Processing agreement
This text is a translation; the Dutch version is binding.
Version of 13 October 2026.
This agreement applies as soon as you take a domain or a mailbox with Busy Book. It sets out how we process personal data for you in doing so, as Article 28 of the General Data Protection Regulation (GDPR) requires.
1. The parties
- You, the business that runs the salon and takes the domain or the mailbox, are the controller: you decide what the data is used for and how.
- MCHLBLLN BV, company number BE0772.728.625, Gulden Bodem 45/302, 3800 Sint-Truiden, is the processor: we process the data only for you. In this agreement that is “we”.
2. Subject and purpose
We process personal data for you only in order to:
- make your mailboxes on your own domain work: receive, store and send your e-mail;
- register, renew and manage your domain: the holder's details, the DNS settings, the renewal and the transfer to another provider.
For nothing else. We do not use this data for our own purposes.
3. The data and the data subjects
- Your e-mail: the content of the e-mail in your mailboxes, and the names and e-mail addresses of the people you write to and receive e-mail from, such as clients, suppliers and staff. It can include anything someone puts in an e-mail.
- The details of your domain's holder: the official name of your business or your own name, the address, the e-mail address, the telephone number and the company or VAT number.
We do not ask for special categories of personal data, such as health data. Your e-mail may contain them: what is in it is decided by you and by the people who write to you.
4. Duration and end
This agreement applies for as long as you have a domain or a mailbox with Busy Book.
If you remove a mailbox, or cancel your domain, you can still download the e-mail in it for 30 days. After that it is erased, at Migadu, where the mailboxes are, and at MCHLBLLN BV.
Your domain remains yours: you are and remain its holder. If you cancel the domain, we lift the transfer lock and send the transfer code to the holder's e-mail address, your own address. With it you move the domain to the provider of your choice.
5. Sub-processors and recipients
For your mailboxes and your domain we work with two sub-processors: Migadu for the mailboxes, Hostinger for the domain and the DNS.
Hostinger hosts no e-mail for Busy Book; the mailboxes of the mailbox add-on are hosted by Migadu.
| Name and legal form | Registered address | Country | Company or VAT number | What it does for Busy Book | Which data | Add-on | Basis for transfer |
|---|---|---|---|---|---|---|---|
| Migadu-Mail GmbH | Rohnen 587, 9414 Schachen | Switzerland | CHE-334.933.960 | hosting the salon's mailboxes: receiving, storing and sending e-mail | the mailbox addresses; the content of all e-mail at those addresses; the address the invitation goes to; with ‘Bring my old mail’, once, the sign-in details of the old mailbox | Mailbox add-on | Adequacy decision for Switzerland (see the transfers in article 6) |
| Hostinger International Ltd. | 61 Lordou Vironos Street, 6023 Larnaca | Cyprus | VAT CY10301365E | registering and renewing the salon's domain name and managing its DNS records | the holder's name, e-mail address, address and company number; DNS records | Domain add-on | Within the EU — no transfer |
To register a domain, the registry of the extension must receive the holder's details, for example DNS Belgium for .be, EURid for .eu and SIDN for .nl. That registry is not our sub-processor: it receives the data as a recipient with its own responsibility, under its own terms.
6. What we do for you
- Only on your instructions. We process the data only on your written instructions. Those instructions are this agreement and what you yourself do in Busy Book, such as creating or removing a mailbox. If a law obliges us to do otherwise, we tell you beforehand, unless that law forbids it.
- Confidential. Everyone at our end who works with your data is bound to confidentiality.
- Secured. We take the security measures Article 32 of the GDPR requires: the connections are encrypted, only those who need it for their work get access, and Migadu and Hostinger secure their systems with their own measures.
- Help with data subjects' requests. If someone asks you for access to their data, or to correct or erase it, or exercises another right under the GDPR, we help you answer.
- Help with your own obligations. We help you with what Articles 32 to 36 of the GDPR require of you: security, notifying a breach, a data protection impact assessment and the prior consultation of the supervisory authority.
- We notify you of a breach. If we discover a breach involving your personal data, we notify you without undue delay, with what we know about it.
- Erasure at the end. At the end we erase the data as set out in point 4.
- Demonstrating and auditing. We give you the information you need to demonstrate that Article 28 of the GDPR is complied with. You may audit this yourself or have it audited, if you announce it a reasonable time beforehand, and we cooperate. If we consider that an instruction of yours infringes the GDPR or another data protection law, we tell you immediately.
Your data goes to a country outside the European Economic Area (EEA) only with the safeguards of Chapter V of the GDPR. If Hostinger transfers data to a country outside the EEA for which no adequacy decision applies, then, according to its own processing terms, the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914) apply. Migadu-Mail GmbH is established in Switzerland; the transfer of personal data to Migadu relies on the European Commission's adequacy decision for Switzerland (Decision 2000/518/EC of 26 July 2000), which remains in force under Article 45(9) GDPR.
7. Liability
The liability rules of the article ‘Liability towards a salon’ of the terms of use of Busy Book apply to this processing agreement, with the same limit. That limit applies to this agreement and the terms of use together. It applies only between the parties and limits no rights of data subjects under Article 82 GDPR.
8. Law and courts
This agreement is governed by Belgian law. Disputes fall under the courts of our registered office (Gulden Bodem 45/302, 3800 Sint-Truiden), the same as in the terms of use.