Data Processing Agreement

In short: This DPA forms part of the ResoFlow Terms of Service. By creating a tenant account on ResoFlow you agree to be bound by this DPA in respect of any personal data you process through the Services.

This Data Processing Agreement (the "DPA") is incorporated by reference into the ResoFlow Terms of Service. By creating a tenant account on ResoFlow, you (the "Customer") and Caleonix LTD (the "Processor") agree to be bound by this DPA in respect of any personal data the Customer processes through the Services.

Terms used in this DPA take their meaning from the UK GDPR and the Data Protection Act 2018, including but not limited to:

• Controller — the entity that determines the purposes and means of processing.
• Processor — the entity that processes personal data on behalf of the Controller.
• Personal Data — any information relating to an identified or identifiable natural person.
• Personal Data Breach — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• Sub-processor — any third party engaged by the Processor to process Personal Data on behalf of the Customer.
• Data Subject — the identifiable natural person to whom Personal Data relates.

• The Customer (the tenant) is the Controller in respect of Personal Data processed through the Services.
• Caleonix LTD is the Processor.
• The third parties listed at /policies/subprocessors are Sub-processors.

The Processor will process Personal Data only as reasonably necessary to deliver the Services to the Customer in accordance with the Terms of Service.

The Customer warrants and undertakes that it:

• Has a lawful basis under the UK GDPR for any processing it instructs the Processor to perform.
• Provides accurate, lawfully obtained Personal Data.
• Handles its own Data Subject rights requests, with reasonable assistance from the Processor under section 9.
• Notifies the Processor promptly of any material change in its processing instructions.

The Processor will:

• Process Personal Data only on the Customer's documented instructions. Signing up to use the Services constitutes the Customer's documented instruction to operate the Services as marketed.
• Ensure that persons authorised to process Personal Data are bound by appropriate confidentiality obligations.
• Implement and maintain the technical and organisational measures required by Article 32 of the UK GDPR (see Annex 2).
• Comply with the rules on engaging Sub-processors set out in section 7.
• Assist the Customer with its obligations under Articles 32 to 36 of the UK GDPR.
• Make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA.

The Processor maintains the technical and organisational measures described in Annex 2.

The Customer grants the Processor general written authorisation to engage Sub-processors, on the conditions that:

• The current list of Sub-processors is published at /policies/subprocessors.
• The Processor will give at least 30 days advance notice before engaging a new Sub-processor that will process Personal Data as part of the Customer’s existing use of the Services. Where a new Sub-processor only supports an optional feature the Customer chooses to enable, it is disclosed on the sub-processors list and the Customer’s decision to enable that feature constitutes its authorisation to engage that Sub-processor for that feature; the Customer remains free not to enable the feature.
• The Customer may object on reasonable grounds and terminate without penalty if its objection cannot be resolved.
• The Processor engages each Sub-processor under a written contract imposing data-protection obligations substantially equivalent to those in this DPA.
• The Processor remains liable to the Customer for the acts and omissions of its Sub-processors.

Some Sub-processors are based outside the UK. International transfers are governed by:

• The UK International Data Transfer Agreement (IDTA), or
• The EU Standard Contractual Clauses with the UK Addendum where applicable.
• Where a US Sub-processor is certified under the EU-US Data Privacy Framework and its UK Extension, that framework may additionally apply alongside the mechanisms above.

Each Sub-processor’s data-processing terms incorporate one of these mechanisms.

This description of our transfer mechanisms is provided on a best-effort basis and is not legal advice.

The Processor will assist the Customer in responding to Data Subject rights requests as follows:

• Self-serve tooling: tenants can export and delete individual diner data through Customers → Export / Delete in the dashboard.
• Manual escalation: for complex cases, the Customer may email [email protected].
• The Processor will respond within 7 business days of any such request.

The Processor will notify the Customer without undue delay (and in any event within 72 hours of becoming aware) of any Personal Data Breach affecting the Customer's data. The notification will include, to the extent known:

• The nature of the breach.
• The categories and approximate number of Data Subjects concerned.
• The categories and approximate number of records concerned.
• The likely consequences.
• The measures taken or proposed to address the breach.

The Customer is responsible for any onward notification to the ICO under Article 33 of the UK GDPR or to affected Data Subjects under Article 34.

The Processor maintains an internal incident-response process covering breach detection, containment, assessment, notification, and recovery, which it reviews periodically and after any material incident. A high-level summary is available on request to Controllers by emailing [email protected].

The Customer may audit the Processor's compliance with this DPA once per 12-month period on 30 days written notice. Audits are conducted at the Customer's expense, with the Processor's reasonable cooperation, and under a mutual non-disclosure agreement.

On termination of the subscription, the Customer has 30 days to request a full export of its Personal Data by emailing [email protected] from the Owner's account email. The Processor will produce the export and provide a secure download link within 7 business days of the request. After the 30-day window the Processor will permanently delete the data, subject to any legal retention obligations (see the retention table in the Privacy Policy).

Liability under this DPA is governed by section 15 (Limitations of liability) of the Terms of Service.

In the event of a conflict between documents, the order of precedence is: UK GDPR > this DPA > the Terms of Service.

This DPA is governed by the laws of England and Wales, matching the Terms of Service.

The current list of Sub-processors is published at /policies/subprocessors. The list is updated with 30 days advance notice as required by section 7 of this DPA.