Data Processing Agreement

1. Parties and roles

This Data Processing Agreement ("DPA") forms part of the agreement between Airplate and the venue that uses the Airplate service (the "Agreement", including the Terms and Conditions). It sets out the terms Article 28(3) of the General Data Protection Regulation (EU) 2016/679 ("GDPR") requires.

The venue is the controller of the personal data it processes through Airplate. Airplate is the processor and processes that personal data only on the venue's behalf. The processor is Airplate (www.airplate.ai),

Veeringstraat 41, 1502 NK Zaandam, Netherlands.

What Airplate does as a controller itself (its website, its own billing, its sales and support contacts) is described in the privacy policy, not here.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the Airplate service to the venue.
• Duration: for as long as the Agreement runs, and afterwards until the personal data is returned or deleted under section 11.
• Nature: collection through the venue's request forms, e-mail and integrations; storage, organisation and retrieval; use to price requests, prepare proposals and contracts, collect signatures and deposits, place holds in the venue's property management system, send notifications and answer the venue's questions in the assistant; disclosure to the sub-processors in section 7; erasure.
• Purpose: to let the venue receive and answer event requests and manage its bookings.

3. Personal data and data subjects

Data subjects:

• the venue's clients and their contact persons (event planners, bookers, signers);
• other people named in a request or booking;
• the venue's own users and team members.

Personal data:

• identification and contact details: name, e-mail address, phone number, company, job title, postal address, VAT number;
• event and booking details: dates and times, number of guests, requirements and notes, prices, deposits and their payment status (card details are only ever entered at Stripe);
• contracts, signatures and the signing audit trail;
• IP addresses recorded when a client views or downloads a proposal;
• the e-mails Airplate sends for the venue and their delivery status; messages and voice notes the venue's staff send to the Airplate bot, when the venue enables it;
• the venue users' account details.

Airplate is not designed for special categories of personal data (Article 9 GDPR). Where a client writes such information in a free-text field, for example a dietary or access need, it is processed only as part of that booking.

4. Documented instructions

Airplate processes the personal data only on the venue's documented instructions: this DPA, the Agreement and the venue's own configuration and use of the service, including for transfers to a third country. Airplate tells the venue at once if, in its opinion, an instruction infringes the GDPR or other EU or member-state data protection law. Where EU or member-state law requires Airplate to process the personal data otherwise, Airplate tells the venue before processing, unless that law prohibits it.

5. Confidentiality

Airplate ensures that every person it authorises to process the personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

6. Security of processing

Airplate takes the measures Article 32 GDPR requires, as set out in Annex 1. It keeps them under review and may change them, provided the overall level of protection is not reduced.

7. Sub-processors

The venue gives Airplate general written authorisation to engage the sub-processors listed on the sub-processor page. Airplate announces an intended addition or replacement on that page and by e-mail to the venue's account address at least thirty days before the new sub-processor processes the venue's personal data.

The venue may object on reasonable data-protection grounds during those thirty days. The parties then look for a solution in good faith; if there is none, the venue may end the affected part of the service without penalty.

Airplate imposes on each sub-processor, by contract, data protection obligations that give at least the protection of this DPA, and remains liable to the venue for the sub-processor's performance of them. Optional services the venue switches on itself, such as the Airplate bot in Telegram, process personal data only after the venue enables them; the sub-processor page states their terms.

8. Requests from data subjects

Taking into account the nature of the processing, Airplate assists the venue by appropriate technical and organisational measures, insofar as possible, to answer requests from data subjects exercising their rights under Chapter III GDPR. Airplate passes to the venue, without undue delay, any such request it receives about the venue's personal data, and answers it only on the venue's instruction.

9. Assistance with security, breaches and impact assessments

Taking into account the nature of the processing and the information available to it, Airplate assists the venue with its obligations under Articles 32 to 36 GDPR: security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority.

10. Personal data breaches

Airplate notifies the venue without undue delay after becoming aware of a personal data breach affecting the venue's personal data, and aims to do so within forty-eight hours. The notice gives the information Article 33(3) GDPR lists, as far as it is available, and is completed as more becomes known: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point.

11. Deletion or return at the end of the service

When the service ends, Airplate, at the venue's choice, returns the personal data to the venue or deletes it, and deletes the remaining copies within one month, unless EU or member-state law requires it to keep them. Deleted personal data leaves the hosting provider's database backups within seven days.

12. Information and audits

Airplate makes available to the venue the information needed to show that the obligations of Article 28 GDPR are met, and allows for and contributes to audits, including inspections, by the venue or an auditor it mandates. An audit is announced at least thirty days ahead, takes place during business hours without disrupting the service, at most once a year unless a personal data breach or a supervisory authority calls for another, at the venue's cost and under confidentiality. Airplate may first answer with written information where that settles the question.

13. International transfers

Airplate transfers the venue's personal data outside the European Economic Area only to the recipients, and under the mechanisms, stated on the sub-processor page: the EU–US Data Privacy Framework for participating recipients, or the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914). The Airplate bot in Telegram, which the venue enables itself, is outside the EU and has no vendor data processing agreement.

14. Assignment

Airplate may transfer this DPA together with the Agreement to an affiliate of Airplate, or to a successor that takes over the service, by written notice to the venue. The transferee takes on all of Airplate's obligations under this DPA.

15. Precedence, liability and law

On data protection matters this DPA prevails over the Agreement. Liability and governing law follow the Agreement. A new version of this DPA is published here with its version number and date.

Annex 1 — Technical and organisational measures (Article 32 GDPR)

• Location: the Airplate application, its database and its file storage run at DigitalOcean in Frankfurt, Germany (EU); the electronic-signature service runs at Hetzner in Helsinki, Finland (EU).
• Encryption in transit: airplate.ai and its API are reached over HTTPS only, through Cloudflare.
• Stored credentials: the tokens and keys of a venue's connected integrations are stored encrypted (AES-256-GCM).
• Passwords: kept only as salted bcrypt hashes.
• Access control: every request to a venue's data needs a valid, expiring session; every database query is limited to the venue's own account; team members act within the venue's roles; a password change or reset ends every existing session.
• Administrative access: Airplate's administration area needs a second factor.
• Abuse protection: sign-in, password reset, the public request forms and the other public endpoints are rate-limited per connection.
• Language model: e-mail addresses, phone numbers, IBANs and card numbers are replaced with placeholders before text reaches the model; the model is reached through Mistral's EU endpoint; the use of Airplate's data to train Mistral's models is switched off.
• Payments: card details are entered only on Stripe's pages, never on Airplate.
• Logs: webhook requests are logged as method, masked path and status, without their headers.
• Backups: the managed database is backed up by the hosting provider; deleted personal data leaves those backups within seven days.
• Retention: as stated under "How long we keep data" in the privacy policy, for example proposal-view IP addresses are erased after thirty days.
• People: everyone authorised to process the personal data is bound to confidentiality (section 5); breaches are handled under section 10.