This Addendum forms part of the agreement between the business customer and Schedmo when applicable data-protection law requires processor terms.
1. Roles and scope
The customer is the controller of personal data submitted to Schedmo for its clients, staff and business operations. Schedmo is the processor for that data and acts only on documented customer instructions, including this Addendum, the agreement, product configuration and authorised support requests, unless law requires otherwise. If law requires different processing, Schedmo will tell the customer before processing unless prohibited. Each party remains a controller for information it independently processes for contracting, billing, security and legal compliance.
2. Processing details
Processing includes hosting, organising, retrieving, transmitting, backing up, securing, supporting, exporting and deleting appointment, client, staff, form, communication and transaction data for the term of the service. Data subjects may include customers, prospective customers, staff and authorised users. Data may include contact, booking, preference, form, payment-status and usage information, and may include sensitive information when the customer chooses to collect it.
3. Customer instructions and obligations
The customer instructs Schedmo to process customer data as necessary to provide, secure and support the subscribed services and enabled integrations. The customer warrants that its instructions and disclosures are lawful, that it has provided required notices and obtained required consents, and that it will collect only data necessary for its purposes. Schedmo will promptly inform the customer if it reasonably believes an instruction infringes applicable data-protection law and may pause that instruction while the parties resolve it.
4. Confidentiality and security
Schedmo restricts access to authorised personnel and uses technical and organisational safeguards appropriate to the risk, including encryption in transit, encrypted storage, tenant isolation, least-privilege access, multi-factor authentication for privileged access, logging, vulnerability and dependency management, recoverable backups, continuity controls and incident procedures. Personnel with access are bound by confidentiality obligations and receive appropriate security and privacy training. Safeguards are reviewed as risks and the service change.
5. Subprocessors and transfers
Schedmo has general authorisation to use vetted infrastructure, identity, communications, payment, analytics and support providers to deliver the service. Subprocessors receive written data-protection obligations no less protective than the relevant requirements of this Addendum, and Schedmo remains responsible for their delegated processor obligations. Schedmo uses lawful transfer safeguards where required and will provide information reasonably needed to assess them. Material new subprocessors will be notified through the service, email or published legal materials with a reasonable opportunity to object on genuine data-protection grounds. If the parties cannot resolve a valid objection, the customer may discontinue the affected feature or terminate it without penalty.
6. Individual rights and incidents
Schedmo will provide reasonable assistance for access, correction, portability, objection, restriction and erasure requests relating to customer-controlled data and will send a request to the customer where the customer is responsible for responding. Schedmo will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data, describe the known nature and likely consequences, affected records and people, mitigation taken and a contact point, and provide updates as the investigation develops. Notification is not an admission of fault. The customer remains responsible for regulator and individual notifications unless law assigns that duty to Schedmo.
7. Assessments and regulatory assistance
Schedmo will provide reasonable information and cooperation for the customer's data-protection impact assessments, regulator consultations and legally required records of processing where the request relates to the service and the customer cannot reasonably obtain the information itself. Assistance beyond standard documentation may be subject to reasonable agreed fees unless required because of Schedmo's breach.
8. Return, deletion and retention
Customers can export workspace data while authorised. Subscription cancellation does not itself delete data. An authenticated workspace-closure instruction enters restricted settlement mode while invoices, processing payments, refunds, disputes, liabilities or payout balances remain; new acquisition activity is stopped while settlement and export functions remain available. Once clear, production personal data is deleted or de-identified without undue delay and backup copies expire on the documented backup cycle. Limited financial, consent, security and compliance evidence may be retained where law or legal claims require it, with access restricted and unnecessary identifiers removed.
9. Audit and deletion assurance
Schedmo maintains proportionate evidence of high-risk access, exports and erasure operations. On reasonable written request, Schedmo will first provide current independent reports, certifications or questionnaires sufficient to demonstrate compliance. If those are insufficient, the customer may conduct one proportionate audit per year on reasonable notice through an independent, confidential auditor, or more often after a material breach or where a regulator requires it. Audits must avoid exposing other customers' information or creating a security or service risk. Each party bears its own costs unless an audit identifies a material breach by Schedmo.
10. Government requests
Schedmo will assess requests for customer data and disclose only where it reasonably believes it is legally required. Unless prohibited, Schedmo will notify the customer before disclosure and provide reasonable information so the customer may seek protection. Schedmo will challenge an overbroad or unlawful request where there are reasonable grounds to do so.
11. Priority and duration
This Addendum applies while Schedmo processes customer data under the agreement. It survives termination for as long as retained customer data remains. If this Addendum conflicts with the agreement on processing customer data, this Addendum prevails; mandatory data-protection law always prevails. Liability relating to this Addendum is governed by the agreement except where applicable law requires otherwise.