1. Parties and roles
This agreement is between the agency using the platform (the controller) and the platform operator (the processor). The agency decides why and how the personal data of its guests and registrants is processed; the platform processes that data only on the agency's behalf.
2. Subject and duration
The platform processes the personal data the agency or its guests enter for inviting people to events, registering them, issuing tickets and sending event emails, for as long as the agency uses the platform and until the data is erased.
3. Types of data and data subjects
Guests, invitees and registrants: email address, first and last name, answers to the registration form and the related registration, ticket and email-delivery records. Special categories of data are processed only if the agency asks for them in its own form fields.
4. Processor obligations
The platform processes the data only on documented instructions of the agency, ensures that people authorised to process it are bound to confidentiality, takes appropriate technical and organisational security measures, assists the agency with data-subject requests and with its obligations on security, breach notification and impact assessments, and notifies the agency without undue delay after becoming aware of a personal data breach.
5. Sub-processors
The agency gives general authorisation for the sub-processors on the platform's sub-processor list. The platform informs the agency of intended changes to that list, so the agency can object, and imposes the same data-protection obligations on every sub-processor.
6. International transfers
Where a sub-processor processes data outside the European Economic Area, the platform ensures an adequate safeguard, such as an adequacy decision or the European Commission's standard contractual clauses.
7. Audits
The platform makes available the information needed to demonstrate compliance with this agreement and allows for and contributes to reasonable audits by the agency or an auditor it mandates.
8. End of processing
When the agency stops using the platform, the platform deletes or returns the personal data at the agency's choice, unless the law requires it to be kept.