GDPR

01

Who is the controller

It depends on which of the two kinds of person you are, and the privacy notice explains the difference.

For a business owner and their team, AxionLabs is the controller of the account details, billing records, and technical logs described in the privacy notice.

For a client of that business, the business is the controller and AxionLabs is its processor. The business decides what to collect about you and why; we hold it on the business’s instructions and do nothing else with it.

02

Why we may process it

• To perform a contract: running the service a business signed up for, and recording the booking a client made.
• To meet a legal obligation: keeping transaction records for the period tax law requires.
• For our legitimate interests: keeping the service secure, investigating abuse, and answering people who write to us. We have weighed these against your interests and do not think they override them.
• With consent, where the law requires it. We do not run advertising, so we rarely need to ask.

03

Your rights

Under the GDPR you may ask us, or the business that holds your records, to:

• Tell you what is held about you, and give you a copy.
• Correct something that is wrong.
• Delete it, where there is no legal reason to keep it.
• Restrict what is done with it while a question is settled.
• Hand it over in a portable, machine-readable form.
• Stop processing that rests on legitimate interests, where your situation gives you a reason.
• Not be subject to a decision made by automation alone that has a legal effect on you. Turnexify makes no such decisions.

04

How to use them

A business owner can do most of this from the dashboard. For anything else, or to close an account, write to us.

A client of a business should ask that business, which is the controller of their records and can act from its dashboard. If you cannot reach the business, write to us and we will help you find the right contact, or act on the business’s behalf where it has asked us to.

We answer within one month. We do not charge for a request unless it is plainly excessive, and we will tell you before we do.

If you are not satisfied, you may complain to your national data protection authority. In the United Kingdom that is the Information Commissioner’s Office.

05

Transfers outside the EU and UK

Our systems run in the United States, so using Turnexify means your information is transferred there. For transfers from the EU and the UK we rely on the European Commission’s Standard Contractual Clauses, and on the UK Addendum to them, with each of the companies below. Copies are available on request.

• Supabase — database, sign-in, and file storage.
• Stripe — card payments and payouts.
• Square — card payments and payouts.
• Resend — sending email.
• Vercel — hosting and custom domains.

06

A processing agreement for businesses

A business in the EU or the UK that uses Turnexify to hold its clients’ records needs a data processing agreement with its processor. Ours is available on request and covers the subject matter, duration, nature, and purpose of the processing, the subprocessors above, and our obligations on security, assistance, deletion, and audit.

07

How long we keep it

The periods are in the privacy notice. In short: for as long as the business keeps its account, then deleted on request or on closure, except for transaction records the law requires us to keep and technical logs that are discarded after a short period.

08

If something goes wrong

If a breach of security affects personal data we hold, we will tell the controller without undue delay so it can meet its own obligations, and we will tell the supervisory authority ourselves where the law requires it.

09

Contact

Write to hello@turnexify.com and put “GDPR” in the subject, or use the contact page and pick “A privacy or data request”. We have not appointed a representative in the EU or the UK; the law requires one only above a scale we have not reached, and this notice will change when that changes.