Data processing agreement

What this covers

The processing this agreement covers: running the studio’s booking page, schedule, class packs, memberships, payments and messages, for as long as the studio has an account. The people concerned are the studio’s customers and participants. The data concerned:

• Names, email addresses, phone numbers and profile pictures.
• Bookings, class packs, memberships, credits and order history.
• Stripe customer identifiers. Card numbers go straight to Stripe and never reach us.
• Records of accepting the studio’s terms: version, date, IP address and browser.
• Notes the studio writes about a customer.
• The click identifiers an ad platform attaches to a visit, when the studio has connected that platform to its booking page.

Data we control ourselves

This agreement covers only your customers’ data. For the following we decide the purpose ourselves and act as controller, under the Privacy policy, and we do not need your instructions for it:

• The accounts of your owners, admins and instructors: names, sign-in emails, roles, billing contact, plan and payment history, and support conversations.
• What the service needs to run: logs, security and abuse signals, usage measurements, errors and diagnostics.
• Information that identifies no person and no studio, such as overall usage numbers.
• What the law requires us to process and keep, such as tax, accounting, payment and anti-fraud records.

Stripe is a controller in its own right for the payment data it processes, under its own terms and privacy notice, which you accept directly. Nothing in this agreement makes us responsible for what Stripe does with it.

Your instructions

We process this data only to run, maintain, secure and support the service. Your complete instructions are the Terms, this agreement, the way you set up your studio in the app, and what your staff and your customers do through the app. We do not use the data for anything of our own.

Any further instruction must come in writing, applies only once we have agreed to it, and can be charged at our current rates when it needs work beyond what the app already does.

If the law requires us to process the data in another way, we will tell you first, unless that same law forbids telling you. If we think an instruction of yours breaks data protection law, we will say so, and we can pause that instruction until it is resolved, without being responsible for the consequences.

It is not our job to check whether your use of the service is lawful.

Your responsibilities

You are responsible for:

• Having a legal ground for each thing you do with your customers’ data, including marketing emails and SMS.
• Giving your customers the privacy information the GDPR requires, and collecting any cookie or tracking consent needed for an ad pixel, an analytics tool or a similar integration you connect.
• The accuracy and lawfulness of what you and your staff enter, including free text notes.
• Answering requests, complaints and questions from your customers and from data protection authorities about their data.
• What your staff and instructors do in the app, and the access you give them.

TimiTomi is not built for health data or other special categories of personal data. Do not enter a customer’s injuries, pregnancy, medical conditions or similar unless you have a valid ground under Article 9 of the GDPR, and if you do, it is at your own risk. We have no duty to detect, flag or separate such data.

You confirm that you have the authority to give us these instructions and that they comply with data protection law. A claim that comes from a breach of this section or from your instructions is covered by the section on claims caused by your business in the Terms.

Integrations you connect

When you connect a third party by entering your own identifiers or credentials, such as an ad pixel, a conversions API key, an analytics property or a calendar account, you are instructing us to send that party the data the integration needs. That party is your own processor or a controller in its own right, not a subprocessor of ours. The contract with that party and any consent it needs are yours. We can disable an integration we reasonably believe is being used unlawfully.

Who can see it

Only people who need the data to run or support the service can reach it, and every one of them is bound to keep it confidential.

Security

We protect the data with measures that fit the risk: encrypted connections, access controlled by role, studio accounts isolated from each other, and regular backups. We can update these measures as the service develops, as long as the overall level of protection does not fall.

The security of your own sign-ins, devices and staff is yours, and so is using the roles and permissions the app gives you.

Subprocessors

You agree that we use the companies listed in the Privacy policy to run the service, and that we may add others under this section. Each one receives only the data its part needs, under a written contract with the same duties this agreement puts on us. We stay responsible for their work, within the limits of the Responsibility section.

If we add or replace one, we will tell you by email at least 15 days before the change. A change inside a company we already use, such as a new region, plan or product name, is not a new subprocessor.

You may object within those 15 days, for a documented data protection reason. We will make reasonable efforts to offer a change that answers the objection. If none is commercially reasonable, you may close your account before the change applies, and we refund any part of a paid period you have not used. That is the only remedy for an objection.

Helping you

When a customer asks you for their data, or asks you to correct or delete it, the app covers most of it directly. Where it does not, we help you answer within the legal deadline. If a customer writes to us directly about data you hold, we send the request to you and tell them we did so, and we do not answer beyond that unless the law requires us to.

We help you with your own security, breach notification and impact assessment duties, as far as they touch our processing and as far as we have the information. Help that goes beyond what the app already does can be charged at our current rates.

If data is breached

If we learn of a breach affecting your customers’ data, we tell you without undue delay, with what we know: what happened, which data is affected, and what we are doing about it. Telling you is not an admission that we were at fault.

Telling your data protection authority and your customers is your job. Where the law leaves time for it, talk to us before you name TimiTomi in a public statement or in a notification to an authority.

Where the data goes

The data is stored in the European Union. Where a subprocessor processes it in the United States, the transfer is covered by the EU-US Data Privacy Framework when the company is certified under it, and otherwise by the standard contractual clauses approved by the European Commission.

When the account closes

While your account is open, you can export your data at any time, and you should export what you want to keep before the account closes. After the account closes we keep your customers’ data for 90 days so you can still export it, then delete it from the live service. Backups are overwritten on their normal cycle after that.

We keep what the law requires us to keep, such as tax, accounting, payment and anti-fraud records, what we need to establish, exercise or defend a legal claim, and information that identifies no person and no studio.

A customer you delete in the app is removed from the live service, and leaves the backups on the same cycle.

Audits

On request, we give you the information needed to show that this agreement is kept. We answer first in writing, through reasonable questions and through any third party report or certification we hold.

If that is not enough to meet a legal duty of yours, you may audit us once in any twelve months, with 30 days written notice, during business hours, without disturbing the service, under a confidentiality agreement, at your cost, and with an auditor we do not reasonably object to. An audit on site can be required only when a data protection authority demands it or after a breach that affected your customers’ data, and it must not put other studios’ data at risk.

Responsibility

Our responsibility under this agreement and under the Terms is one and the same, and the limits in the Responsibility section of the Terms apply to both together. Nothing limits responsibility that cannot be limited by law.

Each of us pays the administrative fines imposed on us for our own breach. Where a customer claims compensation for processing both of us were involved in, each of us carries the share that matches their responsibility, and the section on claims caused by your business in the Terms applies.