Data Processing Agreement

1. Overview

This Data Processing Agreement ("DPA") forms part of the Terms of Service between BookingXi and the business operator ("Controller"). This DPA applies where BookingXi processes personal data on behalf of the Controller.

2. Data Processing

BookingXi processes personal data solely for the purpose of providing booking, payment, and business management services as described in our Terms of Service. We process data including customer names, email addresses, phone numbers, booking details, and payment information.

3. Sub-processors

BookingXi uses the following sub-processors:

• Supabase — Database hosting and authentication
• Stripe — Payment processing
• Vercel — Application hosting
• Resend — Transactional email delivery

4. Data Security

BookingXi implements appropriate technical and organizational measures including encryption in transit and at rest, row-level security for data isolation, regular security audits, and access controls with audit logging.

5. Data Subject Rights

BookingXi will assist the Controller in responding to data subject requests including access, rectification, erasure, and portability. Requests should be directed to dpa@bookingxi.com.

6. Contact

For DPA-related inquiries, please contact dpa@bookingxi.com.