The short version. When you use Suddenly Sorted, we process your customers' personal information on your behalf and on your instructions — only to run your bookings and answer your customers. This agreement is the signable version of that promise: it sets out our roles, the data involved, our security, the short list of sub-processors we rely on, and what happens to your data if you leave. It's governed by New Zealand law and built around the Privacy Act 2020. Most small-salon customers are already covered by our Privacy Policy and Terms and won't need a separate DPA — this is here for the larger customers who require one.
Parties
Suddenly Sorted (NZBN 9429053711434), a business based in New Zealand — the Processor; and
the customer named in the account or order — the Controller (the salon or business).
Contact for privacy matters, for both parties: hello@suddenly.co.nz.
Purpose & roles
The Controller uses Suddenly Sorted's service (the "Service") to run bookings and answer customer enquiries. In doing so, Suddenly Sorted processes personal information on the Controller's behalf and on its instructions. The Controller controls what data is collected; Suddenly Sorted processes it only to provide the Service.
What is processed
- Categories of people: the Controller's clients/customers, and the Controller's own staff.
- Categories of data: names, contact details (phone/email), booking details and history, chat messages sent to the AI assistant, and (where the Controller enables it) deposit-payment metadata.
- Nature & purpose: answering enquiries, making and managing bookings, sending reminders and review requests, and running the Controller's dashboard.
- Duration: for the term of the subscription, then per clause 7.
Suddenly Sorted's obligations
Suddenly Sorted will:
- process personal information only to provide the Service and on the Controller's documented instructions;
- keep it confidential and ensure people who access it are under confidentiality obligations;
- apply appropriate technical and organisational security measures (summarised at suddenly.co.nz/security): encryption in transit and at rest, per-customer tenant isolation, hardened authentication, and access controls;
- assist the Controller, so far as reasonably possible, to respond to individuals exercising their rights (access, correction, deletion) under the Privacy Act 2020;
- not sell the data, and not use the AI-processed content to train AI models (see clause 4).
Sub-processors
The Controller authorises the following sub-processors, each performing one function:
| Sub-processor | Function | Location |
|---|---|---|
| Cloudflare | Hosting, database, edge network | Global edge |
| Anthropic | Generates the AI assistant's replies. Does not train on the data; does not retain it for training. | United States |
| Stripe | Card payment processing (card numbers never reach Suddenly Sorted) | Global |
| Resend | Sends confirmation and reminder emails | Global |
| Maps, business listing, and the Controller's calendar (if connected) | Global |
Suddenly Sorted remains responsible for its sub-processors and will give the Controller reasonable notice of any material change to this list (kept current on the security page).
International transfer
Some processing (notably the AI in clause 4) occurs outside New Zealand, including in the United States. Suddenly Sorted takes reasonable steps to ensure comparable protection consistent with the Privacy Act 2020 (IPP 12).
Data breach
If Suddenly Sorted becomes aware of a personal-information breach affecting the Controller's data, it will notify the Controller without undue delay, share what it knows, and support the Controller's own obligations (including any notification to the Office of the Privacy Commissioner and affected individuals).
Return & deletion
On termination or on the Controller's request, Suddenly Sorted will, at the Controller's choice, return or delete the personal information it holds for the Controller, except where the law requires it to keep a copy (e.g. tax records). The Controller can export its bookings and client list at any time. Data is not held hostage — the Controller's clients are the Controller's.
General
This DPA supplements Suddenly Sorted's Terms of Service and forms part of them. It is governed by New Zealand law. If any conflict arises between this DPA and the Terms on the processing of personal information, this DPA prevails.
Not sure you need this? For most small-salon customers, our Privacy Policy and Terms already cover how we handle data, and no separate DPA is needed. If your organisation requires a signed DPA before subscribing, email hello@suddenly.co.nz and we'll sort it.