Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the StudioBuilder Terms of Service between you, the studio or artist who holds a StudioBuilder account (“the Studio”, the controller), and Steven Alexander Graham, a sole trader in Scotland, United Kingdom, trading as StudioBuilder (“StudioBuilder”, “we”, the processor). It applies whenever we process personal data on the Studio's behalf, and it takes priority over the Terms if they conflict on data protection. You accept it by using StudioBuilder; no signature is needed. If you would like a signed copy for your records, email privacy@studiobuilder.io.

1. Definitions

“Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended or replaced. “Personal data”, “controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the UK GDPR. “Studio Data” means personal data we process for the Studio, described in Annex 1. “Sub-processor” means another company we engage to process Studio Data, listed in Annex 3.

2. Roles

For Studio Data, the Studio is the controller and decides why and how its clients' data is used. StudioBuilder is the processor and handles it only to provide the service. For the Studio's own account details (its owner's name, email, billing and usage), we are a separate controller, as set out in our privacy policy.

3. The Studio's responsibilities

• Have a lawful basis for collecting and using its clients' data, including explicit consent (or another valid condition) for health information on consent forms.
• Tell its clients how their data is used, for example through its own privacy notice, which can point to StudioBuilder as a service provider.
• Only send marketing messages to people who have agreed to receive them.
• Keep its team's sign in details safe, give team members only the roles they need, and remove people who leave.
• Make sure the instructions it gives us, through its settings and use of the app, comply with Data Protection Law.

4. What we will do as processor

1. Instructions. Process Studio Data only on the Studio's documented instructions. These are the Terms, this DPA and the Studio's use and settings of StudioBuilder. If the law requires us to process it otherwise, we will tell the Studio first unless the law forbids it. If we think an instruction breaks Data Protection Law, we will tell the Studio.
2. Confidentiality. Make sure anyone authorised to access Studio Data is bound by confidentiality. Today that is only Steven Graham, who accesses Studio Data only when the Studio asks for support, when needed to keep the service secure or working, or when the law requires it.
3. Security. Keep appropriate technical and organisational measures in place to protect Studio Data, as described in Annex 2, and keep them up to date as risks and technology change.
4. Sub-processors. Use only the sub-processors in Annex 3. The Studio gives general permission for these. We bind each one by written terms that protect personal data at least as well as this DPA, and we remain responsible to the Studio for their work.
5. Changes to sub-processors. Give at least 30 days' notice by email before adding or replacing a sub-processor. The Studio may object on reasonable data protection grounds within that time. We will try to address the objection; if we cannot, the Studio may close its account before the change takes effect.
6. Data subject requests. Help the Studio respond to its clients' requests to access, correct, delete, restrict, object to or move their data. Most of this the Studio can do itself in the app (view, edit, export and delete clients). If a client contacts us directly, we will pass the request to the Studio promptly and not respond ourselves unless the Studio asks us to.
7. Personal data breaches. Tell the Studio without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Studio Data. We will say what happened, what data and roughly how many people are affected, the likely consequences, and what we have done and will do about it, and keep the Studio updated as we learn more. We will help the Studio meet its own duty to notify the Information Commissioner's Office and affected clients.
8. Assessments. Give the Studio the information and reasonable help it needs for data protection impact assessments and any prior consultation with the Information Commissioner's Office about its use of StudioBuilder.
9. End of service. When the Studio closes its account, keep Studio Data for 90 days so the Studio can export it or change its mind, then delete it, unless the law requires us to keep it. The Studio can ask for earlier deletion (we will complete it within 30 days). Encrypted backups containing it are overwritten within a further 30 days.
10. Records and audits. Keep a record of our processing for the Studio, and make available the information reasonably needed to show we meet this DPA. The Studio may ask reasonable written questions about our security once a year, or after a breach. On-site audits are by agreement, at the Studio's cost, with reasonable notice and confidentiality, and limited to what is needed.

5. International transfers

Studio Data is stored in Ireland (EU). Some sub-processors in Annex 3 process data in the United States or elsewhere. We only transfer Studio Data outside the UK where the transfer is covered by UK adequacy regulations (for example the EU and EEA), the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, together with any additional measures needed.

6. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law does not allow liability to be limited.

7. Duration and changes

This DPA lasts as long as we process Studio Data. We may update it to reflect changes in the law, our service or our sub-processors, and will email the Studio at least 30 days before a significant change. It is governed by the same law as the Terms.

Annex 1: Details of the processing

• Subject matter: providing StudioBuilder, booking and studio management software for tattoo artists and studios.
• Duration: while the Studio has an account, then up to 90 days after it closes, plus up to 30 days in encrypted backups.
• Nature: collecting through the Studio's forms, storing, organising, displaying, sending messages, taking payments through the Studio's own Stripe account, producing reports, exporting and deleting.
• Purpose: letting the Studio manage enquiries, quotes, deposits, bookings, consent forms, messages, aftercare, vouchers and its records.
• Data subjects: the Studio's clients and people who enquire, join its waitlist, buy or receive its gift vouchers or message it; and the Studio's own team members as recorded in the app.
• Personal data: names and contact details (email, phone, social media handle); enquiry details and reference photos; quotes, deposits, payment records (card numbers are handled only by Stripe); appointment times and notes; designs and photos; messages and call records; consent form answers, signatures and dates of birth; voucher details; and technical data such as the time a form was signed.
• Special category data: health information clients give on consent forms (such as allergies, medical conditions or medication).

Annex 2: Security measures

• Where data lives: the database and files are stored in Ireland (EU); the app runs on servers in Dublin.
• Encryption: all traffic uses HTTPS with HSTS; stored data is encrypted at rest by our providers; access tokens for connected services (Google, Meta, Stripe) are additionally encrypted by StudioBuilder.
• Studio separation: every record is tied to its studio and database row level security stops any studio reading another's data; files are kept in each studio's own private storage. This separation was checked table by table in an internal security audit in October 2026.
• Private files: consent forms, reference photos and designs are private and shared only through short-lived links. Client portal links expire after 12 months unless renewed.
• Roles: studios give each team member a role (owner, front desk or artist); recording payments, waiving deposits and exporting clients are limited to the roles that need them.
• Sign in: passwords of at least 12 characters, checked against known breached passwords without sending the password anywhere; rate limits, lockouts and a bot check after repeated failures; optional two step verification with backup codes; two step verification required for StudioBuilder's admin area.
• Our access: only Steven Graham can access the systems, and only for support, security or legal reasons.
• Backups: nightly encrypted backups of the database and files, with 14 days kept.
• Monitoring: automated health checks, security headers on every page and alerts when scheduled jobs fail.
• Deletion: deleted leads can be restored for 30 days and are then removed permanently; closed accounts are deleted after 90 days.
• Incidents: a breach is investigated straight away, contained, and reported to the Studio as set out in section 4.

Annex 3: Sub-processors

Stripe also acts as a separate controller for the Studio's own Stripe account under the Stripe Connected Account Agreement. Questions about this DPA: privacy@studiobuilder.io.