Data processing agreement
The processing framework that must accompany a real venue pilot.
Scope and current status
Venues normally determine the purposes for their operational personal data; VenTuhi processes it on their instructions. Initial demonstrations use fictional operational data. This page summarises the processing framework and is not a signed or complete customer-specific DPA. Before real processing, both parties must agree the full DPA with its completed schedules.
Instructions, confidentiality and security
The agreement must identify the parties, subject matter, duration, purposes, data types and people concerned. Processing follows documented lawful instructions, including overseas processing. Personnel with access must have appropriate confidentiality duties. Security measures must be proportionate to the risks and recorded accurately in the agreed schedule.
Suppliers and transfers
Subprocessors require the agreed authorisation process, appropriate contractual duties and an opportunity to object to proposed changes where general authorisation is used. The processor remains responsible for its subprocessors’ relevant obligations. Restricted international transfers require the applicable lawful arrangements, recorded alongside storage and support locations.
Rights, incidents and assurance
The agreement covers help with individual rights, security incidents, impact assessments and regulatory consultation. A processor must notify the controller of a personal data breach without undue delay. Information and audit arrangements must enable the controller to assess compliance.
Return, deletion and schedules
The customer chooses return or deletion at the end of processing, with legally required retention handled appropriately. Complete schedules must identify the processing scope, verified security measures, authorised providers and transfers, export arrangements, active-data deletion and residual backup periods.
Obtain the completed DPA
Contact hello@ventuhi.com for the completed agreement and schedules. We will agree them with the venue before real processing begins.