Privacy Policy

This policy explains how JE DARLINGTON LIMITED ("Pawdiary", "we", "us") collects and uses personal data, and the rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). It covers two groups: groomers and their staff who use Pawdiary (our customers), and the pet owners whose details groomers keep in Pawdiary. Pet owners should also read our Client Privacy Notice at pawdiaryapp.com/client-privacy.

Who we are

JE DARLINGTON LIMITED, registered in England and Wales, company number 17500620. We pay the data protection fee to the Information Commissioner's Office (ICO), the UK regulator for personal data. Contact us about privacy at hello@pawdiary.co.uk. We are not required to appoint a Data Protection Officer; privacy questions go to the address above and are answered by a named person responsible for data protection.

Groomers and their staff: we are the controller

• Account details: your name, email address, password (stored only as a secure hash, which we cannot read), phone number if you give it, and your role in the business.
• Business details: your business name, address, services, prices, opening times, branding and settings.
• Billing: your plan, billing status and invoices. Card payments for your plan are taken by Stripe; we never see or store your full card number.
• Agreement records: when you accepted our Terms of Service, Data Processing Agreement and this policy, which version, and the IP address and browser used, so we can show what was agreed.
• Security and usage: sign-in times, two-step sign-in settings, IP address, browser and device type, and records of important actions (for example, deleting a business) to keep accounts secure and investigate problems.
• Support: messages you send us and our replies.

Why we use it, and our lawful basis

• To create and run your account and provide Pawdiary: performance of our contract with you (Article 6(1)(b)).
• To take payment for your plan and keep accounting and tax records: contract, and legal obligation (Article 6(1)(c)).
• To record your acceptance of our terms and policies: legitimate interests (Article 6(1)(f)) in being able to show what was agreed, and legal obligation where the law requires evidence.
• To keep Pawdiary secure, prevent fraud and abuse, and fix faults: legitimate interests in running a safe, reliable service.
• To tell you about changes to the service, these terms or this policy, and to answer support requests: contract and legitimate interests.
• To send you product news or offers: only where the law allows, either with your consent or, as an existing customer, where you have not opted out (PECR regulation 22). Every such email has an unsubscribe link, and you can opt out at any time without affecting your account.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile you for advertising.

Pet owners: the groomer is the controller, we are the processor

• Groomers use Pawdiary to keep their clients' contact details, addresses, pets' records, bookings, payments, photos, messages and signed terms. The groomer decides what to keep and why, and is responsible for it. We only process it on their instructions, under our Data Processing Agreement.
• If you are a pet owner and want to see, correct or delete your details, contact your groomer. If you contact us, we will pass your request to them promptly and help them respond.
• When you book online, you confirm you have read the Client Privacy Notice, and you can choose (by ticking a box, which is never ticked for you) to receive news and offers from the groomer. The groomer can see when you gave or withdrew that consent.
• When you sign a groomer's terms through a link, we record your typed name, signature, the time, your IP address and browser, so the groomer has evidence of what was agreed.

Who we share data with

• Only the service providers we need to run Pawdiary, listed in the sub-processor table below, under written contracts that require them to protect the data and use it only on our instructions.
• Professional advisers (such as accountants and lawyers), and law enforcement or regulators where the law requires it.
• A buyer or successor if our business is sold or restructured, who would have to protect the data in the same way.
• We never sell personal data, and never share it for advertising.

Google Calendar

• If a business connects Google Calendar, Pawdiary asks Google for permission to see the connected account's email address and to create, change and delete calendar events. We use it only to add the business's bookings and blocked time to its calendar, keep them up to date, and show its other events as busy times in Pawdiary.
• We store the Google account's email address and a refresh token, which only our servers can read, until the business disconnects Google (Settings > Google Calendar), deletes its account, or removes access in its Google account settings. Disconnecting revokes the token straight away.
• We don't use Google data for advertising, sell it, or let people read it except where the business asks us to for support, for security, or where the law requires it. It is not used to train AI models.
• Pawdiary's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

International transfers

• Our main database is hosted in the UK. Where a provider processes data outside the UK, the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), or by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Ask us for a copy of the relevant safeguards.

How long we keep it

• Account and business data: while your account is open. When you delete your business, we delete its data within 30 days, and backups roll off within a further 30 days.
• Billing and accounting records: 6 years after the end of the financial year they relate to, as required by UK tax law.
• Records of your acceptance of our terms: for as long as your account is open and 6 years after, in case of a legal claim.
• Security logs: up to 12 months. Rate-limit records (a one-way hash of your IP address): 1 day.
• Support messages: up to 2 years after the conversation ends.

Cookies and similar technologies

• We use cookies and browser storage that are strictly necessary to provide the service you ask for (keeping you signed in, security checks and payments). These don't need consent under PECR.
• Only if you choose "Accept" (or switch analytics on) in our cookie banner, we also use Cloudflare Web Analytics (cookie-free visit counts) and Sentry error reports to improve Pawdiary, on the basis of your consent (Article 6(1)(a) and PECR). Nothing optional runs until you choose, and you can change your mind at any time with "Cookie settings" in the site footer or on our Cookie Policy page.
• We never use advertising, social media or cross-site tracking cookies. Full details are in our Cookie Policy at pawdiaryapp.com/cookies.

Your rights

• You have the right to be informed; to access a copy of your data; to have it corrected; to have it erased; to restrict how we use it; to data portability (receive it in a machine-readable format); and to object to processing based on legitimate interests, and to direct marketing at any time.
• Where we rely on your consent, you can withdraw it at any time. This doesn't affect anything we did before you withdrew it.
• Business owners can export or delete their whole business from Settings > Account, and anyone can delete their own login there. How: pawdiaryapp.com/delete-account.
• To exercise any right, email hello@pawdiary.co.uk. We will respond within one month, free of charge, and may need to confirm your identity first. We may extend this by two further months for complex requests, and will tell you if so.
• If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

Security

• Data is encrypted in transit (TLS) and at rest. Each business's data is kept separate from every other business's by access rules enforced in the database. Two-step sign-in is available for every account. Access by our own staff is limited to what is needed and is logged.
• If a personal data breach is likely to put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay where the law requires it.

Children

• Pawdiary is for businesses and is not intended for anyone under 18. Groomers should not use Pawdiary to keep data about children.

Changes

• We will tell you by email or in the app before any significant change to this policy, and show the date of the latest version below.

Last updated 5 October 2026.