Data processing agreement: summary

Every studio signs a data processing agreement (DPA) with us before it goes live, as UK GDPR Article 28 requires. This page summarises what it will say. The signed agreement is the one that counts.

Who does what

• The studio is the controller: it decides why and how its clients’ and team’s data is used.
• Joul is the processor: we hold and process that data only to run the service for the studio.
• The data covers clients (names, contact details, bookings, passes, payments recorded, waivers, message preferences and consent, and health questionnaire answers) and the studio’s staff.

Only on your instructions

We process studio data only to provide Joul as the studio sets it up and uses it, and as the agreement describes. We never sell it, use it for advertising, or use one studio’s data for another. If we believe an instruction breaks data protection law, we will say so.

Confidentiality

Everyone at Joul who can reach studio data is bound to keep it confidential, and reaches it only when the work needs it, such as a support request from the studio.

How we protect it

• Each studio’s data is kept apart by row-level security in the database, on top of checks in the app, so a mistake in one query cannot show one studio another’s data.
• Health questionnaire answers are encrypted field by field (AES-GCM), kept apart from other client data, shown only to the roles allowed to see them, and every time someone opens one it is logged.
• Owners and admins must sign in with two-factor (an authenticator app). Sign-in codes, session tokens and recovery codes are stored only as keyed hashes.
• Sign-in attempts are rate-limited, sessions use secure, httpOnly cookies, and sensitive actions (team and two-factor changes, imports, exports, refunds) are written to an audit log.

Sub-processors

We use other companies for parts of the service, listed on the sub-processors page, each bound by terms that protect the data at least as well as ours. We will email studio owners before adding or replacing one, with time to object.

Helping with your clients’ rights

We help the studio answer requests from its clients: to see, correct, delete or move their data. Studio owners and admins can download all of the studio’s data at any time as CSV files in one ZIP (Settings → Import and export), which covers most requests. Clients can change their own contact details and message choices, staff can record a withdrawal of marketing consent, and requests to delete an account are recorded. For anything else, we help on request.

If something goes wrong

If we become aware of a personal data breach affecting a studio’s data, we will tell the studio without undue delay, with what we know, what we are doing about it and what the studio may need to do, so it can meet its own duty to report to the ICO.

When the agreement ends

The studio can export all of its data before it leaves. After the agreement ends we delete the studio’s data, or return it if the studio asks, unless the law requires us to keep something (such as records for tax). Backups expire on their own schedule.

Audits

We will give the studio the information it needs to show we meet these commitments, and allow and contribute to reasonable audits and inspections, on reasonable notice.

International transfers

Studio data is meant to be stored in the UK or EU. Where a sub-processor is outside the UK and EEA, the transfer is covered by the UK’s International Data Transfer Agreement (IDTA), or the EU’s Standard Contractual Clauses with the UK addendum.

Health information

Health answers are special category data. The studio decides what it asks and is responsible for the lawful basis and the condition it relies on (usually the client’s explicit consent). We keep the answers encrypted, never send them to AI features, and leave them out of data exports unless the owner ticks them.

Joulie (the studio assistant)

Joulie is off until a studio’s owner or admin switches it on, and they can pause it at any time. While it is on, we send the AI provider named on the sub-processors page only what each task needs: class times and counts, clients as a first name and an initial, credits and passes, the studio’s own notes and the team’s questions. Never health or waiver answers, email addresses, phone numbers, dates of birth or addresses. Nothing it suggests changes data or sends a message until a team member approves it. The team’s conversations are kept for 30 days for the person who asked; run records keep counts and costs only, and the audit log keeps redacted entries.

Questions

Email [email protected]. See also the privacy notice and the cookie notice.