Data processing agreement

This agreement governs the processing that Playium carries out, on behalf of each venue, of the personal data the venue manages on the platform. It forms part of the Terms of service and is accepted with them on subscribing. On data protection matters, it prevails over the terms.

Applicable law: Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 where the venue is established in Spain or processes data of people residing in the European Union; Andorran Law 29/2021 of 28 October on personal data protection (LQPD) and Decree 391/2022 where it is established in Andorra. Where they coincide, the GDPR is cited for brevity: article 31 of the LQPD imposes on the processor the same obligations as article 28 of the GDPR.

The front desk's offline mode stores in the browser of the venue's device a copy of the venue's data, so it can keep taking payments without a connection: the families, with all the details of parents/guardians and children and their passes; bookings and events from 60 days back onwards, with their notes, custom fields and the customer's contact details; and recent check-ins, consumptions and cash registers. The venue is responsible for the custody of those devices.

If the venue processes health data, it decides that the data is necessary and ensures the legal basis of article 9.2 of the GDPR (usually, the parent/guardian's explicit consent). Playium applies to it the same security measures as to all other data and, in addition, the data in the dedicated field is deleted automatically 30 days after the visit (if it arrives via WhatsApp, the message that carried it is emptied in the copy of the conversation that Playium stores when it is stored) and is kept out of the ICS feed, the emails and the AI assistant.

Playium undertakes to (art. 28.3 GDPR; art. 31.4 LQPD):

• Process the data only on the venue's documented instructions [28.3.a]: those of this agreement, those of the terms of service and those the venue gives when using the platform (registering families, taking payments, sending notices, enabling modules, deleting). If Playium considers that an instruction infringes the law, it will inform the venue immediately. It will only process the data outside those instructions if required by law, and in that case it will inform the venue beforehand, unless the law prohibits it. • Not transfer data to a third country without the safeguards of clause 7 [28.3.a]. • Ensure that the persons authorised to process the data have committed to confidentiality [28.3.b]. Playium staff access a venue's data only to operate the service, resolve incidents or handle a support request from the venue itself. Their support access (platform administration) can see the data of every venue, health data included; it is limited to those purposes and subject to this duty of confidentiality. • Apply the security measures of article 32 of the GDPR described in the annex (clause 11) and keep them up to date [28.3.c]. • Respect the sub-processing conditions of clause 6 [28.3.d]. • Help the venue respond to data subject requests [28.3.e]: if a family contacts Playium, Playium will forward the request to the venue without delay and within 3 working days at most. From the panel the venue can view and correct family records; deleting a family from the panel deactivates it (it no longer appears in the panel or the app, and its access accounts are blocked) and Playium can restore it at the venue's request; to handle an erasure request, the venue uses «Erase personal data», which permanently deletes or anonymises the family's personal data and keeps without it the accounting records the venue must keep by law. • Help the venue meet its obligations on security, breach notification, impact assessment and prior consultation (articles 32 to 36 of the GDPR) [28.3.f], with the information available to it as processor. • Erase or return the data when the service ends under clause 9 [28.3.g]. • Make available to the venue the information needed to demonstrate compliance with these obligations and allow audits under clause 10 [28.3.h].

In addition, Playium keeps a record of the categories of processing activities it carries out on behalf of venues (article 30.2 of the GDPR; article 32 of the LQPD).

The venue, as controller:

• Ensures it has a legal basis to process the data it enters on the platform and informs families and its staff about that processing, including that Playium acts as its processor. To inform families, Playium generates the venue's privacy notice from the details the venue enters in its settings (company name, tax ID, address and phone number) and the services it has turned on, and publishes it only once those details are complete; the venue is responsible for its content and for completing those details and keeping them up to date. • Obtains parents'/guardians' consent where required (in particular, for health data) and can prove it. When signing up in the family app, requesting a booking or signing up for an activity in the public calendar, the parent/guardian ticks a checkbox that links to the venue's privacy notice or, while the venue has not published one, to Playium's privacy policy and, if the venue has published one in Playium, to its legal notice; for a booking via WhatsApp, the assistant sends the link to that same text and, if there is one, the text of the venue's legal notice, and asks for an explicit yes; when the venue's staff register a family from the Families section of the dashboard, they declare that they have informed the family. Playium stores which version was accepted or declared and when and, except on WhatsApp, from which browser and the IP address, the latter only as a hash. If the venue turns on the allergies and special needs field, the family consents with a dedicated checkbox (on WhatsApp, with an explicit yes to a fixed message), the staff who enter it in the dashboard declare that the family has authorised it, and Playium keeps the record in the same way. • Gives Playium only lawful instructions, through this agreement and the use of the platform. • Decides which data is necessary (minimisation), which fields it asks families for and which modules it enables (WhatsApp with AI assistant, calendar sync, payment gateways), and carries out the impact assessment where appropriate. • Manages its staff's permissions and the custody of their credentials and of the devices from which it uses the platform. • Sets the retention periods that apply to it and decides when data is erased: the venue itself erases a family's data from the dashboard with «Erase personal data» (clause 4), and the erasure of all its data when the service ends follows clause 9. By default, Playium automatically deletes communications (WhatsApp messages, the log of sent emails, dashboard notifications and reminders) within the periods set out in the Privacy Policy; the venue can request erasure earlier.

The venue gives Playium general authorisation to use, in order to provide the service, the sub-processors listed in the list of sub-processors, which states what each one does, what data it processes and where, and dates every change (the Privacy policy also names them): hosting and database, email, push notifications, WhatsApp messaging, artificial intelligence, analytics and error monitoring (art. 28.2 GDPR; art. 31.3 LQPD).

Playium will notify the venue of any addition or replacement of a sub-processor at least 30 days in advance, by email to the venue's administrator. During that period the venue may object on reasonable grounds related to data protection by writing to hola@limbo.ad. If the objection cannot be resolved, the venue may terminate the contract without penalty before the change takes effect. If the venue does not accept the updated list in the dashboard, the suspension of access under clause 15 of the Terms of service applies.

Playium imposes on each sub-processor, by contract, data protection obligations equivalent to those of this agreement, and remains liable to the venue for their compliance (art. 28.4 GDPR; art. 31.5 LQPD).

The venue's own providers are not Playium sub-processors. In particular, the payment gateways the venue contracts (Stripe or PayPal) process families' payment data under the venue's contract with them, and the calendar provider to which the venue syncs its feed does so under the venue's account.

Playium is established in Andorra, which has an adequacy decision from the European Commission (Decision 2010/625/EU), so disclosing data from a European Union venue to Playium requires no additional safeguards. The service's database and files are hosted in the European Union (eu-west-1 region, Ireland). Server functions run on Supabase's network, in the region closest to each request, which may be in the United States.

Where a sub-processor processes data in a country without an adequacy decision (for example, the United States), the transfer relies on its certification under the EU-US Data Privacy Framework or on the standard contractual clauses of Decision (EU) 2021/914. Playium will provide the venue, on request, with a copy or summary of those safeguards.

Playium will notify the venue, without undue delay and in any case within 48 hours of becoming aware of it, of any breach of the security of the personal data it processes on the venue's behalf, by email to the venue's administrator, with at least: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed and a contact point. If it is not possible to provide all the information at once, it will be provided in phases.

It is for the venue, as controller, to decide whether to notify the supervisory authority (72 hours: article 33 of the GDPR; article 36 of the LQPD) and whether to communicate the breach to the data subjects. Playium will provide the necessary assistance and document the incident.

While the service lasts and for 30 days after cancellation, the venue's administrator can download all its data from the dashboard (Settings › Your data; if the licence has expired, from the screen shown after signing in): a zip with one CSV file per table, the venue's files and a LEEME.txt (read-me) file describing every table and listing its columns. The download does not include secrets (payment gateway keys, WhatsApp tokens, private links, one-time codes) or Playium's own data (the venue's subscription, its invoices and Playium's internal records). If the venue had already left when Playium activated this procedure, the periods in this clause run from that activation. While the venue's subscription is still alive at the payment gateway (for example, paused or pending payment), the download stays open and nothing is erased.

90 days after cancellation, Playium automatically erases the venue's data, its files and the access accounts of its staff and its families. Playium emails the venue's administrator when the service ends, 7 days before the download closes and when the erasure is complete. If the venue reactivates its subscription before then, the erasure is cancelled. The venue can also request an earlier erasure by writing to hola@limbo.ad from the email associated with the account: Playium schedules it and it runs five days later. The database's automatic backups (clause 11) are renewed every day and each copy is kept for seven days, so erased data also disappears from them within that period. At the venue's request, Playium will certify the erasure in writing.

Playium keeps the billing records of the venue's Playium subscription (its tax details, the subscription and its payment history) for 6 years from the erasure, in a separate, blocked archive the venue cannot access, to meet its legal obligations, and then deletes them. Beyond that, Playium may keep, blocked, the data strictly necessary to comply with a legal obligation of its own or to meet liabilities arising from the processing, for the applicable limitation period, without processing it for any other purpose.

Playium makes available to the venue the documentation that shows compliance with this agreement: this text, the list of sub-processors, the description of the security measures and, where they exist, the audit reports or certifications of its infrastructure providers.

The venue, or an independent auditor appointed by it and bound by confidentiality, may audit compliance with this agreement once a year, or additionally after a security breach or at the request of a supervisory authority, with 30 days' notice, during business hours, without disrupting the service or accessing other venues' data, and bearing its own costs. Playium will cooperate and answer the questions raised in writing.

Measures Playium applies today (explained in more detail in Security):

• Encryption: all communications with the platform are encrypted (HTTPS/TLS). The database and files are hosted on Supabase, which encrypts them at rest. • Location: database and files in the European Union (eu-west-1 region, Ireland). • Isolation between venues: every record carries the venue it belongs to, and the database's row-level security policies prevent one venue from reading or modifying another's data. Each venue's files are stored in its own folder. • Access control: personal accounts for venue staff with two roles (administrator and employee); family accounts that only see their own family's data; passwords stored irreversibly by the authentication provider; mandatory change of the temporary password that a family registered at the front desk receives by email when it activates its account; the synced calendar link uses a secret code the venue can regenerate. • Backups: automatic daily database backups, kept for seven days. • Separate environments: the test and production environments use different databases. • Secrets outside the code: keys for external services are stored as server secrets, not in the code or the browser. • Minimisation: errors the server sends to the monitoring tool (Sentry) are logged without emails, phone numbers or keys; the venue can enable a reduced version of the synced calendar, without the family's phone, email or notes or the birthday child's details (it keeps the customer's name). • Playium staff: access to a venue's data limited to operating the service, resolving incidents or handling support requested by the venue itself, under a confidentiality commitment. • Incident management: with the deadlines of clause 8.

Each party is liable for the damage it causes by breaching data protection law or this agreement, under article 82 of the GDPR: Playium, for that arising from breaching the obligations the law imposes on processors or acting outside the venue's instructions; the venue, for that arising from the lawfulness of the processing, the duty to inform and its instructions. The limitations of liability in the terms of service apply between the parties to the extent permitted by law.

This agreement prevails over the terms of service as regards the processing of personal data. It is governed by the data protection law applicable to each party and, otherwise, by the law and jurisdiction of the terms of service. It is published in Spanish, Catalan and English; in case of any discrepancy, the Spanish version prevails.