Data processing terms
These terms apply when Mintinaj processes personal data for you, as your processor, through your site and back office. They form part of the terms of service and are meant to meet Article 28 of the GDPR and the UK GDPR.
Roles
You (the business) are the controller of the personal data of your site's visitors and customers. Mintinaj LLC is your processor. For your own account data, Mintinaj is the controller, as the privacy policy explains.
What we process, and why
- Purpose and nature: hosting and running your site and its functions (contact forms, booking, store and orders, tickets, stays, courses and memberships, invoices, the site chat)
- People concerned: visitors and customers of your site, and the staff you add
- Data: names, contact details, booking, order and invoice details, messages, and the other details your forms ask for
- Duration: as long as your subscription runs, then until deletion as described below
Do not collect special categories of data (for example health data) unless you need them and the law allows it.
Your instructions
We process the data only on your documented instructions: these terms, and the settings you choose in your back office. We tell you if we believe an instruction breaks data protection law.
Confidentiality and security
Everyone at Mintinaj who can access the data is bound to confidentiality. We keep appropriate security measures: HTTPS connections, passwords and sign-in links stored only as hashes, encrypted backups kept for 30 days, and restricted, protected access to the admin tools.
Sub-processors
You authorise us to use the sub-processors listed in the privacy policy under "Who receives data". We impose the same data protection obligations on them. We announce a new sub-processor at least 30 days in advance by e-mail; you can object, and if we cannot address your objection you can end the subscription without the months left of the minimum term.
International transfers
Data may be processed in the USA and other countries. Where the GDPR applies, transfers rely on safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
Helping you
We help you answer requests from the people concerned (access, correction, deletion and so on), mostly through the tools in your back office, and give you the information you need for a data protection impact assessment or a question from an authority.
Personal data breaches
If we become aware of a breach affecting your data, we tell you without undue delay, with the information we have, so you can meet your own duties.
End of the service
When the subscription ends, you can export your data first. We then delete it within 30 days, and our backups are overwritten within a further 30 days, unless the law requires us to keep it.
Information and audits
We give you the information needed to show that these terms are met. You can audit us, at your cost and with reasonable notice, at most once a year unless there was a breach, preferably through written questions.
Liability and precedence
The limitation of liability in the terms of service applies. If these data processing terms and the terms of service differ on data protection, these data processing terms apply.