello@studiobook.app, +49 1525 3619145.

The Controller determines the purposes and means of the processing of personal data. The Processor processes personal data only on behalf of the Controller and in accordance with the Controller's documented instructions.

2. Subject Matter and Duration

The Processor provides a cloud-based booking and studio management platform. In the course of providing this service, the Processor processes personal data on behalf of the Controller.

This DPA is effective for the entire duration of the service agreement between the Controller and the Processor. It terminates automatically when the service agreement ends and all personal data has been deleted or returned.

3. Types of Personal Data Processed

• Contact and account data of members: name, email address, sign-in method and, where provided, telephone number, postal address and date of birth
• Booking data: bookings, cancellations, waitlist entries, attendance
• Contract and payment data: memberships, credit packs, vouchers, invoices, payment references (Stripe IDs — no card or bank details)
• Internal notes the Controller writes about a member
• Contact details of invited guests: name and, optionally, email address, supplied by the booking member
• Child profiles: first name, last name and, optionally, date of birth, entered by a parent or legal guardian; no account is created for the child
• Answers to intake forms and class questions defined by the Controller, which may include special categories of personal data under Art. 9 GDPR (in particular health data), together with the record of consent (wording shown, timestamp)
• Data migrated from the Controller's previous booking system within these categories (§ 3.2)

Data a member enters reaches the Processor from the member. Data the Controller enters or migrates reaches the Processor from the Controller (Art. 14 GDPR); the Controller decides whose data it enters and is responsible for the legal basis. Acceptance of the member terms and consent to marketing can only be given by the member, never by the Controller on the member's behalf.

3.1 Controller obligations for Controller-defined fields

Because the Controller determines the wording of intake and class questions, the Controller is responsible for ensuring that:
- only data necessary for the stated purpose is requested (data minimisation, Art. 5(1)(c) GDPR);
- a valid legal basis exists — for special categories, the explicit consent of the data subject under Art. 9(2)(a) GDPR. StudioBook provides the consent mechanism and records each consent with the wording displayed;
- no data relating to criminal convictions or offences (Art. 10 GDPR) is collected through these fields.

StudioBook does not inspect, evaluate or otherwise use the content of these fields.

3.2 Migration from a previous booking system

Where the Controller asks the Processor in writing to take over its client list from a previous booking system:

• Only after this DPA is in force. The Processor accepts no export containing personal data before the Controller has accepted this DPA.
• Transfer. The Controller places its export files in a Google Drive folder that the Processor sets up for that Controller alone and shares only with the persons the Controller names, never by public link.
• Conversion. The Processor converts the files into the Controller's StudioBook data, using an AI tool (Anthropic, see § 6) on its own instruction, and uses the files for this migration only.
• Scope. Only the categories in § 3 are migrated. Not migrated: special categories of personal data under Art. 9 GDPR (these require the member's consent recorded in StudioBook, § 3.1), card or bank details, and marketing consents.
• Deletion. The Processor deletes the export files and any working copies no later than 14 days after the import, and confirms the deletion on request.

3.3 The booking panel on the Controller's own website

Where the Controller embeds the booking panel on its own website, the Processor tells that page — and only that page, in the visitor's browser — when the panel is opened (the studio's identifier and the page opened), and when a booking is made in the panel or a checkout is started: the kind of offer (for example trial lesson, contract, drop-in, voucher), the amount and a technical reference (booking ID or Stripe checkout session ID). No names, contact or payment details are included. For this, the Processor sets no cookies, stores nothing on the visitor's device, loads no third-party tracking and sends nothing to advertising or analytics providers. Whether and how the Controller's website uses this signal (for example for its own statistics or ad measurement, with the visitor's consent where required) is the Controller's own responsibility as controller of its website.

4. Categories of Data Subjects

• Members and clients of the Controller, whether they registered themselves or were entered by the Controller
• Staff and instructors assigned to classes by the Controller
• Invited guests whom a member adds to their own booking
• Minors, about whom a parent or legal guardian provides information or for whom they create a child profile; the parent or guardian provides and consents to all such information

5. Processor Obligations

5.1 Processing on Instructions

The Processor shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by Union or Member State law. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

5.2 Confidentiality

The Processor shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.3 Security Measures (Art. 32 GDPR)

The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures are described in detail in the Annex (Technical and Organisational Measures) of this DPA.

5.4 Sub-Processors

The Controller grants the Processor general authorisation to engage sub-processors listed in Section 6 of this DPA. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object to such changes within 14 days. If the Controller objects on reasonable grounds, the parties shall negotiate in good faith to find a solution. If no solution is found, the Controller may terminate the service agreement.

The Processor shall impose the same data protection obligations as set out in this DPA on any sub-processor by way of a contract. The Processor remains fully liable to the Controller for the performance of the sub-processor's obligations.

5.5 Data Subject Rights

The Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

5.6 Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach. The notification shall include:
- A description of the nature of the personal data breach
- The categories and approximate number of data subjects and records concerned
- The likely consequences of the breach
- The measures taken or proposed to address the breach

5.7 Data Protection Impact Assessment

The Processor shall assist the Controller with data protection impact assessments and prior consultations with supervisory authorities (Art. 35–36 GDPR), taking into account the nature of processing and the information available to the Processor.

5.8 Deletion or Return of Data

Upon termination of the service agreement, the Processor shall, at the choice of the Controller, delete or return all personal data and delete existing copies unless Union or Member State law requires storage of the personal data. When the Controller deletes their account, all personal data is immediately and permanently removed.

Retention periods are detailed in our Privacy Policy.

5.9 Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

5.10 Answering the Controller's questions about its own data

Where the Controller asks the Processor a question about its own data in StudioBook — for example which members hold credits that expire this month, or who attended a given class — the Processor may look up that Controller's data to answer it, using an AI tool (Anthropic, see § 6) on the Processor's own instruction. Only the asking Controller's data is looked up, the answer goes only to that Controller, and nothing is kept beyond what is needed to give the answer.

6. Sub-Processors

The Processor uses the following sub-processors:

7. Data Breach Notification

In the event of a personal data breach, the Processor shall:
- Notify the Controller within 24 hours of becoming aware of the breach
- Provide all information required under Art. 33(3) GDPR
- Cooperate with the Controller in investigating and remedying the breach
- Assist the Controller in fulfilling their notification obligations to supervisory authorities and data subjects

8. International Data Transfers

Where personal data is transferred to sub-processors outside the European Economic Area (EEA):
- EU Standard Contractual Clauses (SCCs): are in place with all non-EU sub-processors
- EU-US Data Privacy Framework: applicable sub-processors (Stripe, Resend, Google) are certified under the EU-US Data Privacy Framework
- The Processor ensures that any transfer complies with Chapter V GDPR

9. Technical and Organisational Measures (Annex)

The Processor implements the following measures pursuant to Art. 32 GDPR:

9.1 Access Control

• Row Level Security (RLS) policies on all database tables
• Multi-tenant isolation by studio_id — each studio can only access its own data
• Role-based access control (studio owner, instructor, member)
• JWT-based authentication tokens with expiration

9.2 Encryption

• In transit: All data transmitted via TLS 1.2+ (HTTPS only)
• At rest: AES-256 encryption via Supabase/AWS infrastructure
• No unencrypted data storage or transmission

9.3 Authentication

• Bcrypt password hashing with salting
• OAuth 2.0 via Google
• JWT tokens for session management
• Secure password reset flows via email verification

9.4 Availability and Resilience

• Managed database backups via Supabase
• Point-in-time recovery capability
• Hosted on AWS EU infrastructure with redundancy

9.5 Data Separation

• Logical multi-tenant architecture with strict studio_id scoping
• Each studio's data is logically isolated from other studios
• No cross-studio data access possible through the application layer

9.6 Input Control

• Audit logging via notification_logs table
• All booking, cancellation, and payment events are logged with timestamps
• Transactional email delivery logs

9.7 Transfer Control

• HTTPS-only communication (no HTTP fallback)
• CORS restrictions limiting API access to authorised origins
• API authentication required for all data endpoints

10. Liability

The Processor shall be liable for damages caused by processing that does not comply with this DPA or with the obligations of the GDPR specifically directed to processors. The Processor remains liable if a sub-processor fails to fulfil its data protection obligations.

11. Term and Termination

This DPA is effective for the entire duration of the service agreement between the Controller and the Processor. It cannot be terminated separately from the service agreement. Upon termination, the obligations regarding data deletion/return (Section 5.8) and confidentiality (Section 5.2) survive.

12. Governing Law and Jurisdiction

This DPA is governed by the laws of the Federal Republic of Germany. For merchants (Kaufleute), the exclusive place of jurisdiction is Cologne, Germany. For consumers, the statutory rules on jurisdiction apply.

13. Contact

For questions regarding this DPA or data protection matters:

Marcel Jurna
Am Glockenberg 52, 51515 Kürten, Germany
E-Mail: hello@studiobook.app
Phone: +49 1525 3619145