Data Processing Addendum
Version 0.9 · Effective 2026-05-17
DPA available to business users. Covers GDPR Article 28, UK GDPR, and Standard Contractual Clauses for cross-border transfers.
This DPA is incorporated by reference into the agreement between BookTarot Ltd. and the controller using BookTarot for business purposes.
Subject matter
Processing of personal data as described in the agreement and the Privacy Policy.
Duration
For the term of the underlying agreement.
Nature and purpose
Operating the BookTarot marketplace on behalf of the controller, including matching, scheduling, payments, communications, and analytics.
Types of personal data
Identification, contact, payment, booking, communication, and (where applicable) special categories arising from the content of a reading session.
Sub-processors
The Subprocessor List at /legal/subprocessors is incorporated by reference.
International transfers
Standard Contractual Clauses (Module 2 or 3 as applicable), supplemented by the UK IDTA where applicable.
Audit, security, breach notification
Annual SOC 2 Type 2 attestation (forthcoming). Breach notification without undue delay and within 72 hours where feasible.
To request a signed DPA: dpa@booktarot.com.