Data Processing Agreement

Option 1 selected — Article 28(3) and (4) of Regulation (EU) 2016/679 (GDPR). Option 2 (Regulation (EU) 2018/1725) is not applicable and is deselected.

Not adopted.

1. Documented instructions. The Controller instructs the Processor to process Personal Data only as necessary to provide the Services and as further documented by: (a) the Agreement; (b) the Controller’s configuration and use of the Services (including privacy/retention settings); and (c) any additional written instructions agreed by the parties (including support tickets or emails).
2. Out-of-scope instructions. The Processor is not required to comply with instructions that fall outside the scope of the Services, require custom development, or impose disproportionate technical or organizational burden, unless the parties agree separately in writing (including fees and timelines, if applicable).
3. Unlawful instructions. If the Processor believes the Controller’s instruction infringes applicable law, the Processor will inform the Controller (unless prohibited by law). The Processor may suspend performance of the relevant instruction and/or processing to the extent necessary to avoid non-compliance, until the Controller modifies the instruction or confirms a lawful basis.
4. No legal advice / legal basis. The Controller is solely responsible for establishing a lawful basis for processing and for determining whether consent, notices/signage, and any DPIA obligations apply. The Processor does not provide legal advice and does not monitor the Controller’s compliance with its own obligations.
5. No limitation of Clauses. Nothing in this section limits the Processor’s mandatory obligations under the Clauses or applicable data protection law, including the Processor’s assistance and information obligations where required.

Option 2 selected — General Written Authorisation.

1. Notice method. The Processor shall inform the Controller of any intended changes to the sub-processor list (addition or replacement) by (a) email to the contact address in the Controller’s account and/or (b) updating the published list at the URL referenced in Annex IV.
2. Advance notice. Where practicable, notice will be provided at least 10 days in advance. If the Controller does not object in writing within 10 days of receiving notice, the change shall be deemed accepted.
3. Urgent changes. The Processor may engage or replace a sub-processor immediately where necessary to (a) protect security, (b) address an incident, or (c) maintain service availability, with notice provided as soon as reasonably practicable thereafter.
4. Objection and remedy. Objections must be based on reasonable data protection grounds and stated in writing. If the parties cannot resolve the objection within a reasonable period, the Controller may terminate the affected service(s) (or, if not separable, the Agreement) by written notice, without penalty for prepaid unused fees for the terminated period.

The following supplementary terms apply to audits and inspections under these Clauses:

1. Audits shall be limited to a maximum of once per calendar year.
2. The Controller shall provide at least 30 days' prior written notice of any audit request, specifying the scope and purpose of the audit.
3. Audits shall be conducted during normal business hours and shall not unreasonably disrupt the Processor's operations.
4. All costs and expenses of any audit, including the Processor's reasonable internal costs for cooperation and preparation, shall be borne exclusively by the Controller.
5. The Controller shall use an independent third-party auditor bound by written confidentiality obligations acceptable to the Processor. The Processor may object in writing to an auditor if the auditor is, in the Processor's reasonable opinion, not suitably qualified, not independent, or is a competitor of the Processor.
6. The Processor may satisfy audit requests by providing: (a) current third-party audit reports, certifications, or compliance attestations; (b) detailed written responses to the Controller's written questions regarding data processing and security practices; or (c) summary reports of internal security reviews. Such documentation shall be accepted by the Controller in lieu of on-site audits, provided it is reasonably sufficient to demonstrate compliance.
7. No intrusive testing. No penetration testing, source code review, vulnerability scanning, automated traffic generation, or similar intrusive testing of the Processor’s systems is permitted without the Processor’s prior written consent.
8. All information disclosed during any audit (including reports and findings) is confidential information of the Processor and shall not be disclosed to any third party without the Processor's prior written consent, except as required by applicable law or a competent supervisory authority.
9. The scope of any audit shall be limited to the processing activities and personal data covered by these Clauses and shall not extend to the Processor's proprietary systems, source code, trade secrets, or other confidential business information unrelated to the Controller's personal data.

1. To the maximum extent permitted by applicable law, and without prejudice to any liability that cannot be limited under the Clauses or mandatory data protection law, the Processor's total aggregate liability arising out of or in connection with these Clauses and this DPA, whether in contract, tort, or otherwise, shall not exceed the total fees actually paid by the Controller to the Processor in the 12-month period immediately preceding the event giving rise to the claim.
2. The Processor shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, revenue, data (other than personal data), business opportunities, or goodwill, even if advised of the possibility of such damages.
3. The Processor shall not be liable for any losses, damages, or claims arising from: (a) the Controller's failure to comply with its obligations under the GDPR, the Clauses, or this DPA; (b) the Controller's instructions to the Processor that the Processor has complied with in good faith; (c) any data processing performed on the Controller's own devices or systems outside the Processor's cloud infrastructure; or (d) actions or omissions of the Controller's guests, event attendees, venue staff, contractors, or other data subjects.
4. The Controller shall indemnify and hold harmless the Processor from and against any claims, damages, losses, costs, and expenses (including reasonable legal fees) arising from or related to: (a) the Controller's breach of these Clauses, this DPA, or applicable data protection law; (b) the Controller's failure to obtain necessary consents or legal bases for processing; (c) the Controller's instructions that infringe applicable data protection law; or (d) any claim by a data subject or supervisory authority to the extent caused by the Controller's acts or omissions.

1. The Processor shall promptly notify the Controller of any data subject request received relating to Personal Data processed under this DPA. The Processor shall not respond to any such request directly unless expressly authorized by the Controller or required by applicable law.
2. The Controller shall be solely responsible for responding to data subject requests. The Processor shall provide reasonable assistance at the Controller's cost if such assistance requires effort beyond the Processor's standard self-service tools.

1. EEA transfers. Where Personal Data originating from the EEA is transferred outside the EEA, the Processor will ensure that such transfer is subject to appropriate safeguards under Chapter V GDPR (e.g., an adequacy decision where applicable, or the EU standard contractual clauses for international transfers adopted under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, together with supplementary measures as appropriate).
2. UK transfers (Addendum). Where the UK GDPR applies and UK-originating Personal Data is transferred outside the UK in a manner that is a “restricted transfer”, the parties agree that the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (the “UK Addendum”) is incorporated by reference and forms part of this DPA for that restricted transfer.
   Deemed Addendum selections (to the extent required):
   • Parties. Exporter/Importer details are as set out in Annex I (Controller as exporter; Processor as importer), as updated in the Controller’s account records.
   • Effective date. The effective date is the effective date of this DPA (date of first access/use of the Services by the Controller).
   • Appendix information. The Appendix/Annex information is as set out in Annex II–IV of this DPA.
   • Governing law/jurisdiction. For UK restricted transfers only, the governing law and jurisdiction for the UK Addendum (and any UK-specific mandatory provisions) will be the law and courts required by the UK Addendum to make the transfer lawful, and otherwise this DPA remains governed as stated below.
3. Swiss transfers. Where Swiss law applies and Swiss-originating Personal Data is transferred outside Switzerland in a manner requiring safeguards, the parties agree that the Clauses are deemed amended as necessary to comply with applicable Swiss data protection law, including: (i) references to the GDPR are interpreted to include the Swiss Federal Act on Data Protection (as applicable); and (ii) where required, the Swiss Federal Data Protection and Information Commissioner (FDPIC) is recognized as the competent authority for Swiss transfers.
4. Priority. To the extent the UK Addendum or Swiss mandatory amendments apply, they apply only to the relevant transfer and only to the minimum extent required by applicable law. Otherwise, the Clauses and this DPA remain unchanged.

1. Notice. If the Processor receives a legally binding request from a public authority (including law enforcement) for Personal Data processed under this DPA, the Processor will, to the extent permitted by applicable law, notify the Controller without undue delay. If the Processor is legally prohibited from notifying the Controller, the Processor will use reasonable efforts to seek permission to do so where appropriate.
2. Minimization. The Processor will, to the extent permitted by law, disclose only the minimum amount of Personal Data required to comply with the request and will limit disclosure to the extent reasonably necessary.
3. Challenge. Where permitted by law and reasonably appropriate, the Processor may challenge requests it reasonably believes are unlawful or overbroad. The Processor has no obligation to challenge any request, and will not be required to do so if it determines (acting reasonably) that a challenge would be unlikely to succeed, would create a material risk of violating law, or would create a material legal or operational risk for the Processor.
4. Cost recovery. The Controller shall reimburse the Processor for reasonable costs incurred in responding to such requests (including legal review) to the extent permitted by law and to the extent such response requires effort beyond standard operational handling.

1. Personal Data Breach. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed under this DPA.
2. Becoming aware. The Processor is deemed “aware” of a Personal Data Breach when it has confirmed that a breach has occurred that affects Personal Data processed on behalf of the Controller under this DPA. Alerts, anomalies, and security events that are not yet confirmed as a Personal Data Breach do not constitute awareness.
3. Notification mechanics. The Processor will notify the Controller without undue delay and, where feasible, within 72 hours after becoming aware, and may provide information in phases as it becomes available.

Except as set forth below, the Agreement and this DPA are governed by the laws of the State of New Jersey, USA, without regard to conflict of laws provisions, and disputes shall be submitted to the exclusive jurisdiction of the courts of the State of New Jersey, USA.

Clauses. The Clauses are governed by, and disputes arising from the Clauses shall be resolved in, the manner required by the Clauses and any mandatory provisions of applicable data protection law.

All notices under these Clauses and this DPA shall be in writing and sent by email to the contact addresses specified in Annex I (or as updated in the Controller’s account). Notices shall be deemed received on the business day following the date of transmission, provided no automated undeliverable/bounce notice is received.

1. To the maximum extent permitted by applicable law, any claim arising out of or in connection with this DPA or the Clauses must be brought within one (1) year after the date on which the claimant first became aware (or ought reasonably to have become aware) of the facts giving rise to the claim, regardless of when the cause of action accrued.
2. This limitation period applies to all claims whether in contract, tort, statute, or otherwise, except to the extent a shorter or mandatory longer period is imposed by applicable law that cannot be contractually reduced.
3. Mandatory rights carve-out. Nothing in this section limits or reduces any rights or claims that cannot be limited by the Clauses, mandatory data protection law, or (where applicable) any third-party beneficiary rights of data subjects under the Clauses.

Neither party shall be liable for any delay or failure to perform its obligations under this DPA (other than payment obligations) to the extent that such delay or failure is caused by circumstances beyond the party’s reasonable control, including but not limited to: natural disasters, acts of government, pandemics, war, terrorism, riots, civil unrest, embargoes, power or telecommunications failures, internet or network outages, cyberattacks (including DDoS attacks), or failures of third-party cloud infrastructure providers. The affected party shall notify the other party without undue delay and use reasonable efforts to mitigate the effects of the event.

The technical and organisational measures described in Annex III are provided on an "as-is" basis and represent the Processor’s current security posture as of the effective date. While the Processor commits to maintaining reasonable and appropriate measures, the Processor does not warrant or guarantee that these measures will prevent every security incident, data breach, or unauthorized access. No security system is infallible. The Processor’s obligation is to implement and maintain measures that are appropriate to the nature, scope, and risks of the processing, taking into account the state of the art, the costs of implementation, and the nature of the personal data processed.

1. Agreement controls. Termination rights, procedures, and refunds are governed by the Agreement. Nothing in this DPA grants a general right to terminate for convenience or expands refund obligations beyond what the Agreement provides.
2. Limited remedy. This section applies only where the Clauses (including Clause 7.7(a)) require the Processor to provide a termination remedy in connection with a sub-processor change objection that cannot be resolved within a reasonable period.
3. Notice. Where the limited remedy applies, the Controller may terminate the affected service(s) (or, if not separable, the Agreement) by providing 30 days’ prior written notice to the Processor.
4. Refunds. Any refund of prepaid fees (if any) will be handled in accordance with the Agreement, and in any event will not include amounts for periods already elapsed.
5. No additional damages. The Processor shall not be liable for any additional damages, compensation, or costs arising from the Controller’s decision to terminate under this limited remedy, except to the extent such limitation is prohibited by the Clauses or mandatory law.

1. The Controller shall notify the Processor without undue delay if the Controller becomes aware of any breach of this DPA, the Clauses, or applicable data protection law that may affect the processing of Personal Data by the Processor, including but not limited to: (a) unauthorized access to or compromise of the Controller’s account credentials; (b) a security incident on the Controller’s local devices or network that may have exposed Personal Data; or (c) any supervisory authority investigation, complaint, or enforcement action relating to the processing under this DPA.
2. The Controller shall cooperate with the Processor in good faith to mitigate the effects of any such incident and to comply with any applicable reporting obligations.