Data Processing Terms
Last updated 17 September 2026 · version 2026-09-17
These terms form part of the Terms & Conditions and satisfy Article 28(3) of the UK GDPR. They apply automatically to every account — there is nothing to sign and nothing to request. If a member, a parent, your insurer or your landlord asks whether you have a data processing agreement with your software supplier, this page is it.
In these terms “we” and “us” mean Property Workflow Systems Ltd (registered in England and Wales, company no. 17376073), registered office Unit 6, Orchard Business Units, Cockaynes Lane, Alresford CO7 8BZ. “You” means the gym, club or studio operating an account. Controller, processor, personal data and processing have the meanings given in the UK GDPR.
1. Who is who
You are the controller of everything you put in about your members: who they are, how to reach them, what they pay for, and every time they sign in at your door. You decide what to collect, why, how long to keep it and who to share it with, and you are responsible for having a lawful basis and for telling the people concerned.
We are your processor for that data: we store it and act on it only to provide the Service to you and only on your instructions.
Separately, we are the controller of your own account details — the names and emails of the people who sign in to the office side, your gym’s name, the login credentials and the subscription record. That is described in our Privacy Policy and is not covered by these processor terms.
2. What we process for you, and why
| Subject matter | Providing the Tap In Book service to you |
|---|---|
| Duration | For as long as your account exists, plus the deletion period in section 9 |
| Nature and purpose | Recording arrivals; storing, organising, displaying and exporting your records; working out attendance, allowances and who has stopped coming; and sending the messages you switch on — to you, and to your members or their guardians |
| Types of personal data | Members’ first names and surnames; dates of birth where you record them; email addresses and phone numbers; emergency contact names and numbers; a four-digit PIN, stored hashed, where you issue one; a contact opt-out; anything you add as your own field; membership and plan records; attendance records — the date and time of every sign-in, the tablet it was made on, and the class it was matched to; for junior members, a guardian’s name, email address and phone number; for visitors who sign in as guests, a name, phone number and email address. Photographs of members are not collected by the Service today; the record has a place for one, and if that is ever switched on it is covered by these terms and deleted with everything else. |
| Categories of data subject | Your members, including children where you run junior classes; their parents or guardians; visitors who sign in as guests; and the people you give office logins to |
| Children | The Service is designed on the basis that some members are under 18. Where a member has a guardian recorded, every message the Service sends about that member is addressed to the guardian and never to the child. One piece of code decides that, and it is the only place in the Service that decides it. The Service does not define who is a junior and does not infer it from a date of birth: whether a guardian is recorded is your decision, taken member by member. |
| Special category data | None is required and none is asked for. There is no health information, no medical history, no injury record and no payment card anywhere in the Service. Free text fields — notes, your own fields, the wording of a message — could contain special category data if you put it there. You decide, and you remain the controller if you do. |
3. Our obligations to you
We will:
- Process only on your documented instructions. Your instructions are these terms, the Terms & Conditions, and your use of the Service’s features and settings. We do not mine your data, profile it, sell it, or use it to train anything. If we are ever required by law to process it otherwise, we will tell you first unless the law forbids that.
- Keep it confidential. Access is limited to the people who need it to run or support the Service, and they are bound by confidentiality obligations.
- Secure it with appropriate technical and organisational measures — section 5.
- Use sub-processors only as set out in section 6.
- Help you answer your members. A member’s own page shows everything held about them, including every sign-in and every message they have been sent, and you can export it or delete it yourself. Where a request cannot be handled that way, we will help.
- Help you meet your own obligations on security, breach notification, impact assessments and consultation with the ICO, taking into account what we know and what is available to us.
- Tell you about a personal data breach without undue delay after becoming aware of one, with the detail you need to make your own notification inside your 72-hour window.
- Delete or return the data at the end — section 9.
- Make available the information you need to demonstrate our compliance, and submit to audits — section 8.
4. What the Service shows in a public room, and what you control
A tablet by a front door is a privacy decision as much as a product feature, so the settings that affect it are listed here rather than buried in a manual. All of them are yours.
- The name list. Switched on, the tablet shows a row of initials and then the members filed under the one tapped — so a person standing at the tablet can see your members’ names. Switched off, with the PIN used instead, nothing on the screen names anybody until four digits match a record. Choose deliberately, and tell your members which you have chosen.
- The confirmation. After a sign-in the tablet shows one first name for about three seconds and then returns to the start. It never shows the previous person’s name to the next.
- What a tablet can reach. A paired tablet can open the sign-in screen and nothing else — not a report, not a member’s record, not a phone number — whatever its state. Revoking it from Settings stops it at the next tap. It does hold a copy of the member list on itself, so that it works when the wifi drops.
- Guests. If “Not on the list?” is switched on, a visitor’s name and phone number are typed on the tablet and kept as a record of somebody who is not your member.
- Messages. Both the digest to you and the nudge to your members are off until you switch them on. The nudge honours a member’s opt-out and goes to a guardian where one is recorded.
5. Security measures
- All traffic is served over HTTPS; the database and any stored files are encrypted at rest by the underlying platform.
- Each account’s data is held under its own tenant identity, on its own web address, with every database query scoped to that account. Cross-account access is tested automatically on every change, against a real database rather than a stand-in, because a stand-in agrees just as happily with a query that has no account in it.
- Passwords are stored hashed and salted with a server-side secret; they are never stored or logged in plain text and cannot be read by us. Members’ PINs are stored the same way, which is why a stolen tablet is not a list of everybody’s PIN — and why a PIN cannot be checked when the tablet has no connection.
- A paired tablet holds a long-lived credential that is stored hashed at our end and is allowed to reach the sign-in screen and nothing else. You can revoke it at any time.
- Repeated failed sign-ins are rate-limited, as are password-reset requests. Forms are protected against cross-site request forgery. Inbound payment webhooks are signature-verified.
- Sign-ins held on a tablet with no connection are kept in that browser only and sent under that tablet’s own credential.
- Backups. Every night we take a copy of your whole account — your members, their memberships and plans, your timetable, your tablets, every sign-in and every message you have sent — and we keep the last 30 nights of it. Each copy is written twice: once alongside the live database and once into separate object storage, so that a fault which takes out one cannot take out the other. The public demo gym is the one account not backed up, because it is rebuilt from scratch every night and there is nothing in it that belongs to anybody. Your members’ four-digit PINs and your tablets’ pairing credentials are not copied into it. Both are credentials, and a backup that carried them could put a tablet you had revoked back on your wall. So if we ever have to restore your account from a backup, every paired tablet will ask for a new pairing code from Settings → Devices, and any member who signs in with a PIN will need a new one issuing. Everything else — every member, every sign-in, every record — comes back as it was. A backup is deleted with everything else when an account is closed and purged. Your own download from Settings → Your data is the copy that is fully within your control, and it keeps working when the account is read-only.
We may change these measures as technology moves, provided the level of protection is not reduced.
6. Sub-processors
You give general authorisation for us to use the sub-processor below. It is bound by a written agreement with data protection obligations no less protective than these terms.
| Sub-processor | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, network security, and sending the email you ask us to send — your daily digest, and the nudges to your members or their guardians | Database and files in Western Europe; global network |
Paddle is our reseller and Merchant of Record for your subscription and is a controller of your billing data under its own terms; it never receives anything about your members. If you choose to send messages by text, the text-message provider is one you supply and contract with yourself, and it is not our sub-processor.
We will give you at least 30 days’ notice by email before adding or replacing a sub-processor. If you reasonably object on data protection grounds, tell us within those 30 days and we will either propose a change or you may cancel without penalty and download your data.
7. International transfers
Where personal data is transferred outside the UK, the transfer is covered by the UK Information Commissioner’s International Data Transfer Addendum to the EU Standard Contractual Clauses, or another safeguard approved under Article 46 of the UK GDPR, in the provider’s data processing agreement. We do not transfer your data anywhere else.
8. Audits and information
We will answer reasonable written questions about how we handle your data and give you what you need to demonstrate compliance. If you require an on-site or third-party audit we will co-operate with one audit in any twelve-month period, on at least 30 days’ notice, at your cost, during business hours, without unreasonably disrupting the Service and subject to confidentiality — or more often if a supervisory authority requires it.
9. Return and deletion
You can download your records yourself at any time from Settings → Your data, as spreadsheets, and that keeps working even if the subscription lapses and the account goes read-only.
When you close the account it becomes read-only immediately and we delete it — the members, the memberships, the timetable, the tablets, every sign-in, any uploaded file and the account itself — 30 days later, except anything we must keep by law (for example transaction records for tax). You can change your mind during those 30 days. Download first: after deletion we cannot get it back.
10. Liability and precedence
These terms are subject to the limits of liability in the Terms & Conditions. If anything here conflicts with those terms, these terms win, but only for matters of data protection.
11. Contact
Data protection questions, breach notifications and audit requests: hello@tapinbook.co.uk. There is no ticket system — it reaches a person.