Data processing agreement
between the organizer who accepts this agreement in the admin area of Eventplanner (“controller”) and Benedikt Ulrich, Hornschuchpromenade 29, 90762 Fürth, Germany (“processor”).
1. Subject, duration, nature and purpose
The processor provides the controller with the platform Eventplanner for publishing events, collecting registrations, sending emails, check-in and statistics (see the terms of use). The processing comprises storage, organization, retrieval, transmission by email, display and deletion of personal data. The agreement applies for as long as the controller uses the platform.
2. Types of data and data subjects
- Attendees: name, email address, phone number, answers to custom questions, chosen date, amount, payment method and status, payment reference, check-in time, invitation preferences.
- Contacts: name and email address of people the controller wants to invite, consent confirmation, unsubscribe status, sent invitations.
- Admins of the controller: name, email address, language, sign-in data.
Special categories of personal data (Art. 9 GDPR) must not be collected via custom questions unless the controller has a legal basis for it.
3. Instructions
The processor processes personal data only on documented instructions of the controller – given by the controller’s configuration and use of the platform and by email – unless required to do so by Union or Member State law; in that case the processor informs the controller before processing, unless the law prohibits this. The processor informs the controller immediately if it believes an instruction infringes data protection law.
4. Confidentiality
Persons authorized to process the data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
5. Security of processing (Art. 32 GDPR)
The processor implements in particular the following technical and organizational measures:
- Encryption in transit (TLS/HTTPS for all connections, encrypted connections to database and email server).
- Hosting in ISO 27001 / SOC 2 certified data centres; database and file storage in the EU (Frankfurt).
- Strict separation of organizers (multi-tenancy): every access is limited to the data of the own organization.
- Passwords stored only as bcrypt hashes; limitation of failed sign-in attempts; email confirmation for new accounts; signed session cookies.
- Payment credentials of organizers stored with AES-256-GCM encryption.
- Links to registrations use random, non-guessable tokens.
- Data minimization: optional fields can be switched off; configurable automatic anonymization of attendee data after 6 or 12 months.
- Backups and point-in-time recovery provided by the database provider; deletion of the organization removes all its data.
- Regular updates of software dependencies.
6. Sub-processors
The controller authorizes the engagement of the following sub-processors:
- Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA – Hosting of the application, content delivery, storage of uploaded images and videos (Vercel Blob). Location: EU (Frankfurt) for storage; global edge network; USA (company seat). Safeguards: EU-U.S. Data Privacy Framework certification and EU Standard Contractual Clauses.
- Prisma Data, Inc., USA – Database hosting (Prisma Postgres, on AWS). Location: EU (Frankfurt, AWS eu-central-1). Safeguards: data stored in the EU; EU Standard Contractual Clauses for any access from the USA.
- Email provider (SMTP), to be specified – Sending of emails (confirmations, notifications, invitations). Location: to be specified. Safeguards: data processing agreement; EU location preferred.
The processor informs the controller at least 14 days in advance of any intended change of sub-processors (email or notice in the admin area). The controller may object for important data protection reasons; if no solution is found, both parties may terminate. The processor imposes the same data protection obligations on sub-processors by contract. Transfers to third countries take place only under the safeguards of Art. 44 et seq. GDPR.
Stripe and PayPal are not sub-processors: the controller contracts with them directly, and they act as independent controllers for payment data.
7. Assistance
Taking into account the nature of the processing, the processor assists the controller with appropriate measures in responding to data subject requests (the admin area offers search, export and deletion of all data of a person) and in complying with Art. 32 to 36 GDPR. Requests from data subjects that reach the processor are forwarded to the controller without undue delay.
8. Personal data breaches
The processor notifies the controller without undue delay, and where possible within 24 hours, after becoming aware of a personal data breach, providing the information available to it under Art. 33(3) GDPR.
9. Deletion and return
After the end of the service, the processor deletes all personal data of the controller. The controller can export its data (JSON) in the admin area at any time and delete its organization, which deletes all data immediately; backups are overwritten in the regular cycle of the database provider.
10. Audits
The processor makes available to the controller all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the controller or an auditor mandated by it, with reasonable advance notice and during normal business hours. Certificates of sub-processors may be provided instead where appropriate.
11. Liability and final provisions
Liability is governed by Art. 82 GDPR and the terms of use. In case of contradictions, this agreement takes precedence over the terms of use regarding data protection. German law applies.