Data processing agreement

1. Scope

1.1 This data processing agreement is between EventDrake Limited (EventDrake, we or us) and the business that uses the service under our terms of service (you). It forms part of the terms, and you accept it when you accept them.

1.2 Words defined in the terms have the same meaning here. In particular:

the service is the EventDrake platform as the terms describe it;
a tenant is your own space within the service;
an attendee is a person who books, buys, registers or is booked through your tenant; and
customer data is everything inside your tenant.

1.3 Personal data means any information in customer data about an identified or identifiable person. It includes personal information under New Zealand and Australian privacy law.

1.4 Data protection law means the privacy and data protection laws that apply to the processing of customer data, which may include the Privacy Act 2020 (New Zealand), the Australian Privacy Principles, the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act (CCPA) and similar US state laws.

1.5 This agreement applies whenever we process personal data in customer data for you. If it conflicts with the terms about personal data, this agreement applies. Otherwise, the order of precedence in clause 21.3 of the terms applies.

1.6 If you need a signed copy of this agreement, ask us at hello@eventdrake.net and we will countersign one.

2. Roles

2.1 For customer data, you are the controller and we are your processor. Under US state laws, we are your service provider or contractor.

2.2 If you process customer data as a processor for someone else, we are your sub-processor, and you are responsible for passing on to us any instructions from that controller.

2.3 You are responsible for having a lawful basis for collecting and processing personal data through the service, and for giving attendees the notices that data protection law requires.

2.4 Data about you as our customer (platform data) is not covered by this agreement. We are its controller, and our privacy policy covers it.

3. Our instructions

3.1 Documented instructions. We process customer data only on your documented instructions, including for transfers of personal data to other countries. The terms, this agreement and the way you configure and use the service are your instructions. Any other instruction must be in writing.

3.2 Where the law requires otherwise. If the law requires us to process customer data in some other way, we will tell you before we do, unless that law forbids it.

3.3 Unlawful instructions. We will tell you immediately if we think an instruction breaks data protection law. We don’t have to follow that instruction while we work it out with you.

3.4 Confidentiality. Everyone we authorise to process customer data, including our staff and contractors, is bound by a duty of confidentiality.

3.5 Requests from authorities. If a court, regulator, law enforcement agency or other public authority asks us for customer data, we will tell you about the request, unless the law forbids us to. We will ask the authority to go to you directly where we can. We will challenge a request we reasonably consider overbroad or unlawful, and we will disclose only the minimum the request requires.

4. Security

4.1 We will put in place and maintain the technical and organisational measures in Annex 2 to protect customer data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

4.2 We may change those measures over time, but we won’t reduce the overall level of protection.

4.3 You are responsible for the security of the parts of the service you control, including who has admin access to your tenant, how your admins keep their sign-in details safe, and whether they use multi-factor authentication.

5. Sub-processors

5.1 General authorisation. You authorise us to use the sub-processors listed on our sub-processors page, and to appoint new ones under this clause.

5.2 Notice of changes. We will give you 30 days’ notice before we add or replace a sub-processor, by email to your tenant’s account owner through the hub. The sub-processors page is updated at the same time.

5.3 Objections. From our notice, you have 14 days to object to a change on reasonable data protection grounds by telling us at hello@eventdrake.net. We will work with you in good faith to resolve the objection. If we can’t, you can terminate your account before the change takes effect, and we will refund any fees you have prepaid for the period after termination.

5.4 Written terms. Each sub-processor is bound by a written contract that gives customer data the same level of protection as this agreement.

5.5 Our responsibility. We stay responsible to you for the work of our sub-processors as if it were our own.

6. Assistance

6.1 Requests from individuals. You can export attendee data through the CSV reports in the admin. If we receive a request from an individual about customer data, we will pass it to you and won’t answer it ourselves unless you ask us to. We will help you respond to requests you can’t deal with through the service.

6.2 Assessments and regulators. We will give you reasonable help with data protection impact assessments and any consultation with a regulator about the processing, using the information available to us.

6.3 Costs. Help that is extensive or goes beyond what the service normally provides may be charged at a reasonable cost, which we will agree with you first.

7. Personal data breaches

7.1 A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data in customer data.

7.2 We will tell you about a personal data breach without undue delay, and in any case within 72 hours of becoming aware of it, by email to your tenant’s account owner.

7.3 So far as we know them at the time, our notice will describe:

the nature of the breach, including the categories and approximate number of people and records concerned;
who to contact for more information;
the likely consequences of the breach; and
the measures we have taken or propose to take to deal with it and reduce its effects.

7.4 Where we can’t give all of this at once, we will give it in stages as we learn more.

7.5 We will help you meet any obligation you have to notify a regulator or the affected individuals. Telling you about a breach is not an admission of fault.

8. Return and deletion

8.1 While your tenant is active. Orders stay in your tenant as booking history for as long as you keep the tenant. You can ask us to delete transaction records older than 7 years, and we will do this by hand.

8.2 Export window. For 30 days after your account ends (the export window), you can get your customer data through the CSV reports in the admin, or ask us for a manual export. If your account was suspended when it ended, we will prepare a manual export on request, as clause 19.4 of the terms sets out.

8.3 Deletion. We delete everything else in your tenant within 90 days after the export window ends.

8.4 Transaction records. We keep the transaction records from your tenant, and the customer and attendee details tied to them, for 7 years after your account ends, and then delete them. We keep them on two grounds:

on your behalf, so that you and your attendees can still get records of past bookings. By accepting the terms, you instruct us to keep them for this purpose; and
as our own records, under our legitimate interests, because our fees are calculated from your orders and we need the records to verify our billing, to prevent fraud, and to deal with disputes and liability. For this purpose we hold them as controller, under our privacy policy.

8.5 Logs. Logs that may contain personal data are kept for up to 365 days, then deleted.

8.6 Backups. Individual records inside a backup can’t be corrected or deleted. Corrections and deletions are made to live data, and backups expire on their normal schedule. Today, backups are kept for up to 365 days. Backups holding transaction records may be kept for up to 7 years.

8.7 Restores. If we ever restore data from a backup, we re-apply the corrections and deletions made since that backup was taken.

9. Audits

9.1 On request, we will give you the information you reasonably need to show that we meet this agreement, starting with our security documentation and answers to your security questionnaire.

9.2 You can carry out an on-site audit, or have an independent auditor do it for you, only if data protection law requires it or a personal data breach makes it necessary. On-site audits:

happen no more than once a year;
need 30 days’ written notice;
are carried out during business hours, without disrupting the service or other customers, under a duty of confidentiality; and
are at your cost.

10. International transfers

10.1 Data regions. Each tenant is created in one data region, and customer data is stored in that region. The regions, and the cases where data is accessed or processed outside them, are set out in the privacy policy.

10.2 European Union region. Customer data in a tenant in the European Union region is stored in the European Union. Each case where it is accessed or processed elsewhere is named in the privacy policy with its safeguard. Those cases are:

our staff in New Zealand, covered by the European Union and United Kingdom adequacy decisions for New Zealand;
the hub in Sydney, which holds account data only;
global edge services run by Amazon Web Services, which handle only limited operational data, under the Standard Contractual Clauses; and
each sub-processor outside the European Union, under the Standard Contractual Clauses.

We don’t use Anthropic’s tools with customer data from this region except through Amazon Bedrock in a European Union region.

10.3 Standard Contractual Clauses. Where personal data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in 2021 apply and are incorporated into this agreement by reference. Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) applies where you are a processor. You are the data exporter and we are the data importer. These choices apply:

Clause 7 (docking clause): included.
Clause 9 (sub-processors): option 2, general written authorisation, with 30 days’ notice of changes as clause 5 of this agreement sets out.
Clause 11 (redress): the optional language is not used.
Clause 13 (supervision): the supervisory authority of the member state where you are established or, if you are not established in the European Union, where your representative is. If neither applies, the Irish Data Protection Commission.
Clauses 17 and 18 (governing law and courts): the law and courts of Ireland.
Annexes: Annex I is completed with the parties above and Annex 1 of this agreement, Annex II with Annex 2, and Annex III with Annex 3.

10.4 United Kingdom. For personal data subject to the UK GDPR, the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner (the UK Addendum) applies. It is governed by English law.

10.5 Switzerland. For personal data subject to the Swiss Federal Act on Data Protection, the Standard Contractual Clauses apply with the Swiss adjustments: references to the GDPR are read as references to that Act, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, and people in Switzerland can bring claims in Switzerland.

10.6 Conflicts. If the Standard Contractual Clauses or the UK Addendum conflict with this agreement, they prevail.

10.7 Governing law. The Standard Contractual Clauses, the UK Addendum and the Swiss adjustments apply only to personal data subject to European Union, United Kingdom or Swiss data protection law. The Standard Contractual Clauses must be governed by the law of a European Union member state, which is why they name Ireland. Everything else in this agreement and in the terms, including the agreement with every customer whose data is not part of those transfers, is governed by New Zealand law, as clause 21 of the terms sets out.

11. US state privacy laws

11.1 Where the CCPA or a similar US state law applies to customer data, we act as your service provider or contractor. We:

don’t sell or share customer data, as those laws define selling and sharing;
don’t keep, use or disclose customer data for any purpose other than the business purpose of providing the service to you, or outside our direct business relationship with you;
don’t combine customer data with personal information we receive from anyone else or collect ourselves, except as those laws allow;
comply with the obligations those laws place on us, and give customer data the same level of privacy protection they require of you;
will tell you if we can no longer meet our obligations under those laws; and
allow you to take reasonable and appropriate steps to stop and fix any unauthorised use of customer data.

11.2 We certify that we understand the restrictions in this clause and will comply with them.

12. Liability

12.1 Each party’s liability under or in connection with this agreement is subject to the limits and exclusions in clause 17 of the terms.

12.2 Nothing in this agreement limits the rights that individuals have under the Standard Contractual Clauses or data protection law.

13. Annex 1: the processing

13.1 Subject matter. Providing the service to you under the terms.

13.2 Duration. For as long as you use the service, then until customer data is deleted under clause 8. Transaction records are kept for 7 years after your account ends.

13.3 Nature and purpose. Hosting and storing customer data; running your event sites, bookings, orders and payments through your own Stripe account; sending email on your behalf; check-in, badges and on-site tools; support, security, monitoring, troubleshooting and backups; and anything else you instruct through the service.

13.4 Frequency. Continuous, while you use the service.

13.5 Data subjects.

Attendees, including people booked by someone else.
Your staff, admins and volunteers.
Visitors to your event sites.

13.6 Categories of personal data.

Contact details, such as email address and phone number.
Legal name, badge name and preferred name.
Date of birth.
Pronouns, where provided.
Answers to the questions you set up.
Orders, tickets and payment status. Card details go directly to Stripe and are not held in the service.
Check-in and badge records.
Technical data and logs, such as IP addresses, browser details and timestamps.

13.7 Special categories of data. Your questions may collect sensitive data, such as dietary, medical or accessibility needs. You are responsible for having a lawful basis to collect it and for collecting only what your event needs.

14. Annex 2: security measures

14.1 We protect customer data with these measures, among others:

customer data is encrypted in transit and at rest;
each tenant has its own separate login pool;
admin access is role-based, so each admin sees only what their role allows;
multi-factor authentication is available to tenant admins and required for our staff;
databases have point-in-time recovery, and backups are copied to the backup location paired with the tenant’s data region; and
logs are kept for up to 365 days to investigate problems and security events.

15. Annex 3: sub-processors

15.1 Our current sub-processors, what each one does, and where it processes data are listed on our sub-processors page. That list forms part of this agreement and changes only under clause 5.