Data Processing Addendum

For personal information about Customer’s guests, staff and contacts that Customer submits to VenueWS (“Customer Personal Information”), Customer is the business and controller, and DMS Workspace is the service provider and processor. Customer determines the purposes and means; we act only on Customer’s documented instructions, of which the Terms, this Addendum and Customer’s configuration and use of the product are the complete set.

For information we process as a business in our own right — account administration, billing, security, and analytics on our public pages — our Privacy Policy applies and this Addendum does not.

DMS Workspace will:

• process Customer Personal Information only to provide the service to Customer under the Terms — the “business purpose” — and for no other purpose;
• not sell or share Customer Personal Information, as “sell” and “share” are defined by the CCPA, and not process it for targeted advertising or any commercial purpose of our own;
• not retain, use or disclose it outside the direct business relationship with Customer, or for any purpose other than those permitted by the CCPA and set out here;
• not combine it with personal information received from another source, except as the CCPA permits a service provider (for example, to prevent security incidents or fraud);
• not use it to train generative or machine-learning models of any kind;
• comply with the obligations applicable to a service provider and processor under US state privacy law, and provide the same level of privacy protection those laws require;
• notify Customer promptly if we determine that we can no longer meet those obligations, and stop processing or remediate the unauthorised use;
• notify Customer if, in our opinion, an instruction infringes applicable law.

Certification. By entering the Terms, DMS Workspace certifies that it understands the restrictions in this section and will comply with them.

Customer will:

• have all rights, permissions and consents needed to submit Customer Personal Information and to have us process it, including the messaging consents in section 6 of the Terms;
• give its guests any privacy notice their jurisdiction requires, identifying Customer as the responsible party;
• not submit sensitive categories of information (Terms, section 7);
• keep its own instructions lawful, and configure retention, access and deletion inside the product to match its own obligations.

Access to Customer Personal Information is limited to personnel who need it to provide or support the service. Those personnel are bound by written confidentiality obligations that survive their engagement, receive privacy and security training appropriate to their role, and have their access removed promptly when it is no longer needed.

We maintain technical and organisational measures appropriate to the risk, which currently include:

• Encryption. TLS in transit; encryption at rest for the database and its backups.
• Tenancy isolation. Every record carries a workspace identifier and every query is constrained by it; access is checked on the server for each request.
• Authentication. Sign-in through a dedicated identity server; passwords stored only as salted hashes; role-based permissions; scanner devices hold revocable, scoped keys rather than user credentials.
• Credential handling. Invitation QR codes are signed tokens verified server-side and revocable instantly; API keys are stored hashed and shown once.
• Application hardening. Nonce-based Content Security Policy, HTTP security headers, parameterised database access, rate limiting on authentication and provisioning endpoints.
• Logging. An immutable audit trail of administrative actions inside each workspace, and server logs retained for up to 12 months.
• Resilience. Regular encrypted backups with restore testing; the door scanner holds an offline copy so a network failure does not stop an event.
• Change management. Peer-reviewed changes, automated tests including security-header and authorisation tests, and staged deployment.
• Vendor management. Sub-processors selected for their own security posture and bound to equivalent obligations.

We may update these measures as the product and the threat landscape change, provided we do not materially reduce the level of protection.

Customer authorises DMS Workspace to engage the sub-processors listed on our sub-processor page, and to engage others as the service develops. Each sub-processor is bound by a written contract imposing obligations no less protective than this Addendum, and we remain responsible for their performance as if it were our own.

We will update that page and notify Customer by email at least 30 days before a new sub-processor begins processing Customer Personal Information. Customer may object on reasonable data-protection grounds within that period; we will work in good faith to offer an alternative, and if we cannot, Customer may terminate the affected subscription and receive a refund of the unused portion of its fees.

The product lets Customer read, correct, export and delete guest records itself, which is the fastest route for most requests. Where Customer needs more, we will provide reasonable assistance — taking into account the nature of the processing and the information available to us — with responding to consumer requests, with data protection impact assessments, and with consultations with regulators.

If a consumer contacts us directly about Customer Personal Information, we will not respond substantively other than to direct them to Customer, and we will forward the request to Customer without undue delay unless the law requires otherwise.

We will notify Customer without undue delay, and in any event within 72 hours of becoming aware, of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Information. The notice will describe what we know about the nature of the incident, the categories and approximate volume of information involved, the likely consequences, and the measures taken or proposed. We will provide further information as the investigation develops, cooperate with Customer’s own notification obligations, and take reasonable steps to contain and remediate. Our notification is not an acknowledgement of fault.

Report a suspected vulnerability or incident to us at hello@dmsworkspace.com; we do not pursue good-faith security researchers who follow responsible disclosure.

Customer may export Customer Personal Information at any time during the subscription, and for 30 days after it ends, using the product’s export features. On Customer’s written request, or 30 days after termination, we will delete Customer Personal Information from live systems within a further 30 days; encrypted backups containing it are overwritten on a rolling basis and in any event within 90 days. We may retain information where the law requires it, in which case we keep only what that obligation needs and continue to protect it under this Addendum.

On reasonable written request, no more than once in any twelve months and subject to confidentiality, we will make available the information necessary to demonstrate compliance with this Addendum — ordinarily by completing a security questionnaire and providing our written security documentation. Where a Customer’s regulator requires more, or following a confirmed security incident affecting that Customer, we will cooperate in good faith on a mutually agreed scope, at the Customer’s expense, without disrupting the service or exposing any other customer’s data.

Customer Personal Information is stored in the United States. Some sub-processors operate globally; the sub-processor page states where each processes data. We do not currently offer EU Standard Contractual Clauses, a UK International Data Transfer Addendum, or a Swiss equivalent, and VenueWS is not offered as a GDPR-compliant service; a customer with subjects in those jurisdictions should contact us before subscribing.

This Addendum takes effect when Customer accepts the Terms and continues for as long as we process Customer Personal Information. Each party’s liability under it is subject to the limitation of liability in the Terms. Where this Addendum conflicts with the Terms or the Privacy Policy on the processing of Customer Personal Information, this Addendum prevails. Questions to privacy@dmsworkspace.com.

Related documents

Terms of Service · Privacy Policy · Sub-processors