This addendum explains how Venge processes personal data for a customer when they use the service. It is designed to sit alongside the agreement that governs that customer’s use of Venge.
01Scope and roles
For Customer Personal Data processed through the Venge service, the customer is the controller and Venge is the processor. The customer decides which personal data it enters, whose data it includes, and the purposes for which it uses the service.
Venge processes that data to provide, maintain, support, and secure the service, and only on the customer’s documented instructions, unless a law requires otherwise. Venge acts separately for information it needs to run its own relationship with a customer, such as account, billing, and support information.
02What may be processed
Processing continues for the customer’s use of the service and any period needed to complete deletion, return data, or meet a legal obligation. The service may process account and workspace information, booking-provider details, customer names and email addresses, appointment details, and the technical information needed to operate sessions, prevent abuse, and resolve faults.
Customers should not enter sensitive information unless they have assessed that use and have a lawful basis to do so. The service is not designed for storing payment card details. Payments are handled by Stripe.
03Customer responsibilities
Customers are responsible for providing required notices, obtaining any permissions or other lawful basis needed for their use of the service, and responding to the people whose information they collect. Customers should keep account credentials secure and give access only to people authorised to use their workspace.
Where a customer publishes a booking page, it remains responsible for its relationship with booking guests, including its own booking terms, cancellations, and communications.
04Security and confidentiality
Venge uses technical and organisational measures appropriate to the service, including access-controlled accounts, hashed passwords, server-side sessions, encrypted connections in the production delivery path, and controls intended to limit abusive requests. Access to Customer Personal Data is limited to people who need it to operate or support the service and who are subject to confidentiality obligations.
No service can remove every risk. These measures are not a promise that the service will be uninterrupted or invulnerable, and customers should maintain their own appropriate records and business continuity arrangements.
05Assistance and incidents
Taking into account the nature of the processing and the information available to Venge, we will provide reasonable assistance with requests from individuals, security enquiries, and assessments or consultations that relate to Customer Personal Data. This assistance may be subject to reasonable cost recovery where substantial work is required.
If Venge becomes aware of a personal-data incident affecting Customer Personal Data, we will notify the customer without undue delay and share available information that helps it meet its own notification obligations.
06Subprocessors and transfers
Venge may use the service providers listed in our Subprocessor Directory to operate the service. They receive only the information needed for their role. We will impose written obligations on them that are appropriate to the service they provide.
Some providers may process data outside the customer’s location. Customers can review the provider locations and notices in the directory. Where a transfer mechanism is required, Venge and the relevant provider will use an appropriate mechanism available for that transfer.
07Return and deletion
A customer can close its Venge account through the service. When closure completes, the application deletes the account and data attached to it from the operational database, including associated sessions, identities, subscriptions, workspaces, and booking records. Active Stripe subscriptions are cancelled before account deletion is completed.
Limited information may remain where retention is required by law or in provider backup and recovery systems until their normal replacement cycle. Venge will not use retained Customer Personal Data for a new purpose.
08Changes and contact
We may update this addendum as the service or its providers change. For a material change, we will post the updated version on this page and aim to give at least 30 days’ notice where reasonably practicable. A shorter notice may be necessary to address a security, legal, or provider-driven change.
Questions about this addendum or a customer’s processing instructions can be sent to [email protected].