GDPR and legal documents
The data processing agreement, the list of subprocessors, the details of Flyp’s operator and the templates for your studio’s documents.
Flyp processes your clients’ data on your behalf: your studio is the controller of that data, and Flyp is the processor. The rules are set out in Flyp’s documents and in your studio’s documents.
Data processing agreement
The data processing agreement (art. 28 GDPR) says for what purpose and how long we process your clients’ data, which safeguards we use, when we report a breach (within 48 hours) and what happens to the data after the studio is closed.
You accept it when you sign up. You see the “Before you go to the panel” screen asking you to accept it if your account was created through Google or Facebook, was set up before 17 October 2026, or a new version of the agreement has come into force. You can see the version and acceptance date in Settings → Privacy and consents.
List of subprocessors and changes
The list of entities we entrust data to (hosting, payments, error monitoring and the integrations you turn on) is in §15 of the data processing agreement. The same list goes into the Flyp privacy policy and into the privacy policy template for your studio.
We inform you of changes to the agreement or the list by email and with a bar in the panel at least 14 days in advance. During that time you can object or terminate the agreement at no extra cost.
Details of Flyp’s operator
The company name, address and tax ID of Flyp’s operator are in the footer of the legal pages, in the terms of service and in the footer of emails from Flyp.
Your studio’s documents
In Settings → Terms and privacy you have your studio terms and privacy policy. “Load Flyp template” inserts a template that you complete with your studio’s details, and “Version history” shows every saved version. Keep in mind:
- The template isn’t legal advice. Check it before you publish it, ideally with a lawyer, especially the rules for deposits, rescheduling and withdrawal from the contract.
- A deposit doesn’t limit a consumer’s right to withdraw from the contract within 14 days: in that case you refund the whole payment. The exception is a client who explicitly requested that the service start before that period ends (Consumer rights for purchases from your studio).
- Simply choosing a session date within 14 days of booking isn’t such a request. What counts is the client’s explicit statement.
- Marketing consent in the booking form covers email messages only. For text messages or phone calls you need separate consent.