Data Processing
Agreement

Capitalised terms not defined here have the meaning given in the GDPR. For ease of reading:

Customer / Controller

The business entity contracting with METBooker.

METBooker / Processor / We

The operator of the metbooker.com platform.

Data Subject

An individual whose personal data is processed — typically your tenants, guests, prospective customers or staff.

Personal Data

Any information relating to an identified or identifiable individual processed via the platform.

Sub-processor

A third-party service we engage to help deliver the platform (listed in section 6).

SERMI Records

The optional METBooker add-on for keeping the record of ownership, identity and authority checks that the SERMI scheme requires before security-related work on a vehicle.

You are the data controller. You decide what data is collected from your tenants, guests or staff, and the purposes of that collection. METBooker is the data processor. We process personal data only:

• To provide the booking, calendar and payment-routing features you have enabled in your account;
• On your documented instructions (your account configuration and this DPA constitute those instructions); and
• As required by applicable law — in which case we will tell you unless legally prohibited from doing so.

This DPA forms part of, and is incorporated into, our main Terms & Conditions. If there is any conflict on data-protection matters, this DPA prevails.

We only store the categories of personal data needed to operate the booking platform on your behalf. We do not store payment card numbers, CVCs or expiry dates — these are handled directly by your chosen payment provider.

Processing is limited to what is necessary to provide the platform to you. We process personal data to:

• Take, confirm, modify and cancel bookings;
• Route payments through your chosen provider and reflect their status in your dashboard;
• Send transactional emails (confirmations, reminders, receipts) on your behalf;
• Sync events with your nominated Google Calendar or Microsoft 365 calendar;
• Authenticate users and protect against abuse, fraud and unauthorised access;
• Validate your VAT registration number against the HMRC VAT API and store your company name for billing and audit purposes;
• If you subscribe to SERMI Records: keep, seal and export the security work records you create; read the text on VIN-plate and V5C photos when your staff use the scanner; check with DVLA whether a newer V5C has been issued or the vehicle is marked for export; and send the pre-arrival link and the reminders you have switched on;
• Provide support, debug issues, and maintain platform reliability;
• Comply with legal obligations (e.g. tax and accounting records where applicable).

We do not sell personal data, and we do not use the personal data of your tenants or guests to train AI models or to advertise.

Retention periods are aligned with the purpose of processing. As a controller you may set shorter periods for your own account.

We engage a small number of carefully selected sub-processors to deliver the service. Each is bound by written contractual obligations consistent with this DPA. By accepting this DPA you give general authorisation for the sub-processors below; we will give reasonable notice of any addition or replacement.

Payment providers are connected by you as the customer using your own merchant account — METBooker does not select, operate or control which provider you use or the region in which it processes data. Each payment provider acts as an independent controller for the card and KYC data they collect directly from your customers. Their privacy notices govern that processing.

Application data is hosted in the United Kingdom (Google Cloud europe-west2). Some sub-processors (e.g. Stripe, Square, GitHub) may process limited operational data outside the UK/EEA. Where they do, transfers rely on one or more of:

• UK and EU adequacy decisions, where available;
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; and
• Supplementary technical measures (encryption in transit and at rest, access controls).

Photos read by Google Cloud Vision (SERMI Records scanner) are sent to its European Union endpoint, which the UK recognises as adequate.

We take appropriate technical and organisational measures to protect personal data, including:

• TLS 1.2+ encryption for all traffic to and from the platform;
• Encryption at rest for Firestore, backups and Secret Manager;
• Application-layer encryption of PII fields using AES-256-GCM (see section 9);
• Least-privilege access, with admin sign-in restricted to Google Sign-in for authorised METBooker staff;
• Secrets (API keys, app passwords, service-account credentials and the encryption key) stored only in Google Cloud Secret Manager — never in source control;
• Separation of metbooker-staging and metbooker-production environments; production deploys require explicit instruction;
• Cloud Functions logs and Firestore audit trails for security review;
• Regular dependency updates and review of third-party libraries.

In addition to the storage-level encryption provided by Google Cloud, METBooker applies application-layer encryption to personally identifiable fields before they are written to Firestore. The cipher is AES-256-GCM. The encryption key is held in Google Cloud Secret Manager (europe-west2) and is accessible only to authorised METBooker Cloud Functions — it is never exposed to the application frontend or stored in source control.

This means that even with direct database access, encrypted PII is not legible without the active key material from Secret Manager. Every decryption operation occurs inside a Cloud Function and is covered by Cloud Functions logging.

Because you are the controller, SARs from your tenants or guests should be raised with you in the first instance. Where you need our assistance — for example because relevant data is encrypted on the platform — the following workflow applies:

1. The data subject (end user) raises the SAR with you, the business they booked with.
2. You verify the requester’s identity and submit the SAR to METBooker support at dpa@metbooker.com.
3. METBooker uses an internal SAR Tool to locate, return and (if instructed) delete the data.
4. You forward the resulting export to the data subject within GDPR timescales (typically one calendar month).

SAR Tool capabilities

Your tenants, guests and other data subjects have the following rights under the GDPR. Because you are the controller, requests should be directed to you in the first instance — but we will assist you in fulfilling them at no additional charge for reasonable volumes.

To assist you, we provide self-service export and deletion of any booking record, plus an account-level export on request to dpa@metbooker.com.

As the controller, you are responsible for:

• Having a lawful basis for the data you collect and store on the platform;
• Providing your own privacy notice to your tenants, guests and staff explaining how their data is used;
• Configuring the platform — fields, retention overrides, calendar sharing, payment providers — in line with your own policies;
• Managing access for your team members and revoking it promptly when staff leave;
• Responding to data subject requests directed to you, with our assistance where required;
• If you use SERMI Records: carrying out the ownership, identity and authority checks yourself, meeting the SERMI scheme’s rules, and telling the people whose vehicles you work on that you keep a security work record for six years. METBooker keeps the record; it does not carry out or verify the checks for you;
• Notifying us promptly of any actual or suspected security incident or personal data breach on your side — see section 13 for timescales and method.

13.1 — METBooker’s obligations to you

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 72 hours of confirming the breach. Our notification will include, where known: the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed to address it.

13.2 — Your obligations to us

As controller, you are responsible for the security of your own systems, credentials and integrations with the platform. You must notify METBooker of any actual or reasonably suspected security incident or personal data breach that affects, or may affect, the METBooker platform or data processed through it.

We will make available all information reasonably necessary to demonstrate compliance with this DPA. Once per year, on 30 days’ written notice, you (or an independent auditor on your behalf bound by confidentiality) may audit our processing. We may satisfy audit requests by providing third-party certifications and attestations of our infrastructure providers (e.g. Google Cloud / Firebase).

You can download a complete copy of your data at any time from Settings, Account data export, in your admin console. We also email your Super Admins once a year reminding them to do so.

When your METBooker account is to be closed, we mark it for deletion and email your Super Admins a link to download a copy of your data. The account and the personal data processed on your behalf are deleted 7 days later, on the date given in that email. We send a final notice the day before. If you reply before that date, for example to extend a trial or to reactivate, we can cancel the deletion.

Before anything is deleted we make a final download of your account. If it cannot be made, nothing is deleted. The final download is kept for 90 days after deletion. Your former Super Admins can download it by signing in with the Google account they used for METBooker, and we remind them by email before it expires. After 90 days it is deleted.

We keep, after deletion, only what we need for tax and legal purposes: a record that the account existed and was deleted, with your business name and billing references. Your former Super Admins’ email addresses are removed from that record 30 days after the final download period has ended. Backups containing residual data are purged on the rolling cycle described in section 5.

Questions about this DPA, sub-processor changes, audit requests, or data subject requests escalated to us as processor should be sent to the address below. For security incident reports, see section 13.2.