Data processing agreement
Between the organisation using OurGathering for Teams (the controller) and LUXD LTD, a company registered in England and Wales (company number 17465024), registered office Flat 1b, 153 Wandsworth Bridge Road, London SW6 2TT (the processor), under UK GDPR Article 28. Last updated 26 October 2026.
1. What is processed
- Subject matter and purpose: planning the controller’s internal events.
- People: the controller’s staff and guests it invites.
- Data: names, work email addresses, replies, travel and room details, budget and claims records; and, where the controller asks, dietary and access needs, which can be health data.
- Duration: while the controller uses the service, then deletion as in section 6.
2. Instructions
LUXD LTD processes the data only on the controller’s documented instructions, which are these terms and the controller’s use of the service, unless the law requires otherwise; if so we’ll say, where we can.
3. Confidentiality and security
- Anyone at LUXD LTD with access is bound by confidentiality.
- Encryption in transit; encrypted backups; access checked on the server for every request; health and access answers readable only by people the controller trusts with them; every export recorded.
4. Sub-processors
- Fly.io: hosting, in London.
- Cloudflare: DNS and encrypted backups.
- Resend: sending email.
We’ll tell the controller before adding or replacing a sub-processor, so it can object. Each is bound by terms that protect the data at least as well as these.
5. Helping the controller
- We help the controller answer requests from people about their data, and with security, breach and impact-assessment duties.
- We tell the controller without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its data.
6. Ending
When the service ends, we delete the controller’s data within 30 days, after giving it the chance to export, unless the law requires us to keep it. Backups expire within a further 30 days.
7. Audits
We make available the information needed to show we meet these obligations, and allow reasonable audits with notice.