Data Processing Agreement

1. Roles

This Data Processing Agreement (DPA) forms part of the Terms of Service between you (the controller) and Pipeline Engine Ltd (the processor, "ShowsUp"). It applies where ShowsUp processes personal data about your meeting attendees on your behalf.

2. Subject matter and duration

ShowsUp processes attendee personal data to provide the reminder service for as long as your account is active, and deletes or returns it on termination as set out below.

3. Nature and purpose

Sending meeting reminders by email, SMS, and AI voice, checking meeting attendance, and writing changes to your calendar events, on your instructions.

4. Types of data and data subjects

Contact identifiers (names, email addresses, phone numbers) and meeting attendance status, relating to your meeting attendees and invitees.

Where an attendee replies to a reminder, ShowsUp also processes the content of that reply — the sender's address, the subject, the message text, and any attachments — so that it can be passed to you and the remaining reminders for that meeting stopped. Reply content is deleted 30 days after receipt. Where you have switched on reply spotting, a reply found in the Gmail thread of a reminder is processed the same way, except that it is never sent to Typesafe or to any other sub-processor: ShowsUp reads it only to stop the remaining reminders and show it to you, and deletes its content 30 days after finding it.

ShowsUp also derives, from the words of a reply, a single label recording whether it appears to be a confirmation, a request to move or cancel, or neither. Producing that label involves sending the reply text to Typesafe, a sub-processor that returns a score and cannot generate text or act on the account. The label is shown to you and never changes what ShowsUp sends or pauses. The label is retained after the reply content is deleted; the scoring service's full response is deleted on the same 30-day clock as the content, because it repeats the text back.

ShowsUp reads the title, time, location, link, attendees, and description of events on your main calendar and on any other calendar you have connected, so that it can show them to you. Events marked private, confidential, or personal are stored and shown like any other event, to the account owner and to any agency managing the account. Event details are deleted 24 hours after the event ends, or immediately if you disconnect the calendar. ShowsUp can also write changes you make to an event (title, time, location, description, or guests) back to that calendar, only when you ask it to. ShowsUp only sends its own messages to people on events from those calendars if you choose to add a reminder sequence to that event. If you choose to notify guests when you edit an event, Google or Microsoft sends the update on your behalf, and Outlook always emails guests about changes.

5. Controller instructions

ShowsUp processes attendee data only on your documented instructions, including those given through the product (such as editing a calendar event), unless required by law to do otherwise.

6. Confidentiality

ShowsUp ensures that people authorised to process the data are bound by confidentiality.

7. Security

ShowsUp implements appropriate technical and organisational measures, including encryption of integration tokens at rest (AES-256-GCM), encryption in transit (HTTPS), access controls, and least-privilege API scopes.

8. Sub-processors

You authorise ShowsUp to use the sub-processors listed in our Privacy Policy. We will give you reasonable notice of any intended change and an opportunity to object.

9. International transfers

Where personal data is transferred outside the UK or EEA, ShowsUp relies on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum.

10. Data subject rights and assistance

Taking account of the nature of the processing, ShowsUp will assist you with responding to data subject requests and with your obligations under Articles 32 to 36 UK GDPR.

11. Personal data breach

ShowsUp will notify you without undue delay after becoming aware of a personal data breach affecting your attendee data, with the information you reasonably need to meet your own notification duties.

12. Deletion and return

On termination, ShowsUp deletes or returns attendee personal data in line with the retention terms in the Privacy Policy, unless retention is required by law.

13. Audit

ShowsUp will make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits on reasonable prior notice and subject to confidentiality.

14. Contact