Acuerdo de tratamiento de datos

"Customer" is the account holder that accepts the Terms of Service and acts as controller. "Processor" is Noor Inc, 95-390 Kuahelani Ave, Mililani, Hawaii, United States, the company that operates einvitation. Where the Customer is itself a processor for someone else (for example an event planner working for a client), Noor Inc acts as its sub-processor.

Noor Inc processes personal data only on the Customer's documented instructions, which are these terms and the Customer's use of the service's settings, unless the law requires otherwise; in that case we tell the Customer first where allowed. We tell the Customer if we believe an instruction breaks data protection law.

Everyone at Noor Inc who can access Customer personal data is bound by confidentiality and only accesses it when needed, for example to resolve a support request the Customer raised.

We apply the technical and organisational measures described on our Security page, including encryption of personal fields at rest (AES-256-GCM) and in transit (TLS), hashed passwords, two-factor authentication, role-based team access, rate limiting, activity logs, backups and access controls on our systems. We review them regularly.

The Customer gives general authorisation for Noor Inc to use sub-processors. Current categories are: cloud hosting and databases, S3 compatible file storage, email delivery, payment processing (Stripe, for billing data only), and the AI model provider (only for content the Customer sends to the AI assistant). The current list is available from support@einvitation.app.

We impose data protection terms on each sub-processor that are at least as protective as this DPA, and remain responsible for them. We give at least 30 days' notice of a new sub-processor; the Customer may object on reasonable grounds and, if we can't resolve it, end the affected service with a pro rata refund.

The service lets the Customer find, correct, export (CSV) and delete guest and attendee data. If we receive a request directly from a data subject about Customer data, we pass it to the Customer and don't answer it ourselves unless instructed.

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer data, with the information the Customer needs to meet its own obligations, and we take reasonable steps to contain it.

We give the Customer reasonable help with data protection impact assessments and consultations with supervisory authorities about the service.

Where Customer data is transferred outside the UK or the EEA to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference, together with any additional measures needed.

The Customer can export its data at any time. When the account is closed, or on request, we delete Customer personal data within 30 days, except where the law requires us to keep it. Backups are overwritten on a rolling schedule.

We make available the information reasonably needed to show compliance with this DPA. Where that isn't enough, the Customer may carry out an audit, at its own cost, once a year with 30 days' notice, during business hours and under confidentiality, or appoint an independent auditor to do so.

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it. If this DPA conflicts with the Terms of Service on data protection, this DPA wins.

To request a signed copy, email support@einvitation.app.