Legal
Data Processing Addendum
This draft describes processing practices for businesses using the platform. It is not a signed data-processing agreement. Any separately executed agreement remains in force.
Draft, pending legal review
The annexes below describe supported processing and are maintained alongside the system. Actual enabled services depend on configuration. The clauses have not yet been reviewed by a lawyer. If you need an executed DPA for your own compliance, email support@burgundyblend.com to discuss an appropriate agreement. We do not represent that this draft has been reviewed by a lawyer or that a countersigned agreement is already available.
1. Roles
For the client records a business holds on the platform, the business is the controller and BurgundyBlend is the processor: you decide what is collected and why, and we act on your instructions. For our own account, billing and marketplace records, including web subscription and promotion records, private finance declarations, reconciliation records, fraud prevention and statutory reporting where applicable, BurgundyBlend determines its own processing purposes. Stripe may also act for its own legal and regulatory purposes; its role is not limited to processing on a business’s instructions.
2. What we process
Customers booking appointments
Name, email, phone number, booking and payment history, optional intake questions and answers (which may include health-related information), reminder preferences and reviews
Business owners and their staff
Name, email, phone, business address, services and prices, opening hours, payout status, and private legal-seller and sales-tax registration declarations. Bank credentials and payment-verification identity documents are collected directly by Stripe; they do not belong in ordinary business profile fields
Anyone visiting the site or apps
Device and app version, approximate or precise location when granted, address-search requests, and error diagnostics
3. Subprocessors
The current list is published on our security page and is maintained alongside the system rather than separately from it. There are 10 today. We will give notice before adding one that processes personal data.
4. Security
Measures are described in full on the security page. In summary: card and bank details are handled by Stripe and never reach our servers, private routes require authentication and applicable approval checks, database rules enforce supported client access, and App Check enforcement depends on the configured service and environment rather than being guaranteed for every request, and error reports are stripped of credentials before they are sent.
5. Your clients’ rights
Customers can export their data and delete their account from inside the app without contacting anybody. Where a request reaches us that is properly yours to answer, we will pass it on rather than answering on your behalf.
6. Retention
Booking records are retained after an account is deleted where the other party to the booking needs them for applicable accounting, payment, tax or dispute obligations. Private finance declarations and related audit history may also need retention. We minimise retained personal information where possible; deletion does not erase legally required financial history. The Privacy Policy describes the applicable purposes.
7. Where data is processed
BurgundyBlend Inc. is incorporated in Alberta, Canada. Several subprocessors process data in the United States; each is listed with its location on the security page. If you are in Quebec, note that Law 25 imposes specific requirements on transfers outside the province, and we will confirm our position in writing on request.