Processing agreement

Last updated: 2026-10-21

1. Who is who

You (the business) decide which client data you collect and why: you are the controller. Whistle Booking stores and processes that data only to run your booking system: Whistle is the processor.

2. What data, and why

Clients' names, email addresses, phone numbers, appointments, notes you write, answers to your questions before the visit, purchases and marketing choices; your team's names and working hours.

Used only for: bookings and their emails, your calendar and reports, payments and gift cards, and the features you switch on.

3. What Whistle promises

• Process the data only on your instructions (your settings and actions in Whistle), never for its own purposes, never sell it.

• Keep it in the European Union, encrypted in transit, with access only for staff who need it, under confidentiality.

• Tell you without delay, and within 48 hours, about a data breach that affects your data.

• Help you answer clients' requests (access, correction, deletion) — the tools are in the client page.

• Delete or return your data within 30 days after you close your account, except what the law requires us to keep.

4. Sub-processors

Whistle uses these services to run: Cloudflare (hosting and database, EU), Resend (sending email, EU region), and, when you switch on online payments, Mollie (payments, NL). Whistle tells you in advance about a new sub-processor; you may object.

5. Your part

• Only collect what you need, and no medical information in notes.

• Keep your sign-in safe; turn on two-step sign-in.

• Tell your clients how you use their data (your privacy statement).

6. Duration

This agreement runs as long as you use Whistle Booking. Dutch law applies.