Data protection terms (UK GDPR)

1.1  When you place an Order for an app, whether a trial app or a fully paid, working app (including through our order form on our website), you agree to these terms on behalf of your business and confirm that you have authority to do so. In particular you:

• agree that Our App Limited is the controller of the data about your account and your use of the Service (clause 2);
• appoint Our App Limited as your processor of the personal data your guests give through your app, and give the instructions in clause 4 (clause 3);
• authorise our current sub-processors and our use of further sub-processors as set out in clause 6;
• for a CL App, agree that CL Booking Limited and Our App Limited are joint controllers of your CL Booking data for making and running the app, and that it may be shared between them for that purpose (clause 3A); and
• agree that our staff, who act only under our authority and are bound by confidentiality, may process this data to provide the Service.

1.2  These authorisations continue for as long as we hold the data, including after the agreement ends while we return or delete it.

2.1  Our App Limited is the controller of Account Data: the personal data of you and your staff that we need to run your account and our business, including names, email addresses, sign-in and security records, messages with us, and billing and payment records. We also control the anonymous usage counts produced by apps, and the technical data needed to deliver and secure the Service.

2.2  We process Account Data as described in our privacy policy, and comply with the UK GDPR as its controller.

3.1  You are the controller, and we are your processor, of Guest Data: personal data that guests give through your app, namely:

• mailing list sign-ups: name, email address and optional phone number;
• photos sent in, with an optional name and email address; and
• events suggested by guests, with an optional name and email address.

3.2  Subject matter and duration: hosting your app and the CMS, for as long as the agreement lasts plus the return and deletion period in clause 9. Nature and purpose: storing Guest Data, showing it to you in the CMS, emailing it to you where you ask (for example photos sent in), and deleting it. Data subjects: your guests and visitors to your app. Special category data: none is required, and you and your guests should not send any.

3A.1  CL Booking Limited, a company registered in England and Wales with company number 15232804, whose registered office is at 2 Chalkhill Cottages, Little Somborne, Stockbridge, Hampshire, SO20 6QU (CL Booking) runs clbooking.co.uk. It holds CL Booking Data: the information about each site listed on clbooking.co.uk, including the site’s details, photos, facilities, prices, availability, reviews and terms, and the personal data of the site’s owner and contacts held for the listing.

3A.2  CL Booking has appointed Our App Limited to decide with it how CL Booking Data is used to make and run apps for sites listed on clbooking.co.uk (CL Apps). For that purpose, CL Booking and Our App Limited are joint controllers of CL Booking Data under Article 26 of the UK GDPR. This clause is the essence of their arrangement, which is made available to data subjects as Article 26 requires.

3A.3  Under that arrangement:

• CL Booking is responsible for collecting CL Booking Data on clbooking.co.uk, for the lawful basis for collecting it and for sharing it for CL Apps, for telling site owners and other data subjects about that (including in its own privacy policy), and for keeping the data accurate at its source;
• Our App Limited is responsible for how CL Booking Data is used in CL Apps and the CMS, for the security of that processing (clause 7), for its own sub-processors (clause 6), and for handling personal data breaches affecting CL Apps, telling CL Booking without undue delay;
• each will promptly give the other the help it needs to meet its obligations, including responding to requests and to the Information Commissioner.

3A.4  Data subjects may exercise their rights about CL Booking Data against either company. Whichever receives a request will deal with it, involving the other where needed. Contact details for both are given at the end of this page.

3A.5  For a CL App, clauses 2 and 3 still apply: Our App Limited is the controller of the app account, and the site’s owner is the controller of Guest Data, with Our App Limited as processor.

4.1  You instruct us to process Guest Data to provide the Service as described in the agreement and as you direct through the CMS. We will process Guest Data only on these documented instructions, unless UK law requires otherwise, in which case we will tell you first unless the law prevents it. We will tell you if we think an instruction breaks data protection law.

4.2  As controller, you are responsible for: having a lawful basis (such as consent for your mailing list) for the Guest Data you collect; telling your guests how you use it, for example through your own privacy notice (our privacy policy, linked in every app, explains our part); responding to your guests’ requests; and the lawfulness of anything you do with Guest Data after downloading it or receiving it by email.

5.1  We will:

• make sure that everyone authorised to process Guest Data is bound by confidentiality;
• keep appropriate technical and organisational security measures in place (clause 7);
• help you, as far as reasonably possible and taking into account the nature of the processing, to respond to requests from guests exercising their rights, including by passing on any request we receive without undue delay;
• help you meet your obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner, taking into account the information available to us;
• notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Guest Data, with the information you reasonably need;
• make available the information reasonably needed to show that we meet these obligations, and allow and contribute to audits (clause 8); and
• return or delete Guest Data when the agreement ends (clause 9).

6.1  You give us general authorisation to use sub-processors. Our current sub-processors for Guest Data are: Hetzner Online GmbH (Germany: hosting, storage and backups) and Resend (USA: sending emails, such as photos sent in to you).

6.2  We will tell you at least 14 days before adding or replacing a sub-processor, by email or in the CMS. You may object on reasonable data protection grounds within that time; if we cannot reasonably address the objection, you may end the agreement under our terms without penalty.

6.3  We will impose data protection obligations on each sub-processor that give at least the protection in these terms, and remain responsible to you for their performance.

7.1  Our measures include: encryption of all data in transit (HTTPS); servers in a secure data centre in the EU; passwords stored only as salted hashes; access to the CMS limited by account, with each customer able to see only their own data; sign-in rate limiting; restricted, key-based server access for our staff; regular software updates; and daily backups, kept for 14 days. We review these measures regularly and may improve them, but will not reduce the overall level of protection.

8.1  On written request, we will give you a written description of our measures and answer reasonable questions about them. Where that is not enough to show compliance, or a regulator requires it, you (or an independent auditor bound by confidentiality) may audit our compliance once in any 12 months, on at least 30 days’ notice, during business hours, at your cost, and in a way that does not disrupt the Service or compromise other customers’ data.

9.1  For 30 days after the agreement ends, you may download or ask us for a copy of Guest Data. After that we will delete it, including from our systems within a further 14 days as backups expire, unless UK law requires us to keep it.

10.1  We will not transfer Guest Data outside the UK and European Economic Area except to a country covered by UK adequacy regulations, or with appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, and you authorise transfers made on that basis (including to our email provider in the USA).

11.1  Each party is responsible for its own compliance with data protection law. Liability between us under these terms is subject to the limits and agreed compensation in clauses 11 to 13 of our terms and conditions, except where the law does not allow it to be limited. Nothing in these terms limits the rights of data subjects under the UK GDPR.

12.1  If these terms conflict with our terms and conditions on data protection, these terms apply. We may update these terms to reflect changes in law, guidance or our sub-processors, telling you as set out in our terms and conditions.