Data processing terms

These terms are part of the terms of service between your business ("you", the controller) and LUZAURA, LDA, Rua de Volta da Manhã, Prado Villas, 8125-406 Quarteira, Portugal, NIPC 518676161 ("we", the processor). They apply to the personal data of your clients and contacts that we process for you in Kinhour, and meet Article 28 of the General Data Protection Regulation (GDPR).

What we process, and why

• Subject: running your timetable, bookings, courts, memberships, payments, check-ins, messages and member app, as you set them up in Kinhour.
• People: your clients, people who book or are added to a booking, people who contact you, and your team.
• Data: contact details, bookings and attendance, passes, memberships and payments (card details stay with Stripe), messages, forms you ask clients to fill in, consents, check-ins and door entries.
• Special categories: only if you ask for them, for example in a health form. You are responsible for the lawful basis and the client's explicit consent.
• Duration: while your workspace is open, then as set out under "At the end".

What we promise

• We process the data only on your documented instructions, which are these terms and the way you set up and use Kinhour. If we think an instruction breaks data protection law, we will tell you.
• Everyone at our company who can access the data is bound to confidentiality.
• We keep the data secure: encrypted connections, passwords stored only as secure hashes, sign-in codes that expire, access limited by role, and records of sign-ins and important changes.
• We help you answer requests from your clients to see, correct, export or erase their data. Most you can do yourself in the dashboard.
• We help you with security, breach notifications and data protection impact assessments where the law requires it.
• We tell you without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting your data.
• We give you the information you need to show that these terms are kept, and allow reasonable audits, with 30 days' notice and at your cost, no more than once a year unless a breach or an authority requires it.

Sub-processors

You authorise us to use these sub-processors. Each is bound by data protection terms at least as protective as these.

• Vercel (hosting), Supabase (database, European Union, Frankfurt), Cloudflare R2 (file storage, Western Europe).
• Brevo (email delivery, France) and Google Workspace (our own mailboxes).
• Stripe (payments), and Expo, Apple and Google (member app notifications).
• Only when you switch them on: Twilio (text messages), Meta (WhatsApp, Instagram, Messenger) and Anthropic (front desk assistant).

Services you connect yourself, such as your invoicing software, door locks, Zapier or a marketplace such as Algarve Circle, act on your instructions under their own terms with you; they are not our sub-processors. We will tell you by email at least 30 days before we add or replace a sub-processor, and you may object. If we cannot resolve a reasonable objection, you may close your workspace and we will refund any fees paid for the time after it closes.

Transfers outside Europe

Where a sub-processor processes data outside the European Economic Area, we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

At the end

You can export your data at any time. When your workspace closes, we delete your clients' data within 90 days, unless the law requires us to keep part of it, such as billing records.

Contact

Questions about these terms or a data protection request: support@kinhour.com.