Data Processing Addendum

1. Roles

You’re the controller of that personal data, or a processor acting for the businesses on your platform, and we’re your processor (or subprocessor). Each of us will comply with data protection law. You’re responsible for having a lawful basis for the data you send us and for the instructions you give.

2. The processing

Subject matter and purpose

Providing the Service: storing your businesses’ resources, schedules and bookings, working out availability, placing and changing bookings, and sending events to the webhook endpoints you set up.

Duration

While the terms apply, and until the data is deleted under section 9.

Data subjects

The staff of your businesses, their customers and attendees, and anyone else whose information you send.

Personal data

What you choose to send: typically names of staff and resources, booking times and their status, attendee details, and anything you put in descriptions or metadata. The Service isn’t designed for special category data or payment card data.

3. Instructions

We process the personal data only on your documented instructions, unless the law requires otherwise (and then we’ll tell you first unless the law forbids it). Your instructions are the terms, this addendum, and what you or your team do through the API and the dashboard. We’ll tell you if we think an instruction breaks data protection law.

4. Our people

Only people who need access to run and support the Service have it, and they’re bound to keep the data confidential.

5. Security

We keep appropriate technical and organisational measures in place, including:

• HTTPS for all traffic to the API, the dashboard and the website;
• a database in Google Cloud, encrypted at rest, that accepts only encrypted connections and has no public address allow-list; daily backups kept for seven days, and point-in-time recovery;
• separation between customers: every business’s data is tied to its account, every query on it is limited to that account, and a platform’s keys reach only its own businesses;
• API keys, dashboard sessions and invitation links stored only as one-way hashes;
• restricted API keys, so you can give each of your services only the access it needs, and roles for your team;
• signed webhooks, so you can check that an event came from Tiempo;
• secrets kept in a secrets manager, deploys without stored credentials, and production kept apart from our test environment;
• limits on request rates and on failed sign-ins.

We may change these measures, but not in a way that lowers the overall level of protection.

6. Subprocessors

You authorise us to use the subprocessors on our subprocessors page. We bind each one by a written contract to data protection obligations that protect the data at least as well as this addendum, and we remain responsible to you for them.

Before we add or replace a subprocessor we’ll update that page and email your platform’s owners at least 30 days in advance, except in an emergency. If you object on reasonable data protection grounds and we can’t address it, you can end the agreement before the change takes effect.

7. Helping you

Taking into account what the Service does and the information we have, we’ll help you respond to requests from data subjects, and with security, breach notifications, data protection impact assessments and consulting the Information Commissioner. Much of the data can be read, changed or cancelled through the API yourself; for anything you can’t do that way, ask us at info@doubletapdevelopment.com. If someone asks us directly about data you sent, we’ll pass the request to you rather than answer it ourselves.

8. Personal data breaches

We’ll tell you without undue delay after becoming aware of a personal data breach affecting your data, with what we know and what we’re doing about it, and keep you updated as we learn more. Telling you isn’t an admission of fault.

9. Deleting the data

You can read your data through the API while the agreement lasts. When it ends we’ll delete the personal data within 90 days, unless the law requires us to keep it; copies in backups are overwritten within a further seven days. In test mode, bookings and events are deleted automatically 30 days after they end or happen. Billing records, which hold counts rather than booking data, are kept as the law requires.

10. Showing we comply

We’ll give you the information you reasonably need to show that we meet this addendum, starting with written answers and documentation. If that isn’t enough, you may have an independent auditor, bound by confidentiality, inspect the relevant records once a year, with at least 30 days’ notice, at your cost, and without access to other customers’ data.

11. International transfers

We store the data in Google Cloud’s Belgium region (europe-west1). Where a subprocessor processes it outside the UK, we rely on UK adequacy regulations or on appropriate safeguards, such as standard contractual clauses with the UK’s International Data Transfer Addendum.

12. Liability

Liability under this addendum is subject to section 13 of the terms.