Legal
Data Processing Addendum
This describes how BurgundyBlend processes personal data on behalf of a business using the platform, and forms part of our Terms of Service.
Draft, pending legal review
The annexes below are accurate and maintained alongside the system they describe. The clauses have not yet been reviewed by a lawyer. If you need an executed DPA for your own compliance, email support@burgundyblend.com and we will send you the countersigned version rather than asking you to rely on this page.
1. Roles
For the client records a business holds on the platform, the business is the controller and BurgundyBlend is the processor: you decide what is collected and why, and we act on your instructions. For our own account, billing and marketplace records, BurgundyBlend is the controller.
2. What we process
Customers booking appointments
Name, email, phone number, booking history, deposit amounts, reviews written
Business owners and their staff
Name, email, phone, business address, services and prices, opening hours, payout status. Bank and identity details are held by Stripe, not by us
Anyone visiting the site or apps
Device and app version, coarse location when granted, and error diagnostics
3. Subprocessors
The current list is published on our security page and is maintained alongside the system rather than separately from it. There are 7 today. We will give notice before adding one that processes personal data.
4. Security
Measures are described in full on the security page. In summary: card and bank details are handled by Stripe and never reach our servers, requests are authenticated and attested, database rules enforce access per business, and error reports are stripped of credentials before they are sent.
5. Your clients’ rights
Customers can export their data and delete their account from inside the app without contacting anybody. Where a request reaches us that is properly yours to answer, we will pass it on rather than answering on your behalf.
6. Retention
Booking records are retained after an account is deleted where the other party to the booking needs them for their own records and tax obligations. We would rather say that than imply a deletion is more complete than it is.
7. Where data is processed
BurgundyBlend Inc. is incorporated in Alberta, Canada. Several subprocessors process data in the United States; each is listed with its location on the security page. If you are in Quebec, note that Law 25 imposes specific requirements on transfers outside the province, and we will confirm our position in writing on request.