This agreement forms part of the terms of service between Michael Drapper, a sole trader trading as Cove Flow ("processor", "we") and the venue using Cove Flow ("controller", "you"). It applies to personal data we process on your behalf when providing the service, and meets the requirements of Article 28 of the UK GDPR.
1. What we process
| Subject matter | Providing Cove Flow to the venue |
|---|---|
| Duration | For as long as the venue's account is open, plus 30 days |
| Nature and purpose | Storing and processing bookings, waivers, memberships, sales and customer records, and sending emails on the venue's behalf |
| Data subjects | The venue's customers, members, waiver signers (including children named on a waiver) and staff |
| Types of data | Names, contact details, dates of birth, booking and purchase history, membership details, waiver answers and signatures, and any notes the venue records. Waivers may include health information the venue chooses to ask for. |
2. Our obligations
We will:
- process the data only on your documented instructions, which are these terms and how you use the service, unless the law requires otherwise, in which case we will tell you first if we can;
- make sure everyone who can access the data is bound by confidentiality;
- keep appropriate technical and organisational security measures in place, including keeping each venue's data separate, encryption in transit, encrypted storage of payment tokens, access controls and daily backups;
- help you respond to requests from people exercising their data rights, and with security, breach notification and data protection impact assessments, taking into account the nature of the processing;
- tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data;
- at the end of the service, let you export your data and then delete it within 30 days, unless the law requires us to keep it;
- give you the information you need to show we meet these obligations, and allow for and contribute to reasonable audits.
3. Sub-processors
You authorise us to use the sub-processors listed in our privacy policy. We will give you at least 30 days' notice of any new sub-processor, and you may object. We put the same data protection obligations on every sub-processor and remain responsible for them.
Square processes card payments under its own agreement with you, as a separate controller, not as our sub-processor.
4. International transfers
Where a sub-processor handles data outside the UK, we make sure the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum.
5. Your obligations
You are responsible for having a lawful basis for the data you collect, for giving your customers a privacy notice, and for the content of your waivers and the questions you ask.