This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between The Lost Group Ltd t/a Taybl ("Taybl", "we", "us") and the customer who uses the Taybl platform (the "Customer", "you"). It applies to the personal data we process on your behalf when you use the Service, and it reflects the requirements of Article 28 of the UK GDPR.
If there is any conflict between this DPA and the Terms about the processing of personal data, this DPA applies.
1. Definitions
1.1 "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and any other data protection law that applies to the processing of Customer Personal Data.
1.2 "Customer Personal Data" means personal data that we process on your behalf in providing the Service, as described in Annex 1.
1.3 "Controller", "Processor", "Data Subject", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in Data Protection Law.
1.4 "Sub-processor" means a third party we engage to process Customer Personal Data on your behalf.
1.5 Other capitalised terms have the meanings given in the Terms.
2. Roles and scope
2.1 For Customer Personal Data, you are the Controller and we are the Processor. This covers the personal data of your guests and your staff that you or your Users record in the Service.
2.2 For your own account, contact and billing details, we are an independent Controller. That processing is explained in our Privacy Policy and is not covered by this DPA.
2.3 Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of Data Subject.
3. Our obligations as Processor
3.1 We will process Customer Personal Data only on your documented instructions, which are: these Terms and this DPA, your use and configuration of the Service, and any further written instructions you give that are consistent with them. If we are required by law to process it differently, we will tell you first unless the law prevents us.
3.2 We will tell you if we believe an instruction breaches Data Protection Law.
3.3 We will make sure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
3.4 We will not sell Customer Personal Data, and we will not use it for our own marketing or advertising.
4. Your obligations as Controller
4.1 You are responsible for having a lawful basis to collect Customer Personal Data and to provide it to us, and for giving your guests and staff the privacy information they are entitled to, including that their data is processed using Taybl.
4.2 Allergy and dietary information can be special category data. You are responsible for having an appropriate lawful basis, typically explicit consent, before you record it.
4.3 You are responsible for the accuracy of the data you input, and for the security of your own accounts, including keeping credentials confidential.
5. Security
5.1 We will put in place appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures in place at the date of this DPA are summarised in Annex 2.
5.2 We may update our measures from time to time, provided that we do not materially reduce the level of protection.
6. Sub-processors
6.1 You give us general authorisation to use Sub-processors. The Sub-processors we use at the date of this DPA are listed in Annex 3.
6.2 We will give you at least 15 days' notice of any new or replacement Sub-processor, by email or in-app notice, so that you can object.
6.3 If you object on reasonable data protection grounds within that period, we will work with you in good faith to resolve it. If we cannot, you may cancel the affected part of the Service in line with the Terms.
6.4 We will have a written contract with each Sub-processor that requires it to protect Customer Personal Data to a standard no lower than this DPA. We remain responsible for our Sub-processors' performance.
7. International transfers
7.1 We aim to host Customer Personal Data in the UK or EEA. Some Sub-processors are based, or have group companies, outside the UK and EEA.
7.2 Where Customer Personal Data is transferred outside the UK, we will make sure an appropriate safeguard is in place, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy regulation.
8. Helping you comply
8.1 Taking into account the nature of the processing, we will give you reasonable help, through the Service's features or on request, so that you can respond to requests from Data Subjects to exercise their rights (for example access, correction, deletion and portability).
8.2 If a Data Subject contacts us directly about Customer Personal Data, we will pass the request to you and will not respond except to tell them to contact you, unless the law requires otherwise.
8.3 We will give you reasonable help with data protection impact assessments and with consultations with a Supervisory Authority, where they relate to our processing and you do not already have the information.
9. Personal Data Breaches
9.1 We will tell you without undue delay, and in any event within 48 hours, after we become aware of a Personal Data Breach affecting Customer Personal Data.
9.2 Our notice will include, as far as we then know: what happened, the categories and approximate numbers of Data Subjects and records affected, the likely consequences, and the measures we have taken or propose to take. We will add detail as it becomes available.
9.3 We will take reasonable steps to contain the breach and to help you meet your own notification duties.
10. Audits and information
10.1 We will give you the information reasonably needed to show that we comply with this DPA, and we will allow and contribute to audits you reasonably require.
10.2 Audits will be on reasonable notice, during normal working hours, no more than once a year unless a Personal Data Breach or a regulator requires otherwise, and subject to confidentiality and to protecting other customers' data. We may satisfy a request by giving you relevant reports or certifications from our Sub-processors.
11. Return and deletion
11.1 You can export Customer Personal Data using the Service's export features while your account is active. It is your responsibility to export what you want to keep before you cancel, as set out in the Terms.
11.2 After your subscription ends, we will delete Customer Personal Data within 90 days, unless the law requires us to keep it. Copies in our routine backups are overwritten in the normal backup cycle.
11.3 On request, we will confirm in writing that deletion has taken place.
12. Liability
12.1 Each party's liability under this DPA is subject to the limits and exclusions in the Terms. Nothing in this DPA limits liability that cannot be limited by law, or a Data Subject's rights against either party.
13. Term and law
13.1 This DPA starts when you first use the Service and lasts for as long as we process Customer Personal Data on your behalf.
13.2 It is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
13.3 We may update this DPA in line with the way the Terms can be changed. If a change is material we will give you at least 14 days' notice.
Annex 1: Details of processing
| Subject matter | Providing the Taybl platform: bookings, rotas and staff scheduling, food safety records, ticketing, point of sale, and marketing tools |
|---|---|
| Duration | The term of your subscription, plus the deletion period in section 11 |
| Nature of processing | Hosting, storage, retrieval, display, transmission (including email, SMS and push notifications sent on your behalf), backup and deletion |
| Purpose | To provide the Service to you, to support you, and to keep it secure |
| Types of personal data | Names, contact details (email, phone), booking details, notes (which may include dietary or allergy information), ticket purchase details, marketing contact lists and preferences, staff schedules, clock-in and clock-out times, device location at the moment of clock-in or clock-out, food safety records signed by named staff, and files uploaded by you |
| Data Subjects | Your guests and customers, ticket buyers, marketing contacts, and your staff |
| Special category data | Allergy and dietary information, where it reveals health information |
Annex 2: Security measures
We maintain the following measures.
- Encryption of data in transit between users and the Service.
- Hosting and database providers that apply their own physical, network and access security.
- Each customer's data is separated, so that one venue's users cannot read another venue's data.
- Role-based access in the Service, so your Users only see what their permissions allow, and an audit trail of important actions.
- Access to production systems limited to the people who need it, and protected by authentication.
- Regular backups of the production database, and the ability to restore from them.
- Logging and monitoring of the Service for faults and suspicious activity.
- Confidentiality commitments for everyone who can access Customer Personal Data.
- A process for assessing, containing and reporting Personal Data Breaches.
Annex 3: Sub-processors
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Vercel | Application hosting | All data transmitted through the Service |
| Neon | PostgreSQL database hosting | All data stored in the Service |
| Stripe | Payment processing for subscriptions, deposits, tickets and card payments | Payment and transaction data (we never receive full card numbers) |
| Resend | Email delivery | Recipient email address and message content |
| Twilio | SMS delivery | Recipient phone number and message content |
| Firebase Cloud Messaging | Push notifications | Device push token and notification content |
| UploadThing | File storage | Files uploaded by you or your Users |
| Chatwoot | Support chat | Contact details and messages of venue admins and staff who contact support |