Data Processing Schedule

These terms apply to every account holder whose site collects information from its visitors, through a form, customer accounts, bookings or payments. They apply whether you are a business, an organisation or an individual.

• If you collect the data for a business or organisation, you are the controller and we are your processor under UK GDPR Article 28.
• If you run a site purely for personal or household purposes, data protection law may not apply to you (the "household exemption"). We still process the data only for you, and we still keep every commitment in these terms. In that case, "controller" in these terms means you, and "processor" means us.

• Subject matter: hosting Your Site and running the features you switch on, such as forms, customer accounts, bookings, payments and emails to your visitors.
• Duration: while your Account is open, and until we have returned and deleted the data as section 11 says.
• Nature: storing, organising, showing, sending, retrieving and deleting data, on our systems and our sub-processors' systems.
• Purpose: only to provide the Service to you.
• Data subjects: Your Visitors and Your Customers, and your team members.

• Categories of data, depending on the features you use:

  • name, email address and phone number;
  • addresses, including map coordinates;
  • booking details: what was booked, times, prices, notes, cancellation reasons;
  • vehicle details, where vehicle features are enabled: registration, make, model, colour and photos;
  • customer account passwords (stored only as a one-way hash);
  • payment records: amounts, status, card brand, last four digits and expiry (full card details are handled by our payment processor, never by Kiln);
  • form submissions;
  • IP address and browser of requests, and security events.
• Special category data: none expected. You must not collect it through Kiln.

We take appropriate technical and organisational measures to protect the data (UK GDPR Art. 32). These include:

• encryption in transit and at rest;
• logical separation of each account's data, with access controls enforced in the database;
• one-way hashing of passwords;
• multi-factor sign-in for owners and platform staff;
• an append-only audit log of security events and staff actions;
• daily database backups, kept for 7 days;
• bot checks on public booking, sign-up and form pages.

If one of Your Visitors asks us directly to exercise their rights, we will pass the request to you and will not answer it ourselves. We will help you respond to requests to access, correct, export or erase their data. When you ask, we will produce a full export of one person's data, or erase or anonymise it, within 5 working days.

Some records survive an erasure request, because the law requires them or because they protect the Service:

• booking financial details and payment records, kept for six years;
• the security audit log, kept until its 400-day clock deletes it;
• payment notification data, kept until its 90-day clock removes the personal details.

Our payment processor keeps its own copy of payment data in your payment account. You can delete customer records there yourself.

If we become aware of a personal data breach affecting the data, we will tell you without undue delay, and in any case within 48 hours of becoming aware of it. We will give you the information we have about:

• what happened;
• the data and people affected;
• the likely consequences;
• what we are doing about it.

We will update you as we learn more.