Floory · Data processing addendum
Data processing addendum
Last updated 4 November 2026
This addendum forms part of the terms of service between Atriqa Integrated Marketing Private Limited ("Processor") and the organiser using Floory ("Controller"). It applies whenever Floory processes personal data on the Controller's behalf. If you need a countersigned copy, email contact@floory.si.
1. What is processed
| Subject | Detail |
|---|---|
| People | The Controller's staff, sales heads, salespeople and external agents; contacts at the Controller's exhibitors and prospective exhibitors |
| Data | Names, business emails and phone numbers, company, time zone, role; booth activity (holds, contract signed, sold, released) with time and source; client company names and notes; Telegram chat ID and username for users who connect the bot; sign-in IP addresses and browsers |
| Purpose | Providing Floory: live floor plans, booth holds, reminders, exports, the chat bot and support |
| Duration | The subscription, plus up to 90 days for deletion and up to 14 days for backups to expire |
| Sensitive data | None intended. The Controller should not enter special category data. |
2. Processor obligations
- Process personal data only on the Controller's documented instructions. These terms and the Controller's use of Floory's settings are those instructions.
- Ensure everyone with access is bound by confidentiality.
- Apply the security measures on our security page, and keep them at least at that level.
- Help the Controller respond to requests from people exercising their rights, and with impact assessments where needed.
- Notify the Controller without undue delay, and within 72 hours, after becoming aware of a personal data breach, with the information the Controller needs to meet its own obligations.
- At the end of the service, delete the personal data within 90 days, or return it first if the Controller asks.
- Make available the information needed to show compliance. Allow audits once a year, on 30 days' notice, at the Controller's cost, by an auditor bound by confidentiality.
3. Sub-processors
The Controller authorises the sub-processors listed on our sub-processors page. We give at least 30 days' notice by email before adding or replacing one. The Controller may object on reasonable data protection grounds. If we can't resolve the objection, the Controller may end the affected service and receive a pro-rata refund. We remain responsible for our sub-processors.
4. International transfers
Floory is hosted in India. Where the Controller is subject to the EU GDPR, the parties agree to the standard contractual clauses adopted by the European Commission in Decision 2021/914 (Module 2, controller to processor), with the Controller as data exporter and the Processor as data importer. Where the UK GDPR applies, the UK International Data Transfer Addendum to those clauses applies. Clause 7 (docking) applies. For Clause 17 the governing law is that of Ireland, and for Clause 18 the courts are those of Ireland, unless the UK addendum applies. The annexes are completed by section 1 above, our security page and our sub-processors page.
5. Other laws
Where India's Digital Personal Data Protection Act 2023, Australia's Privacy Act 1988, or UAE Federal Decree-Law 45 of 2021 applies, we process the data on the same terms and give the Controller the help it needs to meet those laws.
6. Order of precedence
If this addendum conflicts with the terms of service on data protection, this addendum wins. If it conflicts with the standard contractual clauses, the clauses win.
Atriqa Integrated Marketing Private Limited · India · contact@floory.si