Data processing agreement

1. What this agreement is for

When your site collects data from your customers — a booking, a place on the waitlist, a sign-up, a request, a newsletter subscription — you are the controller of that data and VRIZ ("we") processes it on your behalf. This agreement sets out what we may and may not do with it.

It forms part of the terms of use and applies to every customer with an active plan or trial, with no need to sign it separately. On the Enterprise plan, additional terms can be agreed in writing.

It is governed by Law 172-13 on the Protection of Personal Data of the Dominican Republic and, where applicable, by the rules of the country of your business or of your visitors.

2. What data, and whose

• Whose: the visitors and customers of your business who use your site's forms.
• What data: whatever your forms ask for. Usually name, email, phone, the service, the chosen date and time, the number of people and any notes they write. For newsletter subscribers, their email and, if you ask for it, their name.
• For how long: for as long as your contract lasts and then up to 60 days so you can request your copy. After that we delete it.

Your site's visit statistics identify no one: they do not store IP addresses or use cookies.

If your business needs to collect specially protected data — health data, for instance — you need a legal basis to do so and must tell us beforehand. On the Enterprise plan, additional measures can be agreed for those cases.

3. What we do with it

Only what is needed for your site to work:

• Store it and, depending on your plan, send it to your email or show it to you in your inbox. What is stored you can download whenever you want.
• Apply your site's rules: availability, capacity, waitlist.
• Send you notices about it and, where your site has them switched on, send confirmations or reminders to your customers.
• Send the notices you decide on to the people who subscribed to your newsletter. Every notice carries an unsubscribe link, and anyone who unsubscribes receives no further notices from us.
• Hand it over to you when you ask.

We use it for nothing else. We do not sell it, do not use it for advertising, do not send it to artificial intelligence providers and do not use it to train models.

When you ask the assistant for an operation on your modules — sending a notice, closing a day, publishing an event — it only gives the order to carry it out: your customers' data, including a notice's recipient list, never passes through the artificial intelligence model.

4. Your part as controller

• Have a legal basis for each piece of data you collect and ask for no more than you need.
• Send notices only to people who agreed to receive them, and answer for what they say.
• Tell your visitors how you process their data, for example with a privacy policy on your site.
• Handle your visitors' requests about their data: access, rectification, erasure.
• Give us only lawful instructions.

5. Our part as processor

• Follow your instructions: this agreement, the terms of use and your site's settings. If an instruction seems unlawful to us, we will tell you.
• Confidentiality: only the people who need it to deliver the service have access to the data, and they are bound to secrecy.
• Security: we apply the measures in section 6.
• Help you with your visitors' rights: you can export the data from your portal and ask us to delete a specific person's data.
• Tell you about a breach affecting this data without undue delay, and in any case within 72 hours of becoming aware of it, with the information we have at that point.
• Cooperate with you if an authority asks you for information or if you need to assess the risk of some processing.
• When it ends: we hand the data over as a spreadsheet file (CSV) if you ask within 60 days and then delete it, except what the law requires us to keep.
• Show that we comply: we give you the information you need when you ask. On the Enterprise plan, audits can be agreed.

6. How we protect it

• Everything travels encrypted (HTTPS).
• The portal is accessed with a link we email, with no passwords that could leak.
• Each site only has access to its own data.
• Your form data, including your subscribers, never goes to artificial intelligence providers, and design changes are prepared in an isolated environment with no access to our databases.
• Internal access is restricted to those who need it to deliver the service.

7. Sub-processors

You authorise us to rely on these providers to process your form data:

Provider	Country	What for
Cloudflare, Inc.	United States	Storing the data and serving your site.
Amazon Web Services, Inc. (Amazon SES)	United States	Sending notices to your subscribers, confirmations and reminders, and emails related to that data.

Each is bound to protect it with safeguards equivalent to those in this agreement. If we add or change a sub-processor that handles this data, we will give you at least 30 days' notice; if you disagree, you can cancel without penalty before the change takes effect.

8. International transfers

Our sub-processors are in the United States, so your form data is transferred outside the Dominican Republic. We only work with providers who commit by contract to protect the data they receive. On the Enterprise plan, where data is stored and isolated infrastructure can be agreed.

9. Liability

Each party is liable for its own breaches, within the limits of liability in the terms of use.

10. Duration

This agreement lasts for as long as we process data on your behalf. If anything in it contradicts the terms of use regarding personal data, this agreement prevails.

11. Processor

The processor is Alfonso Miguel Evangelista Concepción, trading as VRIZ, based in Santo Domingo, Dominican Republic.