Data Processing Agreement
Draft for legal review. This text has not been reviewed by a solicitor and is not yet in force. Bracketed items must be completed before launch.
Last updated: [date of publication]
This agreement forms part of the Terms of Service between Merulio Ltd ("processor") and the operator using Slotera ("controller"), and meets Article 28 of the UK GDPR.
1. Scope
- Subject matter: hosting and processing the operator's client and booking data so the operator can take and manage bookings.
- Duration: for as long as the operator uses Slotera, plus the deletion period below.
- Data subjects: the operator's clients and prospective clients.
- Personal data: names, contact details, billing addresses, booking details, form answers, payment status and notes.
- Special category data: not intended. The controller must not use forms to collect it without its own safeguards.
2. Processor obligations
The processor will:
- process personal data only on the controller's documented instructions, which are given by using Slotera's features;
- ensure people with access are bound by confidentiality;
- keep appropriate technical and organisational security measures, including encryption in transit, tenant isolation in the database, and access limited to what each role needs;
- help the controller answer data-subject requests, including through the export and erasure tools on each client's page;
- notify the controller without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting their data;
- delete or return the controller's data when the service ends, except where the law requires retention;
- make available the information needed to show compliance with this agreement.
3. Sub-processors
The controller authorises these sub-processors:
- Hetzner Online GmbH — hosting and backups, EU.
- Resend — transactional email, [location].
- Sentry (Functional Software, Inc.) — error monitoring, EU (Germany) region.
The processor will give at least 30 days' notice of new sub-processors, during which the controller may object and end the service.
4. International transfers
Where data is transferred outside the UK, the processor relies on UK adequacy regulations or the International Data Transfer Addendum.
5. Liability
Liability under this agreement is subject to the limits in the Terms of Service.