LOG INSIGN UP

Data Processing Agreement

Data Processing Agreement

This data processing agreement applies to the processing of personal data by TOURtoDO on behalf of the client, as referred to in the General Data Protection Regulation (GDPR).

Article 1 — Definitions

In this processing agreement, the following definitions apply:

  • Controller: the client determining the purpose and means of processing personal data.
  • Processor: TOURtoDO, processing personal data on behalf of the controller.
  • Data subject: the person to whom personal data relates (tour participants).

Article 2 — Purposes of processing

The processor processes personal data only on behalf of the controller for providing interactive tours through the TOURtoDO platform.

Article 3 — Security measures

The processor takes appropriate technical and organizational measures to protect personal data against loss or unlawful processing.

Article 4 — Breach notification

In case of a data breach, the processor will inform the controller as soon as possible, and no later than 48 hours after discovery.

Article 5 — Confidentiality

The processor and anyone acting under its authority are required to keep confidential all personal data they process.

Article 6 — Sub-processors

The controller authorises the use of the following sub-processors:

  • OVHcloud (France, EU): hosting, database and file storage.
  • Proton AG (Switzerland): sending email, such as certificates.
  • OpenAI (US): tour content only, and only when the AI assistant is used; transfers based on the EU-US Data Privacy Framework and standard contractual clauses.
  • OpenStreetMap Foundation (UK): map tiles; receives the player's IP address and the map area shown.
  • YouTube (Google): embedded videos, only when a tour contains a video.

The processor informs the controller in advance of any new or replacement sub-processor, so the controller can object. The processor imposes the same obligations on sub-processors as in this agreement.

Article 7 — Termination

After termination of the agreement, the processor will delete or return all personal data unless legal retention is required.

MUSEUMTOURISMEDUCATIONEVENTPERSONAL