Source: https://bukk.io/data-processing [Skip to content](https://bukk.io/data-processing#legal-content) [![bukk.io](https://bukk.io/black_bukk.svg)](https://bukk.io/) [Legal & privacy](https://bukk.io/legal)[Sign in](https://bukk.io/login) Golf Consult AS · Organisation no. 922 561 095 # Data processing agreement Data processing terms for organisations using bukk.io to manage rooms and people. Published 19 October 2026 · Version 2026-10-29-live-1 On this page 1. [Parties and effect](https://bukk.io/data-processing#section-1) 2. [Subject matter, data and instructions](https://bukk.io/data-processing#section-2) 3. [Confidentiality and security](https://bukk.io/data-processing#section-3) 4. [Subprocessors and international transfers](https://bukk.io/data-processing#section-4) 5. [Assistance and personal-data breaches](https://bukk.io/data-processing#section-5) 6. [Return, deletion and assurance](https://bukk.io/data-processing#section-6) 7. [Annex A — technical and organisational measures](https://bukk.io/data-processing#section-7) 8. [Annex B — authorised service providers](https://bukk.io/data-processing#section-8) ## 1\. Parties and effect This data processing agreement (DPA) is offered by Golf Consult AS, organisation number 922 561 095, Nicolas vei 15, 4515 Mandal, Norway, as processor. The controller is the business or organisation identified by name, registration number, address and building in the accepted service order. Its authorised representative and contact email are recorded with acceptance. Contact the processor at support@bukk.io. The DPA takes effect when the customer accepts it as part of the service order or the parties otherwise agree to it in writing. The version and acceptance record identify the agreed terms. It continues until customer personal data has been returned or deleted, subject to lawful retention. It prevails over conflicting service terms for processing on the customer’s behalf. Golf Consult AS’s own platform-account, security and business-relationship processing, and Paddle’s independent payment processing, are described in the privacy notice and are outside this processor scope. ## 2\. Subject matter, data and instructions The subject matter is operation of the customer’s room-booking and building-access service. Processing includes collecting, hosting, organising, displaying, retrieving, communicating, correcting, exporting and deleting membership, access, booking and related order records. The service order, settings and requests from authorised administrators are documented instructions. Data subjects are administrators, staff, tenants, visitors, booking guests and supplier contacts. Data includes name, mobile number, email, organisation, access permissions, room and booking times, optional notes, order and billing details, necessary transaction references, notifications and activity records. Special-category and criminal-offence data are outside the intended service and must not be entered. The customer determines lawful purposes, legal bases, notices and retention instructions. The processor will process data only on documented instructions, including instructions for transfers, unless required by applicable law. It will inform the customer of such a legal requirement before processing unless legally prohibited, and promptly flag an instruction it considers unlawful. Customer data must not be sold, used for unrelated purposes or used by the processor to train an AI model. ## 3\. Confidentiality and security The processor must ensure that authorised personnel are subject to confidentiality obligations and access only the data needed for their work. It must implement and maintain technical and organisational measures appropriate to the risk under GDPR Article 32, including the measures in Annex A. The processor must assess and review the effectiveness of its controls, manage vulnerabilities, restrict administrative access and maintain a response process for security incidents. Changes must not materially reduce protection of the customer’s data. ## 4\. Subprocessors and international transfers The customer gives general written authorisation for the processors listed in Annex B and their service-related subprocessors, subject to the safeguards in this clause. Golf Consult AS must bind each subprocessor to data-protection obligations equivalent to those in this DPA and remains responsible to the customer for performance of those obligations. Golf Consult AS must notify the customer’s recorded contact at least 30 days before appointing a new or replacement direct subprocessor. For changes to a service provider’s own subprocessors, Golf Consult AS must relay notice promptly after receiving it, identify the applicable objection deadline and provide a meaningful opportunity to object before the change takes effect. It must maintain the provider notification arrangements needed to do so. The customer may object on reasonable data-protection grounds within the notified period. The parties will seek a reasonable alternative. If none is available, the customer may terminate the affected service before the new subprocessor receives its data. Prepaid fees for the unused affected service will be refunded through the billing provider. A change cannot override mandatory authorisation or transfer requirements. The primary application and database region is Frankfurt, Germany. International provider operations are disclosed in Annex B. The processor must ensure that any restricted transfer complies with GDPR Chapter V and the customer’s instructions, using an applicable adequacy decision or appropriate safeguards and necessary supplementary measures. Authorisation of a supplier is not permission for an unlawful transfer. Relevant transfer information must be made available to the customer on request. ## 5\. Assistance and personal-data breaches Taking account of the nature of processing and information available, the processor must assist with data-subject requests, security duties, breach assessment and notification, data-protection impact assessments and consultation with supervisory authorities. It will promptly forward requests concerning customer-controlled data and will not disclose that data in response without instructions, unless legally required. The processor must notify the customer without undue delay after becoming aware of a personal-data breach. It must provide available details of the nature of the breach, affected data and people, likely consequences, mitigation and a contact for follow-up. Details may be supplied in phases as investigation progresses. The processor must cooperate with containment and remediation. The contact email in the acceptance record is used for privacy and incident notices until the customer provides an updated contact. The customer should report suspected incidents to support@bukk.io promptly and keep its contact details current. ## 6\. Return, deletion and assurance At the end of the service, the customer chooses return or deletion of personal data. Return is an assisted export in a commonly readable format, normally CSV or JSON with uploaded media where applicable. The processor must confirm scope and delivery arrangements with an authorised contact and protect the transfer. The processor must complete the instructed return or deletion without undue delay, delete remaining copies unless law requires retention, and confirm completion or explain the legal reason for any retained records. During a necessary closing or backup-expiry period, data remains protected and may be used only for the closing process, recovery or legally required purposes. If a backup is restored, applicable deletion instructions must be reapplied before normal use. The processor must provide information necessary to demonstrate compliance and allow and contribute to audits and inspections by the customer or its mandated auditor. Reasonable confidentiality, notice and security arrangements must not prevent effective oversight or regulatory access. Each party remains responsible for its obligations under applicable law. - [Retention and account deletion](https://bukk.io/retention) ## Annex A — technical and organisational measures Application access is scoped to an authenticated user, active building membership and role. Mobile-code sign-in uses expiring codes and request limits. Authorised AI-agent access is permission-scoped and revocable. Automated tests exercise building boundaries and access decisions. Hosted API traffic uses TLS. Integration credentials are encrypted in the application database; production secrets are held in the deployment platform’s protected environment configuration. Ordinary application request logging excludes request bodies and bearer credentials. Subscription processing stores payment references and status rather than card details or full webhook payloads. The processor’s operational duties are to restrict production access to authorised personnel, review access when roles change, maintain updates and security monitoring, investigate incidents, and document recovery and deletion procedures. Recovery must be tested and must preserve applicable deletion instructions. These are contractual obligations; no independent security certification, uninterrupted availability or fixed recovery time is promised. ## Annex B — authorised service providers The supplier register for this version identifies Vercel (application hosting), Neon / Databricks (database), Twilio (mobile verification and messaging), Cloudflare (Turnstile security), Vercel Blob (uploaded images) and Resend (transactional email). Only data needed for the relevant function may be supplied. The register forms part of this DPA in the version recorded at acceptance; later appointments remain subject to clause 4. Paddle’s independent payment processing, external map/image requests and providers or AI agents selected directly by the customer are described separately in the register. Listing them does not turn them into Golf Consult AS’s subprocessors for all of their activities. - [Supplier register](https://bukk.io/suppliers) You can save or print this page using your browser. The version above identifies these documents. Golf Consult AS · Nicolas vei 15, 4515 Mandal, Norway [Terms](https://bukk.io/terms)[Privacy](https://bukk.io/privacy)[Cancellation & refunds](https://bukk.io/refunds)[All legal information](https://bukk.io/legal)[Contact support](mailto:support@bukk.io)