Data Processing Agreement

1. Who does what

• You decide what personal data goes into Cheers and what we do with it for you. For that data, you are the controller and we are your processor.
• We are the controller for our own records about you: your account, sign-in, billing and security. Our Privacy Notice covers those, not this agreement.
• The UK GDPR and the Data Protection Act 2018 apply to this agreement.

2. The processing

Purpose. To provide Cheers to you under the terms: storing and preparing your content, writing AI suggestions, publishing to your Facebook Page and Instagram account, running your link-in-bio page and, if you use it, sending booking data to Meta.

Duration. For as long as the terms apply, then until we delete the data as set out in section 9.

People the data is about. Your team members; people who appear in or are named in your content, such as staff, performers and customers in photos; people who visit your link-in-bio page; and, if you use booking tracking, your customers who book.

Types of personal data.

• Team members: names, email addresses and roles.
• Content: names, photos and videos of people, and any other personal data you add to posts, briefs and media.
• Link-in-bio visits: the page viewed, the links clicked, the time and the referring site. We do not store visitors' IP addresses.
• Booking tracking, only if you use it: booking reference, event, value, date, campaign tags and click ids. Only when the customer has given consent on your website, also their IP address, browser details, Meta browser and click ids, and their email address and phone number hashed with SHA-256. We only accept email addresses and phone numbers already hashed; we never receive them in plain text.

You should not put special category data, such as health information, into Cheers unless you need to for a post.

3. Booking tracking and Meta

If you use booking tracking, we send your booking data to Meta's Conversions API on your instruction, using your own pixel and access token. Meta receives it under Meta's Business Tools Terms, which are between you and Meta. You are responsible for having a lawful basis and the consent your website needs, and for telling your customers in your own privacy notice.

4. What we promise

• Instructions. We process your personal data only on your documented instructions: these terms, this agreement and how you set up and use Cheers. That includes transfers outside the UK. If the law requires us to do something else, we will tell you first unless the law forbids it. We will tell you if we think an instruction breaks data protection law.
• Confidentiality. Everyone we allow to process your personal data is bound to keep it confidential.
• Security. We keep appropriate technical and organisational security measures in place (section 6).
• Sub-processors. We use other providers only as set out in section 5.
• Rights requests. We help you respond when people use their data protection rights. If we receive a request about your data, we pass it to you.
• Breaches. We tell you without undue delay after we become aware of a personal data breach affecting your data, with the information you need to deal with it.
• Other help.We help you with security, breach reporting, data protection impact assessments and any consultation with the Information Commissioner's Office, as far as the processing requires.
• End of the service. At the end, we return or delete your personal data, as you choose (section 9), unless the law requires us to keep it.
• Audits. We give you the information you need to show that we meet these duties, and we allow and contribute to audits by you, or an auditor you appoint, on reasonable request and with reasonable notice.

5. Sub-processors

You authorise us to use these providers to process your personal data:

• Each provider is bound by a written contract with data protection duties equivalent to these. We remain responsible to you for them.
• We will give you at least 30 days' notice by email before we add or replace a sub-processor. You can object during that time. If we cannot resolve your objection, you can end your subscription before the change takes effect.

Not sub-processors.Stripe takes payments and is an independent controller for card data, under its own terms. Meta runs the Facebook and Instagram accounts you connect, under Meta's own terms with you; booking data sent to Meta's Conversions API is covered by the Business Tools Terms between you and Meta (section 3).

6. Security measures

• Your data is stored in London, and the app's code runs in London.
• All traffic to Cheers is encrypted in transit (HTTPS).
• Facebook and Instagram access tokens are encrypted at rest with AES-256-GCM.
• Each brand's data is kept separate. People can only reach the brands they belong to.
• Owners and team members have different permissions.
• Passwords are handled by our sign-in provider, Supabase. We never store them ourselves.
• Messages from Stripe and Meta are checked for a valid signature before we act on them.
• The database is backed up daily, and backups are kept for 7 days.
• Only authorised Orange Jelly staff can access your data, and only when needed to run or support Cheers.

7. What you promise

• You have a lawful basis for the personal data you put into Cheers or ask us to process.
• You give people the information the law requires, and collect any consent needed, including cookie consent on your website for booking tracking.
• Your instructions to us are lawful.

8. Transfers outside the UK

Some sub-processors process data outside the UK, mainly in the United States. We only allow this with the safeguard shown for each one in section 5: the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You authorise these transfers.

9. Keeping and deleting your data

Before we close your account, we can send you an export: a file of your posts, schedule, brand profile and link-in-bio page, with download links to your media that last 7 days. Posts already published stay on Facebook and Instagram until you delete them there.

10. Liability and precedence

• The limits of liability in our terms apply to this agreement, as far as the law allows.
• If this agreement and the terms disagree about personal data, this agreement wins.

11. Contact

Email peter@orangejelly.co.uk or message us on WhatsApp at 07990 587315.