Data Processing Agreement
This agreement forms part of the Terms of Service between Lachlan Brown Group (the "Processor") and the venue (the "Controller"). It meets the requirements of Article 28 of the UK GDPR.
1. Scope
- Subject matter: passing card payment requests from Touch Desk to Dojo terminals, and reporting on them.
- Duration: for as long as the venue uses the Service, plus the retention periods below.
- Personal data: card scheme, masked card number (last four digits only), authorisation code, transaction references, amounts and times. Payments also contain item descriptions from Touch Desk, which may include customer names where the venue puts them there. Full card numbers, expiry dates and security codes are never received or stored.
- Data subjects: the venue's customers who pay by card, and the venue's staff.
2. Processor obligations
The Processor will:
- process the data only on the Controller's documented instructions, which are these terms and the venue's use of the Service;
- make sure everyone authorised to process the data is bound by confidentiality;
- keep appropriate technical and organisational security measures in place. These include encryption in transit (HTTPS), encryption of credentials at rest, access controls, logging and encrypted backups;
- help the Controller respond to data subject requests and meet its security, breach-notification and impact-assessment obligations;
- notify the Controller without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data;
- make available the information needed to demonstrate compliance, and allow reasonable audits on 30 days' notice.
3. Sub-processors
The Controller authorises the Processor to use sub-processors for hosting, email delivery, error monitoring and backups. The Processor is responsible for its sub-processors' compliance. A current list is available from 2hello@sccpro.co.uk". The Controller will be told about changes in advance and may object.
Dojo and A.K.Microsystems are not the Processor's sub-processors. The Controller has its own agreements with them.
4. International transfers
Data is not transferred outside the UK without appropriate safeguards under UK data protection law.
5. Retention and deletion
Payment records are kept for 6 years, so that the Controller can meet its accounting obligations, and are then deleted. When the account ends, Dojo and Touch Desk credentials are deleted at once. Payment records are kept for the rest of that period unless the Controller asks for them to be deleted sooner and no legal obligation requires keeping them. Backups are overwritten within 3 months.