Data Processing Terms

These terms are part of June's Terms of Service. They apply when your shop uses June to keep or handle personal data about other people, mainly your clients and your staff. You do not need to sign anything: using June means these terms apply.

In these terms, “you” means your shop and “June” means Hey Sweet Peas Inc., based in Burlington, Ontario, Canada.

Who does what

You decide what personal data to keep in June and why. In data protection law, that makes you the controller. June keeps and handles that data only to provide June to you, which makes June your processor.

What June handles

• What for: providing June to you: booking and scheduling, reminders and other messages, client and pet records, checkout and payment records, paperwork, and reports.
• How long:for as long as you use June, and then until it is deleted as described in “When you leave” below.
• What June does with it: stores, organizes, shows, sends, backs up and deletes it, as the features you use need.
• About whom: your clients and the people who book with you, and your staff.
• What data:names and contact details (phone, email, address), pet details and notes, appointment history, signed agreements and uploaded files such as vaccine records, payment records (never full card numbers), texts and emails sent and received, including photos clients text you, and your staff's details and work records.
• Sensitive data:June is not built for health or other special category data about people. Please do not enter it. Information about a pet's health is not covered by this rule.

Your instructions

June handles your data only as you instruct, including any transfer to another country. Using June's features, your settings, and these terms are your instructions. If a law requires June to do something else with the data, June tells you first, unless that law forbids telling you. If June thinks an instruction breaks data protection law, June tells you.

Your part: you need a lawful reason to keep your clients' data, you tell your clients how you use it, and you collect consent where the law asks for it, for example before texting a client.

People at June

Everyone at June who can see your data must keep it confidential, and only people who need access to run or support June get it.

Security

June protects your data with measures that fit the risk, including:

• Encryption in transit (every connection uses HTTPS) and encryption at rest.
• Database rules that keep each shop's data separate from every other shop's.
• Access only for the people who need it, and sign-in protections such as bot checks and limits on repeated attempts.
• Regular backups, so data can be restored if something goes wrong.
• Established providers, chosen for their security.

Other providers

You agree that June can use other companies to run June, for example to host the database, send texts and emails, and process payments. June keeps a list of them and gives it to you on request.

Helping you

June helps you answer your clients' requests about their data, such as a request for a copy or for deletion. Most of these you can do yourself in June, and June helps with the rest. June also helps you with security, with reporting a breach, and with data protection impact assessments and questions from a regulator, as far as June reasonably can with the information it has.

Breaches

If June learns of a security breach that affects your data, June tells you without undue delay. June shares what it knows (what happened, what data is affected, the likely effects, and what June is doing about it) and keeps you updated as it learns more.

Where your data goes

June stores your data in the United States and works with it from Canada. The UK and the EU both accept that Canada protects data well enough for companies covered by Canada's private-sector privacy law, which covers June.

When you leave

You can export your data at any time. If your subscription or trial ends, your shop stays read-only for 12 months so you can come back or export it, and then June deletes your data. If you ask, June deletes it sooner, within 30 days of your request. June keeps only what the law requires it to keep, such as billing records. After deletion, a copy can stay in backups for up to 30 days.

Checking

June gives you the information you reasonably need to show that these terms are being met, including the provider list and answers to reasonable security questions.

Everything else

The limits of liability in the Terms of Service apply to these terms too, except where the law does not allow them. If these terms and the Terms of Service ever disagree about personal data, these terms win. Changes follow the Terms of Service: you get an email before a change that matters.

Questions: support@hellojune.io.