This Data Processing Agreement (“DPA”) forms part of the agreement between Evengage Ltd, trading as EventGen (“EventGen”, “Processor”, “we”) and the Customer using the Platform (“Customer”, “Controller”, “you”). It applies where we process Customer Personal Data on your behalf.

1. Definitions and precedence

“Applicable Data Protection Law” means the UK GDPR, Data Protection Act 2018, EU GDPR where applicable, PECR and any binding replacement or implementing law. “Customer Personal Data” means personal data contained in Customer Content that we process as Processor. “Sub-processor”, “Personal Data Breach”, “processing” and related terms have the meanings given by Applicable Data Protection Law.

If this DPA conflicts with the Terms on protection of Customer Personal Data, this DPA prevails. An Order may vary this DPA only if it expressly identifies the agreed variation.

2. Roles and instructions

Customer is Controller and EventGen is Processor, except where either party acts as an independent controller for its own lawful purposes. We will process Customer Personal Data only on documented instructions contained in the agreement, Customer’s configuration and authorised use of the Platform, unless law requires otherwise. We will inform Customer if an instruction appears unlawful unless prohibited by law.

Customer warrants that its instructions, collection, use and disclosure of Customer Personal Data comply with law and that it has provided required notices and established an appropriate lawful basis. Customer determines whether special-category, criminal-offence or children’s data may lawfully and proportionately be processed.

3. Confidentiality and personnel

We will ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations, receive proportionate data-protection and security guidance, and access data only as necessary for their role.

4. Security

Taking account of the state of the art, implementation costs and processing risk, we will maintain appropriate technical and organisational measures, including access controls, tenant and event scoping, encryption in transit, protected credential storage, resilient hosting and backups, logging, vulnerability and dependency management, incident response and secure development practices. Customer remains responsible for Account access, endpoint security, lawful configuration, exports and connected providers under its control.

5. Sub-processors

Customer gives general written authorisation for the Sub-processors listed at eventgen.ai/subprocessors. We will require each Sub-processor to protect Customer Personal Data to a standard materially consistent with this DPA and remain responsible for its performance to the extent required by law.

We will publish or notify material additions or replacements. Customer may object within 14 days on reasonable data-protection grounds, explaining the specific risk. We will consider the objection in good faith and may offer a reasonable mitigation or alternative. If no commercially reasonable solution is available, either party may terminate only the affected service; Customer’s sole remedy is a prorated refund of prepaid fees for that unavailable service.

6. International transfers

Where processing causes a restricted transfer, the parties will rely on an applicable adequacy regulation or legally recognised transfer mechanism. The UK International Data Transfer Addendum to the EU Standard Contractual Clauses is incorporated where required for UK transfers. For EU GDPR transfers, the applicable 2021 EU Standard Contractual Clauses are incorporated using the module matching the parties’ roles. The agreement and Annexes below complete the relevant appendices. If a valid successor mechanism is required, it applies automatically to the minimum extent necessary.

7. Data-subject requests

Taking account of the nature of processing, we will provide reasonable technical and organisational assistance for Customer to respond to data-subject requests. If a request relates principally to Customer Personal Data, we may direct the requester to Customer. Unless caused by our breach, unusual or disproportionate assistance may be charged at our then-current professional-services rate after notice.

8. Compliance assistance

We will provide information reasonably necessary to demonstrate compliance with processor obligations and reasonable assistance with security, breach notifications, DPIAs and regulator consultations, taking account of the processing and information available to us. Assistance beyond standard documentation and Platform functionality may be chargeable where permitted by law.

9. Personal Data Breaches

We will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data. The notice will include available information reasonably needed by Customer to assess notification duties. We may provide information in phases. Notification is not an admission of fault. Customer is responsible for notifications required of it as Controller.

10. Return and deletion

During the subscription, Customer may use available export and deletion features. Following verified Account closure or termination and any notified retrieval period, we will delete or return Customer Personal Data within a reasonable operational period unless law requires retention. Data may remain in protected backups until overwritten under the normal backup cycle and will not be restored except for continuity or recovery.

11. Audits

We will first satisfy audit requests through current policies, certifications, summaries, questionnaires and other standard evidence. If that is insufficient and law requires further audit, Customer may conduct one audit per year on at least 30 days’ notice, during business hours, through an independent auditor bound by confidentiality. Audits must avoid access to other customers’ data and unreasonable disruption. Customer bears its costs and our reasonable assistance costs unless the audit identifies a material breach by us.

12. Liability and termination

Liability under this DPA is subject to the exclusions and limits in the Terms to the fullest extent permitted by law. Expiry or termination of the main agreement terminates this DPA, except provisions intended to survive.

Annex 1: Processing details

Subject matter: provision, security, support and improvement of the EventGen Platform as instructed by Customer.

Duration: the agreement term plus the deletion and lawful-retention period.

Nature and purpose: collection, storage, organisation, retrieval, display, transmission, communications delivery, analysis, matching, export, deletion and other operations selected by Customer.

Data subjects: organisers, authorised users, registrants, attendees, invitees, speakers, exhibitors, sponsors, suppliers, staff, contacts and other individuals whose data Customer submits.

Data categories: identity and contact data; organisation and role; registration and profile responses; attendance, session and meeting records; communications and preferences; orders and payment status; portal and usage activity; photos, documents and custom fields; accessibility, dietary or other special-category data only if Customer chooses to collect it.

Frequency: continuous or as initiated by Customer and data subjects.

Annex 2: Security measures

Role-based and scoped access with least-privilege administrative access.
Encryption in transit and provider-supported encryption at rest.
One-way adaptive password hashing and protected secret storage.
Tenant/event scoping, audit logging and security monitoring.
Backups, recovery procedures and availability safeguards.
Secure development, dependency management and change control.
Incident handling, breach escalation and personnel confidentiality.
Sub-processor diligence and contractual safeguards.

Contact

Evengage Ltd, trading as EventGen
Company number 16480174
129 Little Bushey Lane, Bushey, England, WD23 4SB
privacy@eventgen.ai