Data Processing Addendum

CalRound is a software product owned and operated by SEVI WORLD LIMITED. This Data Processing Addendum (DPA) forms part of the CalRound Terms whenever a customer uses CalRound to process personal data on its behalf. The customer is the controller and SEVI WORLD LIMITED, company number 16462263, is the processor. References to data protection law include the UK GDPR, the Data Protection Act 2018 and other applicable UK data protection law.

The processing covers the hosting, extraction, organisation, publication and sharing functions selected by the customer, together with related support, security and service administration. It continues for the term of the customer's use of the service and for the limited period afterwards needed to delete or return data, maintain protected backups and meet legal obligations.

Processing may include receiving, storing, structuring, extracting, displaying, transmitting, updating, restricting and deleting personal data so that CalRound can turn schedules into calendars, support collaboration, publish customer-selected information, send enabled alerts and provide related services.

Typical data includes names and contact details of organisers and collaborators; event and schedule data; locations; attachments; recipient email addresses where alerts are enabled; and any personal data the customer includes in uploaded schedules. Data subjects may include the customer's staff, members, volunteers, contractors, event participants, recipients and other people named in customer content.

Special-category data and unnecessary children's data are not intended for the service and should not be uploaded unless the customer has established that the processing is specifically lawful, necessary and supported by appropriate safeguards.

The customer determines the purposes and means of processing, is responsible for the lawfulness, fairness and accuracy of its instructions and content, and must provide required notices and obtain any required consents. The customer must use service controls appropriately, avoid unnecessary data and ensure it is entitled to upload, process and publish the data it provides.

CalRound will process personal data only on the customer's documented instructions, including the Terms, this DPA, the customer's use of service settings and other agreed written instructions, unless UK law requires otherwise. Where legally permitted, CalRound will tell the customer before processing required by law. CalRound will promptly notify the customer if, in its opinion, an instruction infringes applicable data protection law.

CalRound ensures that people authorised to process customer personal data are subject to confidentiality obligations. It will maintain appropriate technical and organisational measures proportionate to the risk, including access controls, separation of customer data, encrypted transport, protected storage and service monitoring. No online system can be completely secure, and no certification is claimed.

The customer gives general written authorisation for CalRound to use subprocessors needed to provide the service. Current material providers are listed on the Subprocessors page. CalRound will reflect material changes there and give notice where required by contract or law. If a customer has a legally valid objection to a new subprocessor, the parties will discuss a reasonable resolution. CalRound imposes materially equivalent data protection obligations on subprocessors and remains responsible for their performance as required by law.

Taking account of the nature of processing and information available to it, CalRound will provide reasonable assistance so the customer can respond to data subject requests and meet applicable obligations concerning security, personal data breaches, data protection impact assessments and prior consultation with the ICO. The customer remains responsible for deciding how to respond as controller.

CalRound will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data and will provide information reasonably available to help the customer meet its notification duties. Notification is not an admission of fault or liability.

At the end of the service, CalRound will, at the customer's choice where reasonably available, delete or return customer personal data and delete remaining copies, unless applicable law requires retention. Data may remain temporarily in access-restricted backups until overwritten through normal backup cycles. The customer should export required data before ending the service.

CalRound will provide information reasonably necessary to demonstrate compliance with Article 28 UK GDPR. If that information is insufficient, the customer may request a proportionate audit by itself or an agreed independent auditor. Audits must be arranged on reasonable written notice, during normal business hours, subject to confidentiality and security requirements, and must avoid unreasonable cost, access to other customers' data or disruption. The customer bears its audit costs unless law requires otherwise.

CalRound will not make a restricted transfer of customer personal data unless an applicable lawful transfer mechanism is in place, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by law.

Questions about this DPA may be sent to [email protected]. If this DPA conflicts with the Terms on the processing of customer personal data, this DPA takes priority. SEVI WORLD LIMITED is registered in England and Wales with registered office at 18 Park Street, London, W1K 2HZ, United Kingdom.