Data Processing Agreement

This Data Processing Agreement (the “DPA”) is part of the ResoFlow Terms of Service. It covers the personal data your venue handles through ResoFlow, as Article 28 of the UK GDPR requires. You agree to it when you create a ResoFlow account.

“You” means the business that holds the ResoFlow account. “We” means Caleonix LTD (company number 17162652), which runs ResoFlow. Legal terms such as “controller” and “personal data breach” mean what they mean in the UK GDPR.

• You are the controller of the personal data processed through ResoFlow for your venue. We are your processor.
• The companies listed in section 7 process it for us. The few listed there that work under their own terms instead — the wallet and push services, OpenStreetMap’s address look-up and the public registers — are listed separately.

We process personal data only as reasonably needed to provide ResoFlow to you under the Terms of Service.

You confirm that you:

• have a lawful basis under the UK GDPR for the processing you ask us to do;
• give us accurate, lawfully obtained personal data;
• handle requests from people about their own data, with our help (section 9);
• tell us promptly if your instructions to us change in a way that matters.

We will:

• process personal data only on your documented instructions — signing up and using ResoFlow as it is offered is your instruction — and tell you straight away if we think an instruction breaks data protection law;
• make sure everyone authorised to process it is bound by confidentiality;
• keep the security measures in section 6 (UK GDPR Article 32);
• follow section 7 when we use sub-processors;
• help you meet your duties under Articles 32 to 36 of the UK GDPR (security, breaches, impact assessments and consulting the ICO);
• give you the information you reasonably need to show we keep to this DPA, and allow audits (section 11);
• delete or return the data when your account ends (section 12).

When you ask for help, or when we need to look into a fault, a security event or a billing question, our authorised team may view your account and the personal data in it. Viewing is read-only. We may use the AI services listed in section 7 in this work; they act within the same limits and receive personal data only where the work needs it.

We change your data only during a time-limited support session you start — with a one-time code, by accepting a request, or under a standing permission you set (90 days at most) — and never to move money, delete data or transfer the account.

Outside a session we may also:

• use our own account tools as the Terms of Service allow — for example billing and plan changes, suspending an account or a feature, switching off a misused promo code, removing a review you have reported, or a change of owner;
• change your venue’s name or web address when you ask us in writing (the old web address keeps forwarding to the new one, and the account owner is emailed when it changes);
• apply a setup we prepared with you while the owner is with us (a setup done remotely needs a session);
• return a guest’s payment that ResoFlow could not complete or refund automatically.

Every session, every name or web-address change, every setup applied and every payment returned this way is recorded in your Activity log, as is every time our team sees a guest’s email address. The account owner is emailed when a session ends. If your venue has joined another person’s account, the emails about a changed web address and an ended session go to the venue’s original owner too.

• Data is encrypted in transit (TLS) and at rest (AES-256, with Google-managed keys).
• Our websites and venues’ own domains sit behind a CDN with DDoS protection, a web-application firewall and bot protection; public forms use a challenge step and rate limits.
• Access is role-based, with least-privilege defaults and per-person permissions. Two-step sign-in is available to every owner and admin. Staff sign in with a PIN only on devices an owner or admin has paired. High-stakes actions — deleting a customer’s data, a member of staff or a role, deleting in bulk, refunds, role changes, PIN resets and data exports — need the person to confirm who they are again.
• Sign-in accounts use Firebase Authentication, with passwords hashed by Google. Google runs it only in the United States, so your owners’ and staff’s sign-in accounts are processed there (section 8).
• Our server logs are kept in the EU (Belgium) and deleted after 30 days.
• Activity log records are kept 24 months on every plan (how far back you can see depends on your plan). Billing records are also copied to a separate tamper-resistant log and kept 7 years, as HMRC requires.
• We use error tracking (Sentry), uptime monitoring (BetterStack) and periodic manual security reviews.
• Backups: daily snapshots kept 31 days, 7-day point-in-time recovery, and a weekly copy of the database and sign-in accounts kept 91 days in a separate EU vault.
• A written incident-response process, reviewed periodically and after any material incident; material incidents are reported on our status page. A summary is available from [email protected].

You give us general written authorisation to use sub-processors, on these conditions:

• We give at least 30 days’ notice before adding a new sub-processor that will process personal data as part of the way you already use ResoFlow. A new sub-processor that only powers an optional feature is listed here before you switch the feature on; switching it on is your authorisation for that feature, and you are free not to. To get these notices by email, email [email protected] with the subject “Subscribe to subprocessor updates”.
• You may object on reasonable grounds and, if we can’t resolve your objection, end your contract without penalty.
• Each sub-processor is bound by a written contract with data-protection duties substantially the same as this DPA’s (its data processing agreement is linked under its name).
• We stay responsible to you for what our sub-processors do.

The list below is the current list and is updated in this section.

ResoFlow’s own AI features — Rezo and the other AI tools in ResoFlow — run on Google’s Vertex AI in the EU (our Privacy Policy says what each receives). “Standard clauses” means the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum (section 8). “UK adequacy” means the data stays in the EU, which UK law treats as adequate.

Listed for transparency — these work under their own terms, not as our sub-processors:

Our website’s status badge loads BetterStack’s public status feed straight from your browser; BetterStack sees that request (such as your IP address) but receives no personal data from us. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Some sub-processors work outside the UK. Personal data goes outside the UK and the EU only under the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum. Where a US sub-processor is certified under the EU–US Data Privacy Framework and its UK Extension, that may apply as well.

You handle requests from people about their own data, and we help:

• Your team can download or delete one guest’s data from that guest’s page in Customers (Download their data and Delete customer), and the account owner can download the whole account’s data. If your venue has joined another person’s account, the venue’s original owner is emailed the download link too.
• For anything harder, email [email protected].
• We respond to any such request within 7 working days.

We will tell you without undue delay, and in any case within 72 hours of becoming aware, of any personal data breach affecting your data. We’ll include what we know of: what happened; roughly how many people and records are involved, and of what kinds; the likely consequences; and what we have done or plan to do about it.

You are responsible for telling the ICO (UK GDPR Article 33) and the people affected (Article 34) where that is needed.

You may audit our compliance with this DPA once in any 12 months, on 30 days’ written notice, at your own cost, with our reasonable help and under a mutual non-disclosure agreement.

When your account is deleted or terminated, you have 30 days to ask for a full export of your data: email [email protected] from the owner’s sign-in email (for a venue that has joined another person’s account, the account owner’s or the venue’s original owner’s). Within 7 working days we send a secure download link, valid for 24 hours. After the 30 days we permanently delete the data, apart from anything the law requires us to keep (see the retention table in our Privacy Policy).

Cancelling a paid plan or product doesn’t start this window. What you cancelled ends at the end of the paid period — a cancelled plan moves the account to the Free plan (or to the products it keeps), and a cancelled product leaves your subscription — and your account stays open.

• Liability under this DPA is governed by section 15 (Limitations of liability) of the Terms of Service.
• If documents conflict, this order applies: the UK GDPR, then this DPA, then the Terms of Service.
• This DPA applies for as long as we process personal data for you (section 2).
• It is governed by the laws of England and Wales, like the Terms of Service.