Data Processing Agreement

This draft would be made between the operator of Atelier Corner — currently its founder, operating as an independent project in the Netherlands prior to formal incorporation ("the Processor") — and the participating atelier named on signature ("the Controller").

The Controller determines the purposes and means of processing the personal information of its participants and customers. The Processor handles that information on the Controller's behalf in order to provide the platform.

The Processor provides a workshop management platform covering workshops, sessions, scheduling, bookings, attendance, customer records, loyalty, reviews and related communications. Processing consists of collecting, storing, organising, displaying, transmitting and deleting personal information as needed to provide these features.

Processing continues for as long as the Controller uses the platform, and afterwards only as long as necessary to complete deletion or return, or to meet a legal duty.

Data subjects: the Controller's workshop participants and customers, their guardians or accompanying dependants, the Controller's own staff and team members, and people who join waitlists or leave reviews.

Personal data: names, email addresses, telephone numbers where entered, booking and attendance records, guardian relationships, participant notes entered by the Controller, loyalty and referral records, reviews, communication preferences and email delivery metadata.

The platform is not designed for special-category data, and the Controller should not enter it.

The Processor processes personal data only on the Controller's documented instructions, which consist of this agreement, the platform's settings and features as used by the Controller, and any further written instruction agreed between the parties, unless required otherwise by law.

The Processor ensures that people authorised to process the personal data are bound by an appropriate duty of confidentiality and access it only where needed to provide or support the service.

The measures listed here are the ones currently implemented:

• Authenticated accounts with role-based permissions
• Database-level isolation so each atelier can only reach its own records
• Integration credentials stored server-side and never exposed to the browser
• Encrypted transport (HTTPS) for traffic to and from the platform
• Audit logging of sensitive administrative actions

No claim is made about certifications, independent audits or encryption arrangements that have not been verified. Further measures will be agreed following legal review.

The Controller gives general authorisation for the Processor to engage subprocessors. The Processor will inform the Controller of intended changes and give a reasonable opportunity to object.

Current subprocessors, subject to confirmation of contractual terms:

• Lovable Cloud and its underlying hosting and database infrastructure
• The managed transactional email delivery service
• Google, where the Controller connects a Google integration
• The Lovable AI Gateway and its AI model provider, for the optional migration assistant

Signed subprocessor agreements have not yet been verified.

The Processor will, taking into account the nature of the processing, assist the Controller with requests from data subjects exercising their rights, and will pass on any request it receives directly. During the beta this assistance is provided manually, as self-service export and erasure tools are still being built.

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and will provide the information reasonably available to it. The Processor will also provide reasonable assistance with data protection impact assessments and any consultation with a supervisory authority.

At the end of the service, the Processor will, at the Controller's choice, delete or return the personal data, subject to any legal retention duty and to the deletion capabilities actually available in the platform at that time.

The Processor will make available the information reasonably necessary to demonstrate compliance with this agreement and will allow for and contribute to audits carried out by the Controller or an auditor it mandates, on reasonable notice and without disrupting the service or other ateliers.

Processing takes place on the subprocessors' hosting infrastructure listed in section 8; the exact regions and any transfer mechanisms have not yet been formally documented. No representation is made that transfer safeguards have been verified.

Processor contact: my.atelier.corner@gmail.com. Controller contact: to be completed on signature. Governing law: the laws of the Netherlands.

Signature blocks for both parties are to be added once this draft has been reviewed. See also our Privacy Policy and Terms of Use.