Safari Studio data processing terms

These data processing terms are part of the agreement between Virtues Media LLC, a Wyoming limited liability company trading as Safari Studio ("Safari Studio", "we", "us") and the business that holds a Safari Studio account ("you", "the customer"). They apply to the personal data you keep in Safari Studio. Where they and the Terms of Service differ on personal data, these terms prevail.

1. What we process for you

• Subject matter and purpose. Providing the Safari Studio service as you configure it: your contacts, deals, costings, quotes, invoices, proposals, holds, fleet, files and the email of the mailboxes you connect.
• People concerned. Your staff who use the service; your clients and travellers; your suppliers and their staff; anyone who writes to a mailbox you connect.
• Kinds of data. Names and contact details; trip details; travellers' details you or your clients enter, which can include dates of birth, nationality, dietary needs, medical conditions, insurance details and emergency contacts; payment records; email content; files you upload. We do not collect passport numbers.
• Duration. For as long as your account is active, and afterwards as section 9 says.

2. Roles

You are the responsible party (controller) for the personal data in your account; we are your operator (processor).

3. Instructions

We process that data only to provide the service as you configure it, to follow your written instructions, and as the law requires. These terms are your instructions.

4. People

Our staff and contractors who can access your data are bound by confidentiality and trained in data protection.

5. Security

We apply the measures in our Privacy Policy, section 10, and on our security page, and keep them up to date.

6. Sub-processors

We use the providers listed in our Privacy Policy, section 7, and will tell you by email 30 days before adding one; you may object on reasonable grounds, and if we cannot resolve it you may end the agreement.

7. Help with rights and obligations

The service gives you an export and a delete-or-anonymise action per person; we help you with data subject requests, security assessments and regulator inquiries about data we hold for you.

8. Breaches

We tell you without undue delay, and within 72 hours of confirming it, about any breach affecting your data, with what we know and what we are doing.

9. End of service

At the end of the agreement we return your data by export and delete it as the Terms of Service, section 12, say.

10. Transfers

Where the GDPR or UK GDPR applies, the standard contractual clauses (controller to processor module) are incorporated by reference, with you as data exporter and us as data importer. Where POPIA applies, you authorise the transfer to our providers in section 7 of the Privacy Policy, which are bound by comparable safeguards.

11. Audits

Once a year, on 30 days' notice and at your cost, you may audit our compliance with these terms through written questions and the reports of our providers; an on-site audit only where a regulator requires it.

12. Contact

Questions about these terms go to [email protected].