Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between a golf course, restaurant or bar (the “Venue”) and Luma Tech Digital LLC (“Legacy,” “we” or “us”), the maker of Legacy Golf Systems and Legacy Restaurant POS, under our Terms & Conditions. It sets out how we handle the personal information of the Venue’s customers and staff when the Venue uses our services (the “Services”). It applies for as long as the Venue uses the Services and until we have deleted or returned the Venue’s data afterwards.

1. Roles

The Venue is the controller of the personal information about its customers and staff that it puts into the Services or that the Services collect on its behalf: it decides what the Services are used for. Legacy is the Venue’s processor: we handle that information only to provide the Services to the Venue and as this DPA and the Venue’s documented instructions allow. For the Venue’s own account with us (the owner’s contact details, billing), we act for ourselves.

2. What we process, and why

Subject matter and purpose

Running the Venue’s operation on the Services: online and in-person tee-time booking, point of sale and tabs, food and drink ordering, payments through the Venue’s own Stripe account, receipts, customer accounts and card-on-file, text and email messages to customers and staff, the digital scorecard, the staff time clock and payroll export, gift cards, reports and alerts to the Venue’s managers.

Whose information

• The Venue’s customers: golfers, diners and guests.
• The Venue’s owners, managers and staff.
• People the Venue chooses to send reports to (for example its accountant).

What kinds of information

• Customers: name, email address, mobile number; booking, order, tab, payment, tip, refund, house-credit, season-pass and gift-card history; saved-card references (brand, last four digits and Stripe’s identifier — never the card number); SMS consent; scores on the scorecard; the Google account email and name if they sign in with Google.
• Staff: name, email address, mobile number; a hash of the register PIN; login password hash; clock-in and clock-out times, breaks, pay role and hourly rate, cash tips declared, corrections to hours and who made them; sales attributed to them; alert preferences.

We do not process payment card numbers (Stripe does), government identifiers, or any special category of information. The Venue agrees not to put such information into free-text fields.

3. Our obligations

• Instructions. We process personal information only to provide the Services, on the Venue’s documented instructions (the settings and actions it takes in the product, and this DPA), and as the law requires. If we believe an instruction breaks the law we will say so.
• Confidentiality. The people who can reach personal information on our side are bound to keep it confidential, and access is limited to what their job needs.
• Security. We keep measures appropriate to the information and the risk, including: encryption of all traffic in transit; an encrypted database at rest, hosted on Amazon Web Services and reachable only from the application and our administrators; the application connecting to the database as a least-privilege role; row-level isolation of each Venue’s data in the database, enforced by the database itself and not only by the application; PINs, passwords, sign-in codes and gift-card codes stored only as hashes; card entry handled by Stripe so card numbers never reach our systems; and access to the Venue’s admin gated by role and, for shared front-desk devices, by a trusted-device cookie plus a PIN.
• No selling, no training. We do not sell personal information, do not use it for advertising, and do not use it to train artificial-intelligence or machine-learning models.

4. Subprocessors

The Venue authorises us to use the following providers to process personal information on our behalf. Each is bound by a contract that protects the information at least as well as this DPA does, and we remain responsible to the Venue for their work.

Before we add or replace a subprocessor we will email the Venue’s owner at least 30 days in advance. If the Venue objects on reasonable data-protection grounds and we cannot resolve it, the Venue may cancel its subscription before the change takes effect without penalty.

5. Helping with people’s requests

Customers can see, correct, download and delete their own information from the account page of the Services; staff can see and correct their own details and hours through the register and the links we text them. If a customer or staff member sends a request to the Venue that the Venue cannot meet with those tools, or sends one to us about information the Venue controls, we will help the Venue answer it within the time the law allows, and we will pass any request we receive directly on to the Venue without undue delay.

6. If something goes wrong

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of or access to personal information we process for the Venue, we will tell the Venue’s owner without undue delay and in any case within 72 hours of confirming it, with what we know about what happened, whose information is affected, what we have done and what we recommend the Venue does. We will keep the Venue informed as we learn more and help it meet its own obligations to tell people or authorities.

7. When the agreement ends

When the Venue’s subscription ends, the Venue may export its data from the Services (reports, customer and staff lists, the payroll export) before and for a reasonable period after the end date. We then delete the personal information we process for the Venue within 30 days of the Venue confirming its export is complete or of that period ending, except for what the law requires us to keep (for example records of payments) and copies in routine backups, which expire on their own schedule and are not restored for use.

8. Showing our work

On request, no more than once a year unless there has been an incident, we will give the Venue a written summary of the security measures above and how we keep to this DPA, and answer reasonable questions about it. Where the Venue’s own legal obligations require more, we will agree a sensible way to meet them that does not expose other venues’ data.

9. General

This DPA is part of the Venue’s agreement with us and, for the matters it covers, takes precedence over the rest of it. The liability limits in the Terms & Conditions apply to it. It is governed by the same law and courts as those terms. We may update this DPA when the Services or the law change; we will give the Venue notice by email and the updated edition applies from the date at the top.

Contact

Luma Tech Digital LLC (Legacy Golf Systems · Legacy Restaurant POS)
info@legacygolfsystems.com