Data Processing Agreement
Version 2026-09-25, in force from 25 September 2026. See also the Terms of Service.
This Data Processing Agreement (“DPA”) forms part of the Bookrail Terms of Service (the “Terms”) between MP Informatica Srl, Strada di Santa Bona Nuova 33/B, 31100 Treviso (TV), Italy, VAT number 05355370262 (“Bookrail”, the “Processor”), and the Customer that accepted the Terms (the “Customer”, the “Controller”). It applies automatically, without a separate signature, whenever Bookrail processes personal data on behalf of the Customer in providing the Service. Capitalised terms not defined here have the meaning given in the Terms or in Regulation (EU) 2016/679 (the “GDPR”).
1. Subject matter, duration, nature and purpose
1.1. Bookrail processes personal data contained in Customer Data only to provide the Service to the Customer, as described in the Terms and in Annex 1, for the duration of the Terms and of the period in Section 10.
1.2. Where the Customer is itself a processor acting for its own customer, the Customer warrants that its instructions to Bookrail are authorised by that controller, and Bookrail is a sub-processor.
2. Instructions
2.1. Bookrail processes personal data only on documented instructions of the Customer. The Terms, this DPA, the configuration of the Customer’s projects, and the Customer’s use of the API, command line interface and dashboard are the Customer’s complete instructions.
2.2. Bookrail will inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law, and may suspend the processing concerned until the instruction is confirmed or changed.
2.3. Bookrail may process personal data otherwise only where required by EU or Member State law, in which case it will inform the Customer before processing, unless the law prohibits it.
3. Confidentiality
Bookrail ensures that the persons authorised to process personal data are bound by confidentiality obligations and have access only to what they need to perform their tasks. At the date of this DPA, the only person with access to production systems is Bookrail’s founder and director.
4. Security
4.1. Bookrail implements the technical and organisational measures described in Annex 2, and keeps them appropriate to the risk in accordance with Article 32 GDPR.
4.2. Bookrail may update the measures, provided that the overall level of protection is not reduced.
5. Sub-processors
5.1. The Customer gives a general authorisation to Bookrail to engage the sub-processors listed in Annex 3.
5.2. Bookrail will notify the Customer by email of any intended addition or replacement of a sub-processor at least 30 days in advance and update Annex 3. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service with effect from the change, and receive a refund of fees paid for the period after termination.
5.3. Bookrail imposes on each sub-processor data protection obligations equivalent to those in this DPA, and remains responsible to the Customer for the performance of its sub-processors.
6. International transfers
Bookrail processes and stores Customer Data in the European Economic Area and does not transfer it outside the EEA. If a transfer becomes necessary, Bookrail will first notify the Customer under Section 5.2 and will ensure a valid transfer mechanism under Chapter V GDPR, such as the Standard Contractual Clauses.
7. Assistance to the Customer
7.1. Data subject requests. The Service lets the Customer retrieve, correct, export and delete End User data through the API (including the deletion or anonymisation of a customer record). Where the Customer cannot fulfil a request of a data subject through the Service, Bookrail will assist within a reasonable time. If Bookrail receives a request directly, it will forward it to the Customer without responding on the merits.
7.2. Other assistance. Bookrail will provide reasonable assistance with data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to it.
8. Personal data breaches
8.1. Bookrail will notify the Customer of a personal data breach affecting Customer Data without undue delay, and in any case within 48 hours after becoming aware of it, by email to the Account owner.
8.2. The notification will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed; information not available at first will be provided as it becomes available.
8.3. Bookrail will take reasonable steps to contain the breach and mitigate its effects. A notification is not an admission of fault.
9. Audits
9.1. Bookrail will make available to the Customer the information necessary to demonstrate compliance with this DPA, including a written description of its measures and answers to reasonable security questionnaires, once per calendar year.
9.2. If that information is not sufficient to demonstrate compliance, or where required by a supervisory authority, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, with at least 30 days’ notice, during business hours, without disrupting the Service or accessing other customers’ data, and at the Customer’s cost.
10. Deletion and return
At the end of the Terms, Bookrail makes Customer Data available for export for 30 days, and then deletes it, as described in Section 12.6 of the Terms, unless EU or Member State law requires its storage. Copies in encrypted backups are deleted when the backups expire under Bookrail’s rotation, within a further 30 days, and are not restored in the meantime except to recover the Service after an incident.
11. Liability and precedence
11.1. The limitations of liability in the Terms apply to this DPA, to the extent permitted by the GDPR.
11.2. In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails.
Annex 1. Description of the processing
| Categories of data subjects | The Customer’s End Users (persons who make, receive or manage bookings through the Customer’s product); the Customer’s own staff and resources represented in the Service (for example, a practitioner or an instructor). |
| Categories of personal data | Those the Customer chooses to submit, typically: name, email address, telephone number, booking details (service, times, resources, status, history), notes and metadata written by the Customer, and payment status and amounts of bookings paid through the Customer’s own Stripe account (Bookrail does not receive card data). |
| Special categories | None, unless the Customer submits them in breach of Section 5.1(b) of the Terms. |
| Nature of the processing | Storage, retrieval, computation of availability, creation and modification of bookings, emission of events and webhooks to endpoints configured by the Customer, orchestration of payments on the Customer’s Stripe account, backup and deletion. |
| Purpose | Providing the Service to the Customer. |
| Duration | The term of the Terms and the period in Section 10. |
| Frequency | Continuous. |
Annex 2. Technical and organisational measures
- Isolation between customers. Every table that holds Customer Data is protected by Row Level Security enforced by the database for every project and environment; the application connects with a role that cannot bypass it, and an automated check refuses a release if that is not the case.
- Encryption in transit. TLS on every public endpoint, with HSTS; webhook deliveries are signed.
- Encryption of secrets and backups. API keys are stored only as SHA-256 hashes and shown once; webhook signing secrets are encrypted with AES-256-GCM; nightly database backups are encrypted with
ageto a key whose private half is not stored on the server. - Access control. Production access only through SSH with keys, by the founder; no password login; secrets in files readable only by the services that need them.
- Least privilege in the application. Operations across projects go through single-purpose database functions with a fixed result shape; the internet-facing process holds no privileged database connection.
- Availability and recovery. Nightly encrypted backups kept 7 days on the server and 30 days off site in the EU; a documented restore procedure tested periodically; health checks every minute.
- Rate limiting and abuse protection per API key and on public endpoints.
- Logging. Request logs without request bodies, secrets or plain-text personal data of End Users, kept 14 days.
- Secure development. Every change passes an automated test suite against a real database, and security-relevant changes are reviewed independently before release.
Annex 3. Sub-processors
| Sub-processor | Service | Location of data |
|---|---|---|
| Aruba S.p.A., Italy | Virtual server hosting the Service and its database | Italy |
| Hostinger International Ltd. | Storage of encrypted backups (off site); email delivery of Service messages to the Account owner | France (backup storage); EU (email) |
Stripe is not a sub-processor of Bookrail for Customer Data: payments are processed on the Customer’s own Stripe account under the Customer’s agreement with Stripe.