Data processing addendum
Last updated:
1. What this addendum is
1.1 This addendum is part of the agreement between you, the business named at checkout ("you"), and Narto ApS, a Danish company with registration number (CVR) 46813227, Lynghusene 26, 4571 Grevinge, Denmark, which runs LocalBooked ("we"). The agreement is made under our terms at localbooked.co/terms.
1.2 It applies when we handle personal data on your behalf to deliver the service. "Personal data" means information about an identifiable person. "Data protection law" means the laws on personal data that apply to that handling. That includes the EU General Data Protection Regulation (GDPR), which applies to us as a Danish company, and US state privacy laws such as the California Consumer Privacy Act, where they apply.
1.3 If this addendum and the terms say different things about personal data, this addendum applies.
2. Roles
2.1 For personal data about your customers, leads, callers and website visitors, you decide what it is used for. You are the controller under the GDPR, and the business under US state privacy laws. We are your processor and service provider.
2.2 For your own contact and payment details as our customer, we decide how they are used. Our privacy policy at localbooked.co/privacy covers that.
2.3 Annex 1 describes the data and how we handle it.
3. Your instructions
3.1 We handle the personal data only to deliver the service, on your documented instructions. The terms, this addendum, your plan and the set-up you approve, such as the messages, lists and automations, are your instructions. You can give further instructions by email.
3.2 If we think an instruction breaks data protection law, we tell you.
3.3 If the law requires us to handle the data in another way, we tell you first, unless the law forbids it.
3.4 We do not sell the personal data, share it for advertising, use it for our own purposes outside the service, or combine it with personal data from other sources, except where data protection law allows a service provider to do so, for example to detect security incidents. We may use statistics that do not identify anyone to improve our service.
3.5 If we can no longer meet our obligations under US state privacy laws, we tell you. You can then take reasonable steps to stop and fix any use of the data that is not allowed.
4. Your responsibilities
4.1 You have a lawful basis for the personal data you give us or collect through the system, you give the people concerned the notices the law requires, and you have the consent the law requires for texts and calls. Section 12 of the terms applies.
4.2 You do not use the system to store sensitive data, such as health information, Social Security numbers, financial account numbers or information about children, beyond what a person writes to you in a message.
4.3 Your instructions follow data protection law.
5. Confidentiality and people
Everyone who works with the personal data for us is bound by confidentiality and has access only to what they need for their work.
6. Security
We keep the personal data reasonably secure with the measures in Annex 2. We review them as our service and the risks change.
7. Sub-processors
7.1 You give us general authorization to use the sub-processors listed in Annex 3.
7.2 We tell you by email at least 30 days before we add or replace a sub-processor. If it is urgent for security or legal reasons, we tell you as soon as we can. You can object on reasonable data protection grounds within those 30 days. If we cannot solve your objection, you can end the subscription without the 30 days' notice in the terms.
7.3 Each sub-processor is bound in writing by data protection obligations that protect the data at least as much as this addendum. We remain responsible to you for their work.
8. Transfers outside Europe
8.1 We are in Denmark. Several of our sub-processors are in the United States, and you are usually in the United States too.
8.2 Transfers to sub-processors outside the EU and the EEA are protected by the EU-US Data Privacy Framework where the sub-processor is certified, and otherwise by the European Commission's standard contractual clauses.
8.3 Where personal data goes from us to you outside the EU and the EEA, and that counts as a transfer under the GDPR, the European Commission's standard contractual clauses, module four (processor to controller), apply to that transfer and are part of this addendum. Danish law governs them, and the courts of Denmark settle disputes about them.
9. Requests from people
9.1 We help you answer requests from people about their data, such as requests for access, correction or deletion, as far as we reasonably can.
9.2 If someone contacts us directly, we pass the request on to you without undue delay. We do not answer it ourselves unless you ask us to or the law requires it. Opt-outs from texts, such as a reply of STOP, are handled automatically, as section 5.6 of the terms describes.
10. Security incidents
10.1 If we become aware of a breach of security that leads to personal data we handle for you being destroyed, lost, changed, disclosed or accessed without permission, we tell you without undue delay, and where possible within 48 hours.
10.2 We tell you what we know: what happened, which data and which people are affected, and what we are doing about it. We help you with any notice you must give to authorities or to the people affected.
10.3 Telling you about an incident is not an admission of fault.
11. Help with assessments
If the law requires you to assess the risks of the handling or to consult an authority, we help you with the information we have about it, as far as we reasonably can.
12. Information and audits
12.1 On request, we give you the information you reasonably need to show that we meet this addendum, such as a description of our security measures and our current list of sub-processors.
12.2 If that is not enough, or an authority requires it, you or an independent auditor bound by confidentiality may audit how we meet this addendum. An audit is limited to once a year, with 30 days' notice, during business hours, and at your cost. For sub-processors, we rely on their own reports and certifications.
13. When the service ends
13.1 If you ask within 30 days after the subscription ends, we send you your contacts and inquiries, as section 20.4 of the terms describes.
13.2 After that we delete the personal data we handle for you, no later than 60 days after the subscription ends, unless the law requires us to keep it. Copies in backups are deleted when the backups are replaced.
14. Liability
Each party's liability under this addendum follows the limits in the terms, except where data protection law does not allow those limits.
15. How long this addendum applies
This addendum applies for as long as we handle personal data on your behalf.
16. Contact
LocalBooked is run by Narto ApS, Lynghusene 26, 4571 Grevinge, Denmark. CVR 46813227. Email: [email protected].
Annex 1. The data and how we handle it
| Topic | Details |
|---|---|
| Subject matter | Delivering the LocalBooked service to you |
| Duration | The subscription, and until the data is deleted under section 13 |
| What we do with the data | Hosting and storing it, delivering inquiries, calls and texts to you, sending the texts and emails you have set up, running the AI chat on your website, filtering spam, making reports, and keeping backups |
| Purpose | To deliver the service under the terms |
| Whose data | Your customers and past customers, people who ask you for a quote, callers, people who text you, visitors who use the forms or the chat on your website, other visitors to your website, people you ask for a review, and your staff who use the system |
| What data | Names, phone numbers, email addresses, addresses, details about the job, messages and chat conversations, call details such as number, time and length, recordings if you ask for them, consent and opt-out status, and the status of review requests and follow-ups. For visit statistics: visitors' IP address and browser type, used only to count visits without cookies and not stored |
| Sensitive data | Not intended (section 4.2) |
Annex 2. Security measures
- Access only for the people who need it, with personal accounts.
- Passwords and two-step sign-in on the accounts that hold the data, where the provider offers it.
- Encrypted connections (HTTPS) to and from our websites and tools.
- Established providers with their own security programs.
- We do not ask for or store your passwords. Access to your domain is given through an invitation or delegated access.
- Spam filtering on the forms on your website.
- Backups of your website.
- Deletion of data when it is no longer needed (section 13).
- A plan for security incidents (section 10).
Annex 3. Sub-processors
| Sub-processor | What for | Where |
|---|---|---|
| GoHighLevel (LeadConnector), through the reseller that provides our account | Customer lists, phone numbers, texts, the AI chat, automations and booking calendars | United States |
| Twilio | Phone calls and text messages | United States |
| Cloudflare | Hosting of websites, domains and delivery of form inquiries | United States, with a worldwide network |
| Plausible | Visit statistics on your website, without cookies | European Union |
| Email, where inquiries and messages to us may pass through | United States | |
| Slack | Messages between you and us, which may include details about your leads | United States |
| Zoom | Calls between you and us, which may include details about your leads | United States |
| Fathom | Recording and transcription of our calls with you, which may include details about your leads | United States |
| Anthropic (Claude) and OpenAI | AI software we use when we work on your website, messages and reports | United States |