Data Processing Agreement

This Data Processing Agreement (“DPA”) applies to personal information that a venue or other business customer (“Customer”) puts into VenueDB (“Customer Data”), and forms part of the Terms of Service between the Customer and VenueDB(“we,” “us”). It applies automatically while the Customer uses the Service; no signature is needed. If you need a countersigned copy, email privacy@venuedb.app.

For Customer Data, the Customer is the controller (or business) and VenueDB is the processor (or service provider). For information about the Customer’s own users (sign-in, billing, product use), VenueDB is an independent controller as described in the Privacy Policy; this DPA does not apply to that information.

• Subject: hosting and operating VenueDB for the Customer.
• Duration: while the Customer has an account, plus the deletion period in section 9.
• People: the Customer’s clients, guests, vendors, contacts and staff.
• Data: names, email addresses, phone numbers, notes, event and booking details, contracts and signatures, invoices and payment records, uploaded documents, and emails sent and received through the Service.
• Special categories: the Service is not designed for them. The Customer should not enter health, biometric or similar sensitive data beyond what an event unavoidably involves (for example dietary needs).

• We process Customer Data only to provide the Service and on the Customer’s documented instructions, which are the Terms, this DPA, and the Customer’s use of the product’s features. We will tell the Customer if we think an instruction breaks the law.
• We do not sell Customer Data, do not use it for advertising, and do not use it to train machine-learning or AI models.
• Everyone at VenueDB with access is bound by confidentiality, and access is limited to what the job needs. Support access to a Customer account is read-only, requires a written reason, and is logged.
• We keep security measures appropriate to the risk, including those listed in the Privacy Policy: encryption in transit, hashed passwords, encryption of sensitive secrets, role-based access, audit logging, and rate limiting.

The Customer authorizes the subprocessors on our subprocessors page. We bind each to data-protection terms no less protective than this DPA and stay responsible for their performance. We will update that page, and notify subscribers, at least 30 days before adding or replacing one. The Customer may object on reasonable data-protection grounds in that time; if we cannot resolve it, the Customer may cancel the affected service without penalty.

Taking into account the nature of the Service, we will reasonably help the Customer to respond to requests from individuals (access, correction, deletion, export), to carry out data-protection impact assessments, and to deal with regulators. The Customer can do much of this itself in the product. If an individual contacts us directly about Customer Data, we will refer them to the Customer.

If we become aware of a breach of security that leads to accidental or unlawful loss, alteration, disclosure of or access to Customer Data, we will notify the Customer without undue delay and in any case within 72 hours, with what we know about the cause, the data involved and the steps we are taking, and we will keep the Customer informed.

We and our subprocessors process data in the United States and other countries. Where the law requires a transfer mechanism for personal data moving out of the EEA, UK or Switzerland, the parties agree that the Standard Contractual Clauses (and the UK Addendum where relevant) apply, with the Customer as exporter and VenueDB as importer, and that the details in sections 2 to 4 of this DPA complete their annexes. We will tell you if we can no longer comply with them.

On reasonable request, no more than once a year unless a regulator or an incident requires more, we will give the Customer the information needed to show we meet this DPA, such as answers to a security questionnaire. If that is not enough, we will allow an audit by the Customer or an independent auditor under confidentiality, during business hours, with reasonable notice, at the Customer’s cost.

The Customer can export its data from the Service at any time. When an account closes, access stops immediately and we permanently delete Customer Data after a 30-day grace period, except where the law requires us to keep it (for example, billing records). Copies in backups are removed as the backups expire on our providers’ normal schedules, and stay protected until then.

Each party’s liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms on how personal data is handled, this DPA wins; if the Standard Contractual Clauses apply, they win over both.

Questions about this DPA: privacy@venuedb.app.