1. Parties and roles
The customer is the controller of the guests’ personal data and decides why and how it is processed. [A PREENCHER: denominação social], tax identification number [A PREENCHER: NIF], with its registered office at [A PREENCHER: morada da sede] ([A PREENCHER: país da sede]), is the processor and processes that data on behalf of the customer.
The agreement is accepted at the moment the customer creates its Pro organisation, and that acceptance is recorded. Anyone who wants a signed copy can request one at privacy@seatalia.com.
2. Subject matter, duration and nature of the processing
The subject matter is the provision of the Seatalia service: storing, organising, seating, exporting and displaying guests’ data (including the QR page and the RSVP). The duration is that of the Pro subscription, plus the time needed to return or delete the data.
3. Types of data and data subjects
The data subjects are the guests and plus-ones of the customer’s events, and the users of its organisation. The data processed may be:
- first name, surname, household, group and table;
- adult, child or baby and age or age band;
- meal, diet or allergy tags and diet notes, which may be health data (Article 9);
- email and phone number, if the RSVP asks for them or if the customer enters them;
- email and name of the organisation’s users.
4. What Seatalia undertakes to do
As processor, Seatalia undertakes to:
- process the data only on the customer’s documented instructions (this agreement and the customer’s use of the service) and inform the customer if it considers that an instruction infringes the GDPR;
- ensure that the persons authorised to process the data are bound by confidentiality;
- apply the security measures of Article 32, described below;
- engage other processors only with the customer’s general authorisation, imposing equivalent obligations on them. The list is published and we give 30 days’ notice of changes, and the customer may object;
- assist the customer in responding to data subjects’ requests, with the service’s CSV export and deletion tools;
- assist the customer in complying with the obligations under Articles 32 to 36 (security, data breaches, impact assessments and prior consultation);
- notify the customer of any personal data breach without undue delay and, where possible, within 48 hours of becoming aware of it;
- at the end of the service, return the data (export) or delete it, which happens automatically 90 days after the date of each event, without prejudice to legal retention. Deleted data disappears from backups within 30 days;
- make available to the customer the information necessary to demonstrate compliance and allow reasonable audits, on prior notice;
- not transfer data outside the European Economic Area without appropriate safeguards, such as the Standard Contractual Clauses.
5. What the customer undertakes to do
The customer undertakes to:
- have a legal basis for processing the guests’ data and inform them of the processing;
- enter only the data it needs, and record diets and allergies only if they are needed for the catering;
- decide whether to activate the QR page and the RSVP, and for how long;
- give its instructions in writing and respond to data subjects;
- ensure that its users use the service in accordance with the terms.
6. Events created through the venue link
When a couple creates their event through a venue’s link, the couple keeps their account and their event. The venue only has access to the plan after the couple accepts the connection. The data the venue receives is then processed by it as controller, under the terms of this agreement.
7. Security measures
We apply, among others, the following technical and organisational measures:
- hosting in the EU and encrypted connection (TLS);
- encryption at rest on disk and in backups, and field-level encryption of diet notes;
- passwordless login, via single-use links valid for 15 minutes;
- share, QR and RSVP links with long random codes and rate limits;
- QR page that shows only the first name and the table, never diets, and with no trackers;
- internal access to guest data only at the customer’s request and with logging;
- backups with 30-day retention and error logging without personal data.
8. Liability
Each party’s liability to data subjects is governed by Article 82 of the GDPR. Between the parties, the limits in the terms of use apply, to the extent permitted by law.
9. Duration and governing law
This agreement remains in force for as long as the customer uses the service, and the obligations of deletion and confidentiality continue afterwards. It is governed by: [A PREENCHER: lei aplicável e tribunal competente].
10. Contact
To exercise rights or request a signed copy: privacy@seatalia.com.