Data Processing Addendum
This addendum applies whenever Planvent processes personal information on your behalf, and it applies automatically - you do not need to sign anything for it to be in force. If your own compliance requires a countersigned copy, write to hello@planvent.ca and we will sign one.
It is written to Canadian privacy law. We do not offer Planvent to businesses established in the European Economic Area or the United Kingdom, so this addendum does not carry the EU standard contractual clauses and does not purport to make you GDPR-compliant. If your business needs that, tell us before you sign up rather than after.
It forms part of the terms of service (the “agreement”). Planvent Inc. is the processor; you, the account holder, are the controller.
1. Roles
You are the controller of the personal data you put into Planvent about your clients, guests and vendors. We are the processor, acting on your documented instructions - which means the agreement, this addendum, and your ordinary use of the product’s features.
For your own account data - who you are, your business, how you use the product - we are the controller, and the privacy policy governs it instead.
2. What we process, and for how long
We process personal data for as long as the agreement lasts, to provide the event planning workspace and the features described in it, for the categories set out in schedule 1 below, plus the retention period in section 9 of the privacy policy.
3. What we will do
- Process personal data only on your instructions, unless the law requires otherwise, in which case we will tell you first unless the law forbids it.
- Bind anyone who handles it to confidentiality.
- Keep the measures in schedule 2 in place.
- Help you answer data subject requests, and meet your own obligations on security, breach notification and impact assessments, at reasonable cost for anything beyond ordinary support.
- Tell you without undue delay after we become aware of a personal data breach affecting your data, with what we reasonably know, so you can meet your own notification deadlines.
- On termination, delete or return the personal data as you choose, except what we must keep by law.
- Give you the information reasonably needed to show we are complying, and allow audits on reasonable notice, frequency and confidentiality terms.
Authorised instruction: aggregate statistics. You instruct and authorise us to produce aggregated, de-identified statistics about the cost of event services from the quotes, rates and budget lines in your workspace, and to use those statistics to improve budget estimates across Planvent. The output contains no personal data and cannot be traced back to you, your client, your event, or an individual vendor’s quote, and we may continue to use it after the agreement ends. This is described for your clients’ benefit in section 6 of the privacy policy and permitted under section 5 of the terms.
4. Sub-processors
You authorise the sub-processors listed in section 7 of the privacy policy, as updated from time to time. We will tell you at least 14 days before a new one starts handling your data. You may object on reasonable data protection grounds by writing to hello@planvent.ca within that window; if we cannot address the objection, either of us may terminate the affected part of the service.
We remain responsible for a sub-processor’s performance of these obligations to the same extent we are responsible for our own. Handing work to a provider does not hand the obligation with it.
5. Processing outside Canada
Personal information you put into Planvent is processed outside Canada, as set out in section 8 of the privacy policy. Each sub-processor is under contract to give it a comparable level of protection, and we stay accountable to you for it under PIPEDA - transferring the work does not transfer the responsibility.
6. Liability and precedence
Each side’s liability under this addendum is subject to the limit in section 10 of the terms, and nothing here expands it. Where this addendum and the rest of the agreement disagree about the processing of personal data, this addendum governs; on everything else, the agreement governs.
Schedule 1: processing details
- Data subjects: your clients, event guests and vendor contacts.
- Categories of data: names, contact details, RSVP replies, dietary and accessibility notes, budget and vendor correspondence - whatever you enter.
- Nature and purpose: hosting and processing the above to run an event planning workspace, including AI-assisted concepts, vendor communication and budget tracking.
- Duration: the term of the agreement, plus the retention period in the privacy policy.
Schedule 2: technical and organisational measures
- Encryption of data in transit and at rest.
- Passwords stored as bcrypt hashes, never in readable form.
- Every record owned by exactly one workspace, with every application query constrained to the workspace of the signed-in account.
- Revocable, non-guessable tokens for shared links - proposals, RSVPs, intake forms and vendor quote requests - each scoped to the narrowest view its holder needs.
- Access controls limiting our people to what their role requires.
- Sub-processor due diligence, with data protection obligations passed down by contract.
Contact
Planvent Inc., 490 Gordon Krantz Avenue, Milton, ON L9E 1Z5. hello@planvent.ca