Data Processing Terms

Last updated 7 November 2026 · version 2026-11-07

Notice, 10 November 2026. We are changing payment provider. Paddle no longer takes payments for us, and online payment is paused. Nothing is charged until you choose to subscribe with our new provider. We will update this page before payments start again. If your free trial ends while payment is paused, your account keeps working.

These terms form part of the Terms & Conditions and satisfy Article 28(3) of the UK GDPR. They apply automatically to every account — there is nothing to sign and nothing to request. If somebody on your list, a parent, your insurer or your landlord asks whether you have a data processing agreement with your software supplier, this page is it.

In these terms “we” and “us” mean Property Workflow Systems Ltd (registered in England and Wales, company no. 17376073), registered office Unit 6, Orchard Business Units, Cockaynes Lane, Alresford CO7 8BZ. “You” means the place operating an account. Controller, processor, personal data and processing have the meanings given in the UK GDPR.

1. Who is who

You are the controller of everything you put in about the people who come to your place: who they are, how to reach them, what they pay for, and every time they sign in at your door. You decide what to collect, why, how long to keep it and who to share it with, and you are responsible for having a lawful basis and for telling the people concerned.

We are your processor for that data: we store it and act on it only to provide the Service to you and only on your instructions.

Separately, we are the controller of your own account details — the names and emails of the people who sign in to the office side, your place’s name, the login credentials and the subscription record. That is described in our Privacy Policy and is not covered by these processor terms.

2. What we process for you, and why

Subject matter	Providing the Tap In Book service to you
Duration	For as long as your account exists, plus the deletion period in section 9
Nature and purpose	Recording arrivals; storing, organising, displaying and exporting your records; working out attendance, allowances and who has stopped coming; and sending the messages you switch on — to you, and to the people on your list or their guardians
Types of personal data	First names and surnames; dates of birth where you record them; email addresses and phone numbers; emergency contact names and numbers; a four-digit PIN, stored hashed, where you issue one; a contact opt-out; anything you add as your own field; membership and plan records; attendance records — the date and time of every sign-in, the tablet it was made on, and the session it was matched to, and — where somebody taps out or is marked as having left — the time they left and whether that was on the tablet, at the desk or at closing; for anybody under 18, a guardian’s name, email address and phone number; for visitors who sign in as guests, a name, phone number and email address, or — where you have switched on the date-of-birth sign-in — a first name and who they are here to see, and no phone number at all. Photographs are not collected by the Service today; the record has a place for one, and if that is ever switched on it is covered by these terms and deleted with everything else.
A date of birth at the door	You may choose a way of signing in where somebody taps their own date of birth and the first letter of their surname on the tablet, and nothing on that screen names anybody until the two together match exactly one of your records. Choosing it switches the name list off and keeps it off. The tablet holds no dates of birth — not a copy of your list, not a scrambled form of one, and nothing waiting in the browser to be sent later. Each entry is checked against your records on our side and then forgotten, and nothing about the attempt is kept: what somebody typed is not stored, logged or reported anywhere, whether it matched or not. The only record an unsuccessful attempt can leave is a request for help at the desk, which says which tablet and when and nothing about who the person said they were. Because the check happens on our side, this one method does not work when the tablet has no connection, and the tablet says so.
Categories of data subject	The people on your list, including children where children come to your place; their parents or guardians; visitors who sign in without being on the list; and the people you give office logins to
Children	The Service is designed on the basis that some of the people on a list are under 18. Where somebody has a guardian recorded, every message the Service sends about them is addressed to the guardian and never to the child. One piece of code decides that, and it is the only place in the Service that decides it. The Service does not define who is a junior and does not infer it from a date of birth: whether a guardian is recorded is your decision, taken person by person.
Special category data	None is required and none is asked for. There is no health information, no medical history, no injury record and no payment card anywhere in the Service. A date of birth is not special category data; it is ordinary personal data, and it is the same date of birth the Service has always let you record, used at the door as well as in the office. Free text fields — notes, your own fields, the wording of a message — could contain special category data if you put it there. You decide, and you remain the controller if you do. Section 1 of the Terms & Conditions sets out the settings the Service is not to be used in, and nothing here changes it.

3. Our obligations to you

We will:

Process only on your documented instructions. Your instructions are these terms, the Terms & Conditions, and your use of the Service’s features and settings. We do not mine your data, profile it, sell it, or use it to train anything. If we are ever required by law to process it otherwise, we will tell you first unless the law forbids that.
Keep it confidential. Access is limited to the people who need it to run or support the Service, and they are bound by confidentiality obligations.
Secure it with appropriate technical and organisational measures — section 5.
Use sub-processors only as set out in section 6.
Help you answer the people on your list. Somebody’s own page shows everything held about them, including every sign-in and every message they have been sent, and you can export it or delete it yourself. Where a request cannot be handled that way, we will help.
Help you meet your own obligations on security, breach notification, impact assessments and consultation with the ICO, taking into account what we know and what is available to us.
Tell you about a personal data breach without undue delay after becoming aware of one, with the detail you need to make your own notification inside your 72-hour window.
Delete or return the data at the end — section 9.
Make available the information you need to demonstrate our compliance, and submit to audits — section 8.

4. What the Service shows in a public room, and what you control

A tablet by a front door is a privacy decision as much as a product feature, so the settings that affect it are listed here rather than buried in a manual. All of them are yours.

The name list. Switched on, the tablet shows a row of initials and then the names filed under the one tapped — so a person standing at the tablet can see the names on your list. Switched off, with the PIN used instead, nothing on the screen names anybody until four digits match a record. Choose deliberately, and tell the people who come which you have chosen.
A sign-in that uses a date of birth. You may choose a third way instead, in which somebody taps their own date of birth and the first letter of their surname and nothing on the tablet names anybody until the two together match exactly one record. Choosing it switches the name list off and keeps it off. Two things about it are worth knowing and are the reason it is described here rather than in a manual. First, the tablet holds no dates of birth at all — not a copy of your list, not a scrambled form of one, and nothing waiting in the browser to be sent later. Each entry is checked against your records on our side and then forgotten, which is why this one method does not work when the tablet has no connection: a tablet that leaves the building is not a list of anybody’s dates of birth, and that is a deliberate trade rather than an oversight. Second, where two people share a date of birth and an initial the tablet signs in neither of them and asks the person to see the desk, rather than guessing between two records.
“Please see the desk”, and what it records. Where that method is on, every screen carries a button that tells the desk somebody needs help. What is recorded is the tablet and the time, and nothing at all about who the person said they were — not the digits typed, not a partial date, not whether anything matched. The same row is written when somebody has entered too many wrong dates in a row and the tablet asks them to see a person instead.
The confirmation. After a sign-in the tablet shows one first name and nothing else for about three seconds — two, where the date-of-birth method is on — and then returns to the start. It never shows the previous person’s name to the next.
What a tablet can reach. A paired tablet can open the sign-in screen and nothing else — not a report, not somebody’s record, not the arrivals board, not a phone number — whatever its state. Revoking it from Settings stops it at the next tap. Where the name list is in use it holds a copy of that list on itself, so that it works when the wifi drops; where the date-of-birth method is in use instead, it holds nothing.
Tapping out. Where you switch on “Leaving? Tap out”, a person leaving uses the same way they signed in, and the tablet shows their first name and nothing else. It can only add a leaving time to a visit already recorded that day; it never records an arrival. Guests do not tap out on the tablet. Who is still in is shown only in the office, behind a login, on the Still here screen and its printable roll-call — never on the tablet.
The arrivals board. Anybody with a login can open a screen showing who has arrived in the last couple of hours, by name, and mark that they have been called. It is an office screen behind a login, not a screen for a public room, and a paired tablet cannot reach it. Where somebody has asked for help at the door, that appears on it as a call from a tablet, naming nobody.
Guests. If “Not on the list?” is switched on, a visitor’s name and phone number are typed on the tablet and kept as a record of somebody who is not your person. Where the date-of-birth method is on, that screen does not ask for a phone number at all: it asks a first name and who the person is here to see.
Messages. Both the digest to you and the nudge to the people on your list are off until you switch them on. The nudge honours a person’s opt-out and goes to a guardian where one is recorded.

5. Security measures

All traffic is served over HTTPS; the database and any stored files are encrypted at rest by the underlying platform.
Each account’s data is held under its own tenant identity, on its own web address, with every database query scoped to that account. Cross-account access is tested automatically on every change, against a real database rather than a stand-in, because a stand-in agrees just as happily with a query that has no account in it.
Passwords are stored hashed and salted with a server-side secret; they are never stored or logged in plain text and cannot be read by us. The PINs people tap at the door are stored the same way, which is why a stolen tablet is not a list of everybody’s PIN — and why a PIN cannot be checked when the tablet has no connection.
A paired tablet holds a long-lived credential that is stored hashed at our end and is allowed to reach the sign-in screen and nothing else. You can revoke it at any time.
Repeated failed sign-ins are rate-limited, as are password-reset requests. Forms are protected against cross-site request forgery. Inbound payment webhooks are signature-verified.
Sign-ins held on a tablet with no connection are kept in that browser only and sent under that tablet’s own credential.
Backups. Every night we take a copy of your whole account — the people on your list, their memberships and plans, your timetable, your tablets, every sign-in and every message you have sent — and we keep the last 30 nights of it. Each copy is written twice: once alongside the live database and once into separate object storage, so that a fault which takes out one cannot take out the other. The public demo place is the one account not backed up, because it is rebuilt from scratch every night and there is nothing in it that belongs to anybody. Your tablets’ pairing credentials are never copied into it, whatever else you choose. A pairing credential is what lets a tablet reach your sign-in screen, and a backup that carried one could put a tablet you had revoked back on your wall. So if we ever have to restore your account from a backup, every paired tablet will ask for a new pairing code from Settings → Devices. The four-digit PINs are left out as well — unless you switch them on, which is yours to decide in Settings → PINs in your nightly copy and is off to begin with. Left out, a copy of the backup on its own can never be used to try PINs against, and after a restore everybody who signs in with a PIN will need a new one issuing. Switched on, the PINs travel in the backup in the same scrambled form they are stored in — never the four digits themselves, and never the separate secret they are scrambled with — and after a restore nobody needs a new one. Changing the setting applies to the backups taken from that night on; it does not alter the ones already kept. Everything else — every person, every sign-in, every record — comes back as it was. A backup is deleted with everything else when an account is closed and purged. Your own download from Settings → Your data is the copy that is fully within your control, and it keeps working when the account is read-only.

We may change these measures as technology moves, provided the level of protection is not reduced.

6. Sub-processors

You give general authorisation for us to use the sub-processor below. It is bound by a written agreement with data protection obligations no less protective than these terms.

Sub-processor	What it does	Where
Cloudflare, Inc.	Hosting, database, file storage, network security, and sending the email you ask us to send — your daily digest, and the nudges to the people on your list or their guardians	Database and files in Western Europe; global network

Paddle is our reseller and Merchant of Record for your subscription and is a controller of your billing data under its own terms; it never receives anything about the people on your list. If you choose to send messages by text, the text-message provider is one you supply and contract with yourself, and it is not our sub-processor.

We will give you at least 30 days’ notice by email before adding or replacing a sub-processor. If you reasonably object on data protection grounds, tell us within those 30 days and we will either propose a change or you may cancel without penalty and download your data.

7. International transfers

Where personal data is transferred outside the UK, the transfer is covered by the UK Information Commissioner’s International Data Transfer Addendum to the EU Standard Contractual Clauses, or another safeguard approved under Article 46 of the UK GDPR, in the provider’s data processing agreement. We do not transfer your data anywhere else.

8. Audits and information

We will answer reasonable written questions about how we handle your data and give you what you need to demonstrate compliance. If you require an on-site or third-party audit we will co-operate with one audit in any twelve-month period, on at least 30 days’ notice, at your cost, during business hours, without unreasonably disrupting the Service and subject to confidentiality — or more often if a supervisory authority requires it.

9. Return and deletion

You can download your records yourself at any time from Settings → Your data, as spreadsheets, and that keeps working even if the subscription lapses and the account goes read-only.

When you close the account it becomes read-only immediately and we delete it — the people, the memberships, the timetable, the tablets, every sign-in, any uploaded file and the account itself — 30 days later, except anything we must keep by law (for example transaction records for tax). You can change your mind during those 30 days. Download first: after deletion we cannot get it back.

10. Liability and precedence

These terms are subject to the limits of liability in the Terms & Conditions. If anything here conflicts with those terms, these terms win, but only for matters of data protection.

11. Contact

Data protection questions, breach notifications and audit requests: hello@tapinbook.co.uk. There is no ticket system — it reaches a person.