Data-processing terms

Version 30 October 2026. These terms form part of the subscription terms between your business (the controller) and Charlotte Marshall trading as The Farrier’s Diary (the processor).

Scope and instructions

For the duration of your workspace, we host, store, organise, retrieve and delete your customer and diary records to provide the service on your documented instructions. Those instructions comprise this agreement, your use of the tools and authorised requests to support. Records include customer names, contact details, postcodes, horse information, bookings, appointments and business notes. People concerned are your customers, contacts and authorised business users. Special-category data is not needed and should not be entered.

You determine the purposes of your customer processing and are responsible for its lawful basis, notices, accuracy and instructions. We process these records only on your documented instructions, including for international transfers, unless UK law requires otherwise. We will inform you of a legal requirement unless prohibited and tell you if we believe an instruction infringes data-protection law.

Confidentiality and security

Persons authorised to process records must be subject to confidentiality obligations. We maintain proportionate technical and organisational measures, including authenticated business membership, database row-level access controls, encrypted transport, restricted server credentials and separation of public booking intake from private records. Private records are not deliberately cached for offline use. We assist with security information reasonably needed to assess the service.

Suppliers

You give general authorisation for Supabase (database and authentication), Vercel (hosting and operational delivery) and Resend (transactional authentication email) as subprocessors, including their necessary contracted infrastructure providers. We must bind subprocessors to equivalent data-protection obligations and remain responsible to you for their processing under these terms. Stripe separately handles payment information under its applicable terms; it is not used to store your horse or appointment records.

We will notify your account email at least 30 days before adding or replacing a material subprocessor where practicable. You may object on reasonable data-protection grounds; we will work to resolve the concern, or you can end the affected service and request return/deletion. We will only make restricted international transfers with a lawful safeguard, such as applicable adequacy regulations or approved contractual safeguards. Contact support for current supplier and transfer details.

Assistance and incidents

Taking account of the nature of processing and information available, we will reasonably assist with rights requests, security obligations, breach notifications, impact assessments and regulator consultations. We will notify you without undue delay after becoming aware of a personal-data breach affecting your records, provide available details and cooperate with containment and required notifications. You remain responsible for your controller notifications.

Return, deletion and audit

At the end of the service, we will, at your choice, return or delete your personal data and delete existing copies, unless law requires retention. Contact support for export and closure; we verify the owner first. Active-system deletion is handled within 30 days of a verified closure request, subject to a disclosed legal restriction. Protected backups may retain copies until their normal expiry; any restored copy remains subject to deletion instructions.

We will make available information necessary to demonstrate compliance with these terms and allow and contribute to proportionate audits, including inspections by you or your mandated auditor, with reasonable notice and safeguards for other customers. Contact thefarriersdiary@gmail.com to arrange this. No audit may expose another business’s records.