Data Processing Addendum
Last updated
This Data Processing Addendum ("DPA") forms part of the Terms of Service between TourChorus ("Processor") and the customer organisation ("Controller") and applies where TourChorus processes personal data on the Controller's behalf.
1. Scope and roles
The Controller determines the purposes of processing personal data of its passengers and staff collected through the Service. TourChorus processes that data only to provide the Service and on the Controller's documented instructions, which are the Terms, this DPA and the Controller's configuration of the Service.
2. Details of processing
- Subject matter: provision of the TourChorus platform.
- Duration: the term of the Terms plus any export or deletion period.
- Data subjects: the Controller's passengers ("Riders") who use its tours, and the Controller's staff users.
- Categories of data: device identifiers, tour usage events, language preferences, survey answers, email addresses and consents Riders choose to share with the Controller, staff names, emails and roles.
- Special categories: none intended. The Controller should not use surveys to collect special-category data.
3. Processor obligations
TourChorus will:
- Process personal data only on documented instructions, and tell the Controller if an instruction appears to break data protection law.
- Ensure people authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational measures (section 5).
- Assist the Controller, taking into account the nature of processing, in responding to data subject requests and with data protection impact assessments.
- Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data.
- At the end of the Service, delete or return the personal data at the Controller's choice, unless law requires retention.
- Make available information reasonably necessary to demonstrate compliance with this DPA.
4. Sub-processors
The Controller authorises TourChorus to use sub-processors for hosting, databases, payments, email delivery, AI translation and voice generation, and error monitoring. TourChorus will impose data protection obligations on sub-processors no less protective than this DPA, remains responsible for them, and will give notice of new sub-processors so the Controller can object on reasonable grounds.
5. Security measures
- Tenant isolation: every record is scoped to its organisation and access is authorised server-side from the user's membership and role.
- Encryption in transit (TLS) and at rest by our infrastructure providers.
- Least-privilege access for TourChorus staff, with audited support access.
- No third-party secret keys in client applications.
- Backups and monitoring of production systems.
6. International transfers
Where personal data is transferred outside the EEA, UK or Switzerland to a country without an adequacy decision, the parties rely on the applicable standard contractual clauses, which are incorporated by reference.
7. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on data protection, this DPA prevails.