Data Processing Addendum Summary

1. Purpose

This document provides a summary of the data processing relationship that may apply between **[Company Legal Name]** and Service Providers using the Platform.

A full Data Processing Addendum may be issued separately where required.

2. Roles

Depending on the processing activity:

• the Service Provider may act as an independent controller of personal data relating to its customers,
• the Platform may act as a processor where it processes personal data solely on behalf of the Service Provider for the purpose of providing SaaS functionality,
• in limited cases, the Platform may act as an independent controller for its own platform operations, security, billing, compliance, or service improvement purposes.

3. Subject Matter of Processing

Processing may relate to:

• booking records,
• customer contact details,
• attendance data,
• payment-related metadata,
• communications,
• operational customer records processed through the Platform.

4. Purpose of Processing

Where the Platform acts as a processor, the purpose of processing is limited to providing the Platform services requested by the Service Provider, such as:

• hosting,
• booking workflows,
• customer record management,
• reporting,
• communications infrastructure,
• support,
• security and reliability operations.

5. Security Measures

The Platform will implement reasonable technical and organizational measures designed to protect personal data, taking into account the nature of the processing and the risks involved.

6. Subprocessors

The Platform may use subprocessors such as infrastructure providers, communication vendors, analytics vendors, and payment-related vendors where required to operate the service.

Relevant subprocessors should be made available through separate documentation where required.

7. International Transfers

Where personal data is transferred internationally, appropriate safeguards will be used where required by law.

8. Duration

Processing continues for as long as necessary to provide the Platform services and to meet legal, operational, or retention obligations.

9. Full DPA

Where required by law or contract, the parties may enter into a separate full Data Processing Addendum that governs processor-controller obligations in more detail.

10. Contact

For privacy or contractual questions, contact:

**[Company Legal Name]** **[Company Address]** **[Privacy Email]**