Data processing agreement

Parties and scope

This agreement is between the business that has a Qouh account (“you”, the controller) and 12651696 Canada Inc., 6 Topbank Drive, Toronto, ON M9W 7C2, Canada (“we”, the processor). It is part of the terms of service and applies whenever we process personal data on your behalf. You accept it together with the terms; nothing needs signing. If you want a signed copy, ask for one through the contact form.

What we process, and why

We run Qouh for you for as long as your account exists: we store, organise and use the data to offer booking times, plan routes, send confirmations, reminders and invitations, and sync the calendars you connect.

• Whose data: your customers (the people who book through your booking page or whom you add) and your staff.
• Which data: names, email addresses, phone numbers, addresses and their map positions, booking times and notes, the language of the booking, and recurring-visit details.
• No special categories of data (such as health data) are needed; please keep them out of notes.

Your instructions

We process the data only on your documented instructions: these terms, this agreement and what you set up in Qouh. If we think an instruction breaks data protection law, we tell you. If a law requires us to process data in another way, we tell you first, unless that law forbids it.

Confidentiality

Everyone on our side who can reach the data is bound to confidentiality and reaches it only when the work needs it.

Security

We take appropriate technical and organisational measures (Article 32 GDPR), including:

• Encrypted connections (HTTPS) everywhere.
• Calendar tokens and verification secrets encrypted at rest; passwords stored only as hashes.
• Two-step verification for owners and administrators, and access to the servers limited to the people who run them.
• Each business's data kept apart by access rules checked on every request.
• Daily backups, kept in the EU.
• Security updates installed promptly.

Sub-processors

You give general permission for the sub-processors below. We tell account owners by email at least 30 days before adding or replacing one; you may object, and if we can’t resolve it, you may end your plan. Each sub-processor has the same data protection duties, and we remain responsible for them.

• ZAP-Hosting GmbH (Germany): hosting, in the European Union (the Netherlands).
• Cloudflare: the network in front of the site and protection from attacks.
• Emailit: sending emails.
• OpenFreeMap: map tiles; it sees the IP address of whoever loads a map.
• Google: calendar sync, only for staff who connect Google Calendar.

Helping you

We help you, as far as we can, to answer requests from people who use their rights (to see, correct or delete their data, for example), and with security, data protection impact assessments and questions from authorities where they concern our part.

Data breaches

If a breach affects your data, we tell you without undue delay, and within 48 hours of finding it, with what we know then, so you can meet your own 72-hour deadline.

When your account ends

When your account is closed, we delete your data within 30 days, unless a law requires us to keep it. Before that you can ask us for a copy through the contact form.

Information and audits

We give you the information you need to show that we meet these duties, and allow an audit by you or an auditor you choose, with reasonable notice and at most once a year, unless a breach or an authority calls for more.

Data outside the EU

We are a company in Canada, which the European Commission recognises as protecting personal data adequately. Your data is stored in the European Union (the Netherlands). Sub-processors outside the EU and Canada work under the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

Liability and law

Liability is as in the terms of service, and this agreement follows the same law. Nothing in it limits the rights people have under the GDPR.