Data Processing Addendum

This DPA applies to personal data of Controller's end users that EventCloud processes as a processor to provide the services.

EventCloud will: (a) process personal data only on documented instructions from Controller; (b) ensure persons authorised to process the data have committed to confidentiality; (c) implement appropriate technical and organisational measures; (d) assist Controller with data-subject requests; (e) notify Controller without undue delay after becoming aware of a personal data breach.

Controller authorises EventCloud's use of sub-processors listed on our trust page. We will give 30 days' notice of new sub-processors and Controller may object on reasonable grounds.

Where personal data is transferred outside the EEA, UK, or Switzerland, EventCloud will rely on the EU Standard Contractual Clauses (and UK Addendum / Swiss equivalent), incorporated by reference.

EventCloud will make available information necessary to demonstrate compliance and allow audits, including inspections, by Controller or an auditor mandated by Controller, subject to reasonable confidentiality and notice.

On termination, EventCloud will, at Controller's choice, return or delete personal data, unless retention is required by law.

Each party's liability under this DPA is subject to the limitations in the Terms of Service.

To countersign this DPA, email legal@myeventcloud.com with your company name and Controller representative details. We will return a signed copy within 5 business days.