Data Processing Agreement

1. The processing

• Subject: the data Turnout copies from the Stripe and Livestorm accounts you connect.
• Duration: while an account is connected or the workspace exists, then until the data is deleted (section 7).
• Nature: reading through read-only APIs, storing, computing aggregates, showing them to your users, deleting.
• Purpose: computing your workspace’s analytics, nothing else.
• Data subjects: your customers and their contacts; your webinar registrants and attendees; your users and staff, where they appear in that data.
• Categories of data: from Stripe, read-only:
  • Account: your account id, timezone and default currency
  • Customers: who your customers are, and their country
  • Products: product names
  • Prices: plan prices and billing intervals
  • Subscriptions: trials, plan changes and cancellations
  • Invoices: paid invoices and their lines (your revenue)
  • Credit notes: credits issued after payment
  • Refunds: money given back
  • Disputes: lost chargebacks
  • Charges: which customer a refund or dispute belongs to
  • Events: fast daily refreshes (what changed since last time)
  Objects are stored as Stripe returns them: customers’ names, emails, addresses, phone numbers, tax ids and metadata, and on charges the billing details and the card’s brand, country, expiry and last 4 digits (never full card numbers). From Livestorm: events, sessions and attendees as Livestorm returns them: name, email, phone, company, job title, registration answers, IP address, UTM parameters and attendance.
• Special categories: none intended. The registration questions of your Livestorm webinars are yours to set, and your responsibility.

2. Instructions and confidentiality

Your instructions are your use of Turnout and its settings: connecting, disconnecting, refreshing, changing settings, connecting an AI assistant, which then receives the results it asks for, publishing a report through a shared link, deleting the workspace. We process connected data only on them, unless EU or member state law requires otherwise; we then tell you first, unless that law forbids it. We tell you if an instruction seems to break the GDPR. Everyone who works on Turnout for us is bound to confidentiality.

3. Security

We apply the measures of the annex. We may improve them, but not lower their overall level.

4. Subprocessors

• You authorise the subprocessors listed at /privacy#subprocessors.
• We email your workspace admins 30 days before we add a subprocessor. If you object on reasonable data protection grounds and we cannot address the objection, you may terminate by deleting the workspace before the change applies.
• Each subprocessor is bound by data protection terms no weaker than this DPA, and we remain responsible to you for it.

5. Assistance

We forward to you, without delay, any request from a data subject that reaches us, and help you answer it. We help you meet your obligations under Articles 32 to 36 of the GDPR (security, breach notification, impact assessments, prior consultation), taking into account the information available to us.

6. Personal data breaches

We notify your workspace admins by email without undue delay, and at most 72 hours after we become aware of a breach. The notice says, as far as we know them: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact (security@heyturnout.com). What we do not know yet follows as soon as we do.

7. End of processing

When you delete the workspace, or the terms end, we delete the connected data within 24 hours, as workspace deletion does; database backups expire within 7 days. Disconnecting a provider deletes the data copied from it within 24 hours. Nothing needs returning: the connected data is a copy of your own Stripe and Livestorm data, which stays in those accounts.

8. Audits

We give you, on request, the information needed to show that we meet this DPA. You may audit us, or have an independent auditor bound to confidentiality do so, once a year, on 30 days’ written notice, at your cost, without access to other customers’ data.

9. Transfers

Connected data is hosted in the EU (Frankfurt, Germany). Transfers by subprocessors outside the EU follow their data processing agreements, linked from the list.

10. Law and courts

As in the terms: French law applies. Any dispute that cannot be settled amicably goes to the competent courts of Paris, France.