Data Processing Agreement

1. Background and roles

This data processing agreement (“DPA”) is part of the terms of service between Cognito Ventures OÜ (“Ruumio”, the processor) and the studio (the controller). It covers the personal data of the studio's members, guests and staff that Ruumio processes when providing the service (“studio data”). Ruumio's own account and billing data, for which it is the controller, are covered by the privacy policy.

If this DPA and the terms differ on the protection of personal data, this DPA prevails. Terms such as controller, processor, personal data, processing and personal data breach have their meaning in the General Data Protection Regulation (GDPR).

2. Subject matter and duration

Ruumio processes studio data only to provide the service, for as long as the terms apply, plus the export and deletion period after the end (section “Deletion and return”). The details are in Annex 1.

3. The studio's responsibilities

The studio confirms that it has a lawful basis for the processing, gives its members the information the law requires, obtains consents where needed, and that its instructions comply with the law. It is responsible for the accuracy of the data it enters, for the questions it asks (no special categories of data unless lawful and necessary), and for answering its members' requests about their data.

4. Ruumio's obligations

Instructions: Ruumio processes studio data only on the studio's documented instructions, including those given through the settings of the service. If the law requires other processing, Ruumio tells the studio first unless the law forbids it, and tells the studio if it believes an instruction breaks the law.

Confidentiality: everyone at Ruumio who can access studio data is bound by confidentiality.

Security: Ruumio applies the measures in Annex 2, appropriate to the risk.

Assistance: Ruumio helps the studio, as far as reasonably possible, to answer data subject requests, to keep the data secure, to handle breaches and to carry out data protection impact assessments and consultations. The service includes the tools for this: member export and deletion, the activity log and the studio data export.

Data subject requests: Ruumio passes requests about studio data to the studio within 5 working days and doesn't answer them itself, except to say that the request went to the studio, unless the law requires otherwise.

Breaches: Ruumio tells the studio of a personal data breach affecting studio data without undue delay (aiming at 24 hours after becoming aware), with what is known so that the studio can meet its own duties, and updates it as more becomes known.

Records: Ruumio keeps a record of its processing and gives the studio the information needed to show that this DPA is complied with.

5. Sub-processors

The studio gives Ruumio general authorisation to use sub-processors. The current list is at ruumio.app/sub-processors (Annex 3). Ruumio binds each sub-processor to data protection obligations at least as strict as this DPA and remains responsible for them.

Ruumio tells the studio owner by e-mail at least 30 days before a new sub-processor starts processing studio data. The studio may object on reasonable data protection grounds within that time. If the objection can't be resolved, the studio may end its subscription before the change takes effect, without a penalty, with a refund of prepaid fees for the period after the end.

6. International transfers

Studio data is stored in the European Union (Hetzner: Helsinki, Finland; encrypted backups in Germany). Where a sub-processor processes it outside the EU/EEA, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework) or the standard contractual clauses, with supplementary measures where needed.

7. Deletion and return

The owner can download the studio's data at any time, also while the studio is paused (billing → Data): a ZIP file with every record as JSON and the uploaded images.

When the studio stops being active (the plan is cancelled or ends for non-payment, the trial ends without a plan, or a Ruumio fee invoice stays unpaid), the data stays available for export for at least 90 days, and the owner is told by e-mail before it is deleted. Ruumio then deletes it, or sooner at the studio's request. The data of a studio suspended for a breach is kept until the matter is settled, then deleted the same way.

Ruumio keeps only its own records: its invoices to the studio (7 years, Estonian Accounting Act), the record of terms acceptances (as proof of the agreement) and the activity log (2 years, without the studio's content). Backups that may still contain the studio's data expire within 30 days, and copies of sent e-mails at the e-mail provider within 45 days.

8. Audits

Ruumio provides the information needed to show compliance with this DPA: on request, a summary of its security measures and of its latest internal audit, answers to the studio's security questions, and certifications where available. Shared documents are confidential.

The studio, or an auditor it appoints who is bound by confidentiality and isn't a competitor of Ruumio, may audit compliance once a year with 30 days' notice, and also when a supervisory authority requires it or after a breach affecting the studio's data. Ruumio may answer first with documents; an audit goes further only if they don't answer the studio's reasonable questions. Audits take place remotely during working hours by default, must not unreasonably disrupt the service, and never give access to other studios' data or to systems where that would weaken their security.

Sub-processors are audited through their own certifications and audit reports (for example ISO/IEC 27001 or SOC 2 reports and PCI DSS attestations), which Ruumio checks and passes on where their terms allow.

Each party bears its own costs. An audit beyond the documents (on site, or needing more than one working day of Ruumio's time) is at the studio's cost, at reasonable rates agreed in advance, unless it finds that Ruumio has materially breached this DPA.

9. Liability and general

Liability under this DPA follows the limitation of liability in the terms, unless the GDPR provides otherwise. Estonian law applies and disputes are decided as set out in the terms. If a provision is invalid, the rest stays in force.

Annex 1: Details of the processing

Subject matter and purpose: providing the booking and studio management service: rooms, locations and opening hours; bookings, recurring bookings and their changes; staff scheduling; payments through the studio's Stripe account; member plans, hour packs, gift cards and discount codes; company accounts and invoices; e-mails and push notifications; door codes; calendar sync; reviews; messages with the studio; the studio's website; and integrations.

Duration: the term of the subscription and the export period after it (at least 90 days), longer while a suspension is being settled or when the law requires it; backups up to 30 days more, and copies of sent e-mails at the e-mail provider up to 45 days.

Data subjects: the studio's members, guests, prospective customers and people who write to the studio; its administrators and staff; contacts of companies that book on account; gift card buyers and recipients; and people the studio shows on its website (team and project members).

Categories of data: identity and contact details (name, e-mail, phone, language) and billing details (company name, registry code, VAT number, address, billing e-mail); bookings (rooms, times, notes, extras, answers to the studio's booking questions, staff assignments); payments and their status (amounts, refunds, Stripe customer references; card data only at Stripe); member plans, packs, gift cards (including the recipient's name and e-mail and the buyer's message), discount codes and invoices; company and project memberships; door codes; messages with the studio, contact form messages and reviews; the studio's notes about members; photos and other uploads; busy times read from the external calendars of rooms and staff; account and security data (password hash, two-factor secret, sessions with the browser and a shortened IP address, activity log entries with IP addresses for 90 days, push subscriptions, calendar feed links); and what the studio collects with its own booking questions.

Special categories: not intended. The studio must not collect them unless the law allows it and it is necessary. Answers to booking questions can be deleted automatically after a period the studio chooses; free-text fields (notes, messages, booking notes) are not deleted automatically, so the studio removes anything sensitive written there itself.

Annex 2: Technical and organisational measures

Encryption: TLS 1.2/1.3 for all traffic over the internet (with users, e-mail sending, payments and other services, and the calendar and webhook addresses studios enter); stored credentials and two-factor secrets encrypted (AES-256-GCM); booking answers encrypted; backups that Ruumio copies off the server encrypted (AES-256), while the hosting provider's own server backups stay in its EU data centre.

Access: every query limited to the studio's own data; roles and permissions inside the studio; two-factor login required for Ruumio's administrators and available to every user; hashed passwords and session tokens; a recent password confirmation for sensitive admin actions; access to servers only by key.

Monitoring and logging: an activity log of logins, changes and refused access; alerts on unusual login activity; error tracking without personal data; external uptime monitoring.

Availability: daily backups with tested restores, and recovery procedures.

Secure development: security rules for every change, automated tests including security tests before deployment, dependency checks, and prompt security updates.

Organisation: an information security management system following ISO/IEC 27001, an incident response procedure, confidentiality obligations, and checks of sub-processors.

Annex 3: Sub-processors

Hetzner Online GmbH (hosting in Finland, encrypted backups in Germany); Stripe Payments Europe, Ltd. (Ireland) with Stripe, Inc. (payments, EU/US); Postmark / ActiveCampaign, LLC (e-mail delivery, US); Cloudflare, Inc. (DNS; no studio data); Functional Software, Inc. / Sentry (error reports without personal data, EU); Better Stack, Inc. (uptime monitoring and heartbeats, no personal data). The up-to-date list with locations: ruumio.app/sub-processors.