Data Processing Addendum

1. Roles

The venue is the controller and Floorful.app ("Floorful") is the processor of the personal data described in section 3. For the venue's own staff accounts, promoters' accounts and the venue's subscription billing, Floorful is a controller in its own right, as described in the Privacy Policy.

2. Instructions

Floorful processes the personal data only to provide the service described in the Terms of Service, on the venue's documented instructions. The venue gives those instructions through its use and configuration of the service, for example by selling tickets, sending emails or anonymising a customer. Floorful will tell the venue if it believes an instruction breaks data protection law, and will process data otherwise only where the law requires it, telling the venue first unless the law forbids it.

3. The processing

• Subject matter and purpose: selling and administering tickets, table bookings, memberships and guest lists; sending confirmations and event communications; admitting guests at the door; reporting.
• Duration: for as long as the venue uses the service, and afterwards as section 9 describes.
• People concerned: the venue's customers, ticket holders, table guests, guest list names, members, and the customers of the venue's promoters.
• Personal data: names, email addresses, phone numbers, company names on memberships, birthdays (day and month, where given), order and payment details (never full card numbers), tickets and QR codes, admission times, marketing consent choices, accepted booking terms, and wallet pass device identifiers.
• Special category data: none is required, and the venue must not enter any.

4. Confidentiality and security

Floorful ensures that everyone authorised to process the data is bound by confidentiality. Floorful maintains the technical and organisational measures in the Annex and will not reduce their overall protection during the term.

5. Sub-processors

The venue authorises Floorful to use the sub-processors listed in the Annex. Floorful will give at least 30 days' notice of any new sub-processor, by email or in the dashboard, and the venue may object on reasonable data protection grounds; if the parties cannot resolve the objection, the venue may end the agreement. Floorful imposes data protection obligations on each sub-processor equivalent to this addendum and remains responsible for them.

6. International transfers

Where personal data is transferred outside the European Economic Area, Floorful ensures an adequate safeguard is in place, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

7. Helping the venue

Floorful provides tools for the venue to answer requests from the people whose data it controls: it can find a customer's records, export them, correct them and anonymise them. Floorful will pass on any request it receives directly and help the venue with data protection impact assessments and consultations with authorities, as far as the information available to it allows.

8. Personal data breaches

Floorful will notify the venue without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the venue's data, with the information the venue needs to meet its own obligations, and will take reasonable steps to contain it.

9. When the service ends

The venue can export its data at any time before it closes. After closure, Floorful keeps records of paid transactions, because accounting and tax law require them, and anonymises the personal data in them on the venue's request; it deletes a venue that never took an order 30 days after closure. Any other personal data is deleted or anonymised within 90 days of the end of the service, unless the law requires it to be kept.

10. Audits

Floorful will make available the information reasonably needed to show that it meets this addendum, and will allow for and contribute to audits by the venue or an auditor it appoints, on reasonable notice, no more than once a year unless a breach or an authority requires it, and subject to confidentiality.

11. Liability and precedence

The liability provisions of the Terms of Service apply to this addendum. Where this addendum and the Terms of Service conflict about personal data, this addendum applies.

Annex A: Security measures

• Encryption of all data in transit, and of data at rest by the hosting provider.
• Separation of each venue's data at the database level, enforced by row-level security, with every client write passing through a published, checked operation.
• Role-based access with per-venue permissions, and an append-only audit log of back office changes.
• Passwords stored only as salted hashes; secrets held by the hosting provider, never in code.
• Rate limiting of public endpoints.
• Payments handled entirely by Stripe, with bank verification on larger payments; Floorful never receives full card numbers.
• Automated tests of the security rules on every change, and daily backups.

Annex B: Sub-processors

• Supabase Inc.: database, authentication, storage and server functions. Location: European Union (Ireland).
• Vercel Inc.: website and app hosting. Location: global edge network, United States.
• Stripe Payments Europe Ltd. and its affiliates: payment processing. Location: European Union and United States.
• Resend (Plus Five Five, Inc.): email delivery. Location: United States.
• Google LLC: Google Wallet passes. Location: United States.
• Apple Inc.: Apple Wallet pass updates. Location: United States.