Data Processing Agreement (DPA)

ARTICLE 1: DEFINITIONS AND SCOPE

1.1 Definitions

• "Personal Data," "Data Subject," "Processing," and "Data Controller" have the meanings set forth in applicable data protection laws, including GDPR and CCPA
• "Services" means the ticketing and event management services provided through the Platform

1.2 Scope

This DPA applies when Event Host acts as Data Controller and Company acts as Data Processor for ticket sales and related transactions.

ARTICLE 2: DATA PROCESSING DETAILS

2.1 Subject Matter and Purpose

Processing of Personal Data for ticket sales, event management, and related customer service activities.

2.2 Categories of Data Subjects

• Ticket purchasers
• Event attendees
• Customer service contacts

2.3 Categories of Personal Data

• Contact information (name, email, phone)
• Payment information (processed through third-party payment processors)
• Ticket preferences and purchase history
• Communications with customer service

2.4 Processing Activities

• Ticket sales processing
• Order confirmation and delivery
• Customer support
• Refund processing
• Event-related communications

ARTICLE 3: PROCESSOR OBLIGATIONS

3.1 Processing Instructions

Processor will process Personal Data only on documented instructions from Controller, including this DPA and the Terms of Service.

3.2 Confidentiality

Processor ensures that persons authorized to process Personal Data are bound by confidentiality obligations.

3.3 Security Measures

Processor implements appropriate technical and organizational measures to ensure security of Personal Data, including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Incident response procedures

3.4 Sub-Processors

Processor may engage sub-processors (including payment processors) with Controller's general authorization. Current sub-processors are listed in Schedule A.

ARTICLE 4: DATA SUBJECT RIGHTS

4.1 Assistance with Rights Requests

Processor will assist Controller in responding to Data Subject requests for access, rectification, erasure, restriction, portability, and objection.

4.2 Response Timeframe

Processor will respond to Controller's requests for assistance within 10 business days.

ARTICLE 5: DATA BREACHES

5.1 Notification

Processor will notify Controller without undue delay (and in any event within 24 hours) upon becoming aware of a Personal Data breach.

5.2 Assistance

Processor will provide reasonable assistance to Controller in meeting breach notification obligations.

ARTICLE 6: DATA TRANSFERS AND RETENTION

6.1 International Transfers

Any transfers of Personal Data outside the EEA will be subject to appropriate safeguards.

6.2 Data Retention

Processor will retain Personal Data only as long as necessary for the Services or as instructed by Controller, but no longer than 7 years after final transaction.

6.3 Data Return/Deletion

Upon termination, Processor will delete or return Personal Data as instructed by Controller within 30 days.

ARTICLE 7: AUDITS AND COMPLIANCE

7.1 Audit Rights

Controller may audit Processor's compliance with this DPA upon reasonable notice.

7.2 Compliance Documentation

Processor will make available information necessary to demonstrate compliance with this DPA.

ARTICLE 8: LIABILITY AND INDEMNIFICATION

8.1 Limitation

Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service.

8.2 Data Protection Violations

Processor will indemnify Controller for damages resulting from Processor's violation of applicable data protection laws.

SCHEDULE A: SUB-PROCESSORS

The current list of authorized sub-processors is maintained at Sub-Processors.