Data processing agreement

Who we are

Cabriola is a service operated by Marc Llort Maulion, a self-employed professional, Spanish tax ID 23842063X, with a contact address at Carrer de Nàpols, 261, Barcelona, Spain. He is the controller for account data and operation of the service. Contact for privacy requests and data protection rights: [email protected].

Parties and scope

This agreement is between the Cabriola operator identified below, as processor, and the account holder or authorised workspace representative acting as controller of guest data. It covers hosting, organising, consulting, exporting and deleting replies for event management. It does not replace the controller’s obligations or govern Cabriola’s own controller activities for accounts and billing.

Data and duration

Data subjects are guests and accompanying people. Data may include names, contact information, attendance, party size and the answers configured by the customer. Diets and allergies can reveal specially protected data: request them only when necessary and when applicable requirements are met. Processing lasts while data remains in the project or workspace, subject to deletion instructions and backup rotation.

Instructions and confidentiality

We process data only to provide the service under documented controller instructions, including actions taken in the product. We do not sell it, use it for advertising or train models on it. If law requires other processing, we will notify you beforehand when legally permitted. Access is limited to authorised people bound by confidentiality, and we will flag instructions that appear unlawful.

Security measures

We use TLS in transit, session and permission controls, logical workspace separation, input validation, backups, and limited security and staff-access records. Connection credentials are stored as hashes and can be revoked. We do not guarantee that all data is encrypted at rest or that incidents cannot occur. Measures will be adapted to risk and the service without materially reducing protection.

Providers and transfers

You authorise Cloudflare for the service’s network, security and email. The application and database run on the operator-managed server. Google and Apple authenticate users and Polar handles payments; they do not receive guest replies for those functions. New subprocessors accessing data under this agreement will be notified in advance so you can raise reasoned objections. Equivalent obligations and required international-transfer safeguards will apply. This agreement does not activate features involving new processing.

Assistance and incidents

Taking account of the service and available information, we will assist with data-subject rights, impact assessments and authority consultations where applicable. Personal-data breaches will be notified without undue delay after awareness, with available information and updates as needed. We will not answer rights requests on your behalf without instructions unless law requires it.

Return, deletion and verification

Export data or delete replies, projects or the workspace. On termination we will return or delete data as instructed, except where legal retention is required. Ordinary backups rotate within 14 days; deletion instructions will be reapplied after a restore. Removing a member from a shared workspace does not delete data managed by others. We will provide reasonable compliance information and allow proportionate audits while protecting security and other customers’ data. Contact: [email protected].