Scope and roles
This Data Processing Agreement forms part of the Terms of Service between TAPP Digital Incorporated ("TAPP", the processor) and the Customer (the controller). It applies to personal data in Customer Data that TAPP processes to provide WavesPath.
It is written to meet the Barbados Data Protection Act 2019 and, where they apply, the EU GDPR and the UK GDPR. Where those laws use different words for the same thing, the meaning is the same.
Processing only on your instructions
TAPP processes personal data only on the Customer's documented instructions, which are the Terms, this agreement, and the Customer's use and settings of the Platform, unless the law requires otherwise, in which case TAPP will tell the Customer first where the law allows. TAPP will tell the Customer if it believes an instruction breaks data protection law.
TAPP does not sell personal data, use it for its own purposes, or use it to train artificial intelligence models.
Details of the processing
| Subject matter and duration | Providing WavesPath to the Customer for the length of the subscription and the deletion period afterwards. |
|---|---|
| Nature and purpose | Hosting, storing, organising, displaying, sending, analysing and deleting data so that the Customer can run its membership, events, learning, communications, bookings and governance. |
| People concerned | The Customer's members, applicants, former members, delegates, speakers, authors, reviewers, exhibitors, sponsors' contacts, learners, subscribers, form respondents, people who book facilities, and the Customer's own staff and volunteers. |
| Kinds of data | Contact details; membership details and status; dues, invoices and payment records (never card numbers); attendance, check-ins and continuing education credits; certificates; answers to the Customer's forms and files people upload; photographs; messages sent and their delivery; committee and ballot participation (ballot choices are kept secret). |
| Special categories | None are required. If the Customer chooses to collect them, for example through its own form questions, it is responsible for having a lawful basis and for telling TAPP. |
People who handle the data
TAPP gives access to personal data only to staff who need it to run and support the Platform, who are bound by confidentiality, and whose access to the platform's administration is limited by area and protected by two-factor sign-in.
Security
TAPP keeps appropriate technical and organisational measures in place to protect personal data, taking into account the risks involved. The current measures are described on our Security page and include encryption in transit and at rest, separation of each customer's data, access control and logging, two-factor sign-in for TAPP staff, and backups.
Subprocessors
The Customer authorises TAPP to use subprocessors to provide the Platform. The categories, purposes and locations are on our Security page. The current named list is available to the Customer on request at hello@wavespath.com.
TAPP will give the Customer at least 30 days' notice before adding or replacing a subprocessor. If the Customer objects on reasonable data protection grounds, we will discuss it in good faith, and if we cannot resolve it the Customer may end the affected service and receive a refund of fees paid for the time remaining.
TAPP places data protection terms on each subprocessor no less protective than these and remains responsible for their work.
Helping with requests and assessments
The Platform lets the Customer find, correct, export and delete its End Users' records. Where it cannot do something itself, TAPP will help the Customer answer requests from people exercising their rights, and will pass on any request it receives directly. TAPP will also give reasonable help with data protection impact assessments and consultations with authorities.
Personal data breaches
TAPP will tell the Customer without undue delay, and where possible within 72 hours, after becoming aware of a breach affecting the Customer's personal data, with what is known at the time: what happened, the data and people likely affected, the likely consequences and what is being done. TAPP will update the Customer as it learns more and help it meet its own duties to notify.
International transfers
TAPP and its subprocessors operate mainly in the United States. Where personal data is transferred from a country whose law restricts transfers, TAPP will rely on a recognised safeguard, such as the European Commission's Standard Contractual Clauses, the UK's International Data Transfer Addendum, or another mechanism the law allows.
Deletion and return
The Customer can export its data at any time. When the subscription ends, TAPP keeps the data available for export for 30 days and then deletes it within 90 days, unless the law requires it to be kept. Copies in backups are deleted as the backups expire and are protected until then.
Information and audits
TAPP will make available the information reasonably needed to show it meets this agreement and answer reasonable security questionnaires. Where that is not enough, the Customer may carry out an audit, or have one carried out, on at least 30 days' notice, no more than once a year unless a breach or an authority requires it, at the Customer's cost, in a way that protects other customers' data and TAPP's confidential information.
Questions about this page?
Write to us at hello@wavespath.com. If you are a member of an organisation that uses WavesPath, that organisation can also help with your own record.