This addendum applies where Waitrooms processes personal data of visitors to a customer's waiting room on the customer's behalf. The customer is the controller and Waitrooms is the processor.
Scope of processing
| Subjects | Visitors to the customer's waiting rooms. |
|---|---|
| Data | IP address (transient), country (aggregated), queue position tokens, and email addresses when a visitor asks to be notified. |
| Purpose | Running the waiting room: ordering visitors, preventing abuse, sending requested notifications, and producing aggregate statistics. |
| Duration | For the term of the customer's account, subject to the retention periods in the privacy policy. |
Our commitments
- Process personal data only on the customer's documented instructions, which these terms and the customer's room settings make up.
- Ensure everyone with access is bound by confidentiality.
- Apply the measures described on our security page.
- Use only the subprocessors listed in the privacy policy, with 30 days' notice of changes.
- Help the customer respond to data subject requests and notify them without undue delay of any personal data breach.
- Delete or return personal data at the end of the service.
International transfers
Where data leaves the EEA, UK or Switzerland, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent mechanism.
To sign a countersigned copy, email hello@waitrooms.dev.