Data processing agreement

Version 2026-10. Between Joe Bishop, trading as Convoy (39a Ernest Road), "we", and the business customer using Convoy, "you".

1. When this applies

This agreement forms part of our terms for every customer on a Business plan, and for anyone else who uses Convoy to run events for their own clients, staff or members. It covers the personal data of the people in your events ("guest data"). You don't need to sign anything for it to apply. If you'd like a signed copy, ask us.

2. Who does what

• You are the controller of guest data: you decide which events to run, who to invite and why.
• We are your processor: we handle guest data only to run Convoy for you, as described here.
• We are a controller in our own right for your account details, billing records and our security logs, as set out in our privacy notice.

3. Details of the processing

• Subject matter and purpose: showing your guests an event page where they can say whether they're coming, how they're travelling and when they'll arrive, and organise lifts and pickups.
• Nature: collecting, storing, displaying to people with the invite link, exporting at your request, and deleting.
• People involved: your guests, drivers and co-hosts, and anyone else added to your events.
• Types of data: names, attendance, travel mode, arrival times, the general area someone is coming from, seats offered, pickup times and places, notes, and account email addresses for guests who sign in. Convoy isn't designed for special category data (such as health information), and you shouldn't ask guests for it.
• Duration: for as long as you use Convoy. Each event and its guest data is deleted automatically at the end of your plan's retention period after the event (365 days on Business), or sooner if you or a guest deletes it.

4. Our commitments

Under UK GDPR Article 28, and the EU GDPR where it applies, we will:

1. Process guest data only on your documented instructions, which are these terms and how you set up and use your events, unless the law requires otherwise. If the law requires us to do something else, we'll tell you first unless the law forbids it. We'll tell you if we think an instruction breaks data protection law.
2. Make sure everyone who can access guest data is bound by confidentiality.
3. Keep guest data secure with appropriate technical and organisational measures, including encryption in transit and at rest, least-privilege access, two-step verification for admin access and logging of every admin access. See our security overview.
4. Use other processors only as listed below. We'll give you at least 30 days' notice before adding or replacing one, so you can object. If we can't resolve a reasonable objection, you can end your plan and we'll refund any fees you've paid in advance for the period after it ends. Each sub-processor is bound by data protection terms that give the same level of protection as this agreement, and we remain responsible to you for them.
5. Help you respond to people exercising their rights (access, correction, deletion and so on). Most of this you can do yourself in Convoy; for anything else, we'll help within 10 working days of your request.
6. Tell you without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting your guest data, with the information you need to meet your own reporting duties.
7. Give you reasonable help with data protection impact assessments and with consulting the Information Commissioner's Office, where these involve Convoy.
8. When your plan ends, or when you ask, delete guest data. You can export guest lists to CSV beforehand. Backups expire on a rolling basis within 35 days.
9. Give you the information you need to show compliance with Article 28, and allow audits. We'll answer reasonable written questions at any time. An on-site or third-party audit can take place once a year, with 30 days' notice, at your cost, and under a confidentiality agreement.

5. Your commitments

• Have a lawful basis for sharing guest details through Convoy, and tell your guests about it, for example by linking to your own privacy notice and to ours.
• Only invite people who are 16 or over to add themselves. A parent, guardian or you can add a younger person by name.
• Share invite links only with people who should see the event. Anyone with the link can see the guest list.
• Not ask guests for special category data or anything not needed to plan their travel.

6. Sub-processors

Stripe handles your payments, but it only processes your billing details, never guest data.

7. International transfers

Guest data is stored in the UK. We won't transfer it outside the UK unless the destination has UK adequacy regulations or appropriate safeguards are in place, such as the UK International Data Transfer Agreement or Addendum, and we'll tell you first under section 4.4.

8. Liability and changes

Each party's liability under this agreement is subject to the limits in our terms for business customers, except where the law doesn't allow it to be limited. We may update this agreement to reflect changes in the law or our service. We'll give you at least 30 days' notice of any change that reduces your protection.

Contact

help@joebishop.info