Data processing agreement

1. Parties and scope

Olladay is operated by Donncha O Toole, trading as Olladay, of Bellevue House, Bellevue Demesne, Delgany, Co. Wicklow, Ireland (“Olladay”, “we”, “us”). You can contact us at hello@olladay.com.

This agreement is between Olladay, as processor, and the venue that uses Olladay, as controller (“you”). It forms part of our terms for venues and applies automatically when you accept them. It covers the personal data Olladay processes on your behalf to provide the Olladay service (“your data”). It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and, where it applies, the UK GDPR and the UK Data Protection Act 2018 (together, “data protection law”).

It does not cover information Olladay controls itself, such as your own account, sign-in and billing details, support correspondence and the booking fee Olladay charges. Our privacy notice covers those.

2. Details of the processing

• Subject matter and purpose: providing the Olladay booking service to you: your booking page, bookings and payments, passes, memberships, gift vouchers, waitlists, customer emails and texts, health and safety terms, team and rota tools, reports, exports and the integrations you connect.
• Nature of processing: collecting, storing, organising, displaying, sending, exporting, backing up and deleting, in line with your instructions.
• People concerned: your customers and guests, people who buy or receive gift vouchers, group booking organisers, waitlist members, members and pass holders, emergency contacts named by guests, and your team members.
• Types of personal data: names, email addresses and, if given, mobile numbers; bookings, attendance, tickets and extras; payment and refund references, amounts and status (not full card numbers); passes, memberships, vouchers, credit and discounts; marketing choices; signed agreements, including typed or drawn signatures, IP address and browser, and photo consent choices; group organiser billing details; team members’ roles, shifts and availability; and records you import from another system.
• Special category data: answers to your yes/no health questions, where you choose to ask them. They are shown only to the venue owner on screen and are never included in exports.
• Duration: for as long as you use Olladay, and then until deletion under section 10.

3. Your instructions

Olladay processes your data only on your documented instructions. Your instructions are these terms and this agreement, your settings, and the actions you and your team take in the console. Olladay may also process your data where EU, Member State or UK law requires it; in that case we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks data protection law.

4. Your responsibilities

You are responsible for having a lawful basis for the processing, for giving your customers the privacy information they need, for any additional condition needed for health information, for asking only for the information you need, and for making sure records you import or ask for were obtained lawfully.

5. Confidentiality

Olladay ensures that everyone authorised to process your data is bound by confidentiality and accesses it only as needed to provide the service, give support you ask for, keep the service secure, or meet a legal requirement.

6. Security

Olladay takes appropriate technical and organisational measures under Article 32, taking into account the risks involved. They include:

• encryption in transit (HTTPS) for the booking pages, console and connections to providers;
• encrypted backups, and encryption of stored logins for heaters, locks and other connected services with a key kept separately from the data;
• sign-in through Google with verified email addresses, so Olladay stores no passwords; login sessions and private booking and receipt links are stored only in hashed form;
• each venue’s data is kept separate, and team roles (owner, manager, front desk) limit what each person can see and do; health answers are visible to the owner only;
• card details are collected by Stripe and never reach Olladay;
• access to production systems is limited to authorised people, and secrets are kept out of the code and the database;
• protections against cross-site request forgery and repeated guessing of codes;
• regular backups and tested restore procedures.

We review and update these measures as the service and the risks change, without lowering the overall level of protection.

7. Sub-processors

You give Olladay general authorisation to use the sub-processors listed below. Olladay has a written contract with each one that gives at least the protection required by Article 28, and remains responsible to you for their performance.

We will tell you by email at least 30 days before we add or replace a sub-processor, and update this page. If you object on reasonable data protection grounds, tell us within that time. We will try to address your concern; if we can’t, you can end the affected service, or your use of Olladay, without penalty before the change takes effect.

Services you connect. If you connect one of the following, Olladay sends it the data needed for the connection on your instruction. Each is your own provider under your own agreement with it, not Olladay’s sub-processor, and you can disconnect it at any time.

8. International transfers

Olladay is based in Ireland. Your data is hosted in the United Kingdom, which the European Commission recognises as providing adequate protection, and the UK recognises the European Economic Area as adequate. Where a sub-processor processes your data in another country without an adequacy decision, Olladay makes sure the transfer is protected by an approved safeguard: the EU-U.S. Data Privacy Framework and its UK extension where the provider is certified, or the EU Standard Contractual Clauses (Commission Decision 2021/914) together with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement. You can ask us for a copy of the relevant safeguards.

9. Helping you

• People’s requests. The console lets you find, correct, export and delete customer records. If we receive a request from one of your customers, we will pass it to you without undue delay and will not respond ourselves except to confirm who to contact, unless you ask us to. We will help you respond where you need us to, including by erasing a customer’s details on your instruction.
• Other obligations. We will give you reasonable help with security, breach notifications, data protection impact assessments and consultations with a supervisory authority, taking into account the information available to us.

10. Personal data breaches

If Olladay becomes aware of a personal data breach affecting your data, we will tell you without undue delay, and in any case within 48 hours, by email to your owner account. We will give you the information we have about what happened, the data and people likely to be affected, the likely consequences and what we are doing about it, and add to it as we learn more. You decide whether to notify the Data Protection Commission, the Information Commissioner’s Office or the people affected, and we will help you do so.

11. Deletion and return

While your business is open, you can download your data as CSV files at any time and delete customer records in the console. When you close your business, you can ask us within 30 days for an export of your data. We then delete your data from our live systems within 90 days of closure, and it leaves our encrypted backups within a further 14 days. We keep records only where EU, Member State or UK law requires us to, such as payment and accounting records, and only for as long as needed; this agreement continues to protect them.

12. Information and audits

Olladay will make available the information you reasonably need to show that this agreement is being met, including answers to security questionnaires. Where that is not enough, or a supervisory authority requires it, you may audit our compliance once in any 12 months, with at least 30 days’ notice, during business hours, at your cost, by yourself or an independent auditor bound by confidentiality, in a way that does not compromise other venues’ data or our security.

13. Liability and order of precedence

Each party’s liability under this agreement is subject to the limits in the terms for venues, except where data protection law does not allow it. If this agreement conflicts with the terms for venues on data protection, this agreement wins. If any Standard Contractual Clauses or UK transfer terms apply and conflict with this agreement, they win.

14. Changes and contact

We may update this agreement in the same way as the terms for venues, or sooner if data protection law requires it. Contact hello@olladay.com about anything in this agreement.