Parties and scope
This data processing agreement forms part of the terms of use and applies between each business that uses Tuora to manage its bookings (the controller) and Auror Ventures Partners SL (the processor). It meets article 28 of Regulation (EU) 2016/679 (GDPR) and, for businesses and people in the United Kingdom, article 28 of the UK GDPR and the Data Protection Act 2018.
Duration, nature and purpose
Auror Ventures Partners SL processes the business's personal data for as long as the business uses the platform, and only to provide the service to it: taking and showing its bookings, sending each booking's emails, keeping its customers' records, their tabs and their payments, producing its reports, and passing data to the services the business itself connects.
Data and people concerned
- People: the business's customers and anyone who books with it, and the business's staff who use the platform.
- Data: contact details (name, phone and email), booking details, the notes customers write, their purchases and the record of their payments (never the card number, which only Stripe processes), and whether they agreed to receive offers.
The processor's obligations
Auror Ventures Partners SL:
- processes the data only on the business's documented instructions, which are its settings and its use of the platform, unless the law requires otherwise, in which case it tells the business first;
- ensures that the people authorised to process the data are bound by confidentiality;
- applies appropriate technical and organisational measures: encrypted connections, passwords kept only as one-way hashes, access limited to authorised staff, and continuous backups;
- helps the business respond to people exercising their rights, which the business can handle from the platform itself, and with any impact assessments and prior consultations it has to carry out;
- tells the business of any personal data breach affecting its data without undue delay and in any case within 48 hours of becoming aware of it;
- makes available the information needed to demonstrate compliance with this agreement, and allows audits on reasonable notice, at the business's cost and no more than once a year.
Sub-processors
The business authorises Auror Ventures Partners SL to use these sub-processors, bound in writing to the same obligations as this agreement:
- Amazon Web Services EMEA SARL: hosting, backups and sending email, in the European Union (Sweden).
Auror Ventures Partners SL will announce any new sub-processor on this page 30 days in advance; a business that disagrees can object by writing to hello@tuora.io or leave the service. Services the business connects itself, such as Stripe, Xero or Zapier, process data under the business's own agreements with them and are not sub-processors of Auror Ventures Partners SL.
International transfers
The data is hosted in the European Union. Data about people in the United Kingdom reaches the European Union under the UK's adequacy regulations for the European Economic Area, and data returned to a business in the United Kingdom under the European Commission's adequacy decision for the United Kingdom. Any other transfer outside those territories will be made with appropriate safeguards, such as standard contractual clauses.
End of the service
When the business leaves the service, Auror Ventures Partners SL deletes its personal data within 90 days, unless the law requires keeping it. If the business asks before then, it returns the data in a commonly used format.
Liability and governing law
Liability and governing law are those of the terms of use.