Data Processing Agreement

Effective October 14, 2026 · Version 2026-10-14.2

In short: When organizers add information about their sponsors, vendors, team members and attendees, the organizer decides how it’s used, and we only process it to run the portal for them, under the safeguards below. This agreement is part of the Terms of Service and applies automatically.

1. Roles

This Data Processing Agreement (“DPA”) is part of the Terms of Service between Partner4Events LLC (“Processor”, “we”) and the organizer that uses the Service (“Controller”, “you”). It applies to personal information you add to the Service about other people (“Customer Personal Data”). Under US state privacy laws such as the CCPA, we act as your “service provider” or “processor”; under the GDPR and UK GDPR, as your “processor”.

2. What we process and why

• People: contacts at sponsors and vendors, your team members, attendees and anyone else you add.
• Information: names, email addresses, phone numbers, job titles, company details, files and messages, signatures, and invoice details.
• Purpose: only to provide the Service to you, as described in the Terms and following your instructions (which include your use of the portal’s features).
• Duration: for as long as you use the Service, then deleted as described in section 8.

3. Our commitments

• Process Customer Personal Data only on your documented instructions, and tell you if we believe an instruction breaks the law.
• Not sell or share it, not use it for our own purposes or advertising, and not combine it with other data except as allowed by law to provide the Service.
• Make sure everyone who can access it is bound by confidentiality.
• Support personnel may access Customer Personal Data only when you grant access. Once granted, access will expire in 24 hours. Access is limited to the single event you choose, never includes your attendee records, can be ended by you at any time, and every time we open it is recorded where you can see it.
• Keep appropriate technical and organizational security measures in place (section 5).
• Help you respond to requests from people exercising their privacy rights, and with security, breach notification and impact assessments, as reasonably needed.
• Give you the information needed to show we follow this DPA.

4. Your commitments

You confirm that you have a lawful basis and any notices or consents needed to add Customer Personal Data to the Service and to have us process it, and that your instructions comply with the law.

5. Security measures

• Encryption in transit (HTTPS) and encryption at rest by our hosting providers.
• Each organization’s data is kept separate and access is checked on every request.
• Two-step sign-in required for our admins and available to every organizer.
• No standing access for our staff: an organizer’s data is readable only through a grant they open themselves, scoped to one event and expiring within 24 hours.
• Bot protection on sign-in forms, and access to production systems limited to people who need it.
• Backups and the ability to restore data.

6. Subprocessors

You authorize us to use the subprocessors below. Each is bound by data protection terms at least as protective as this DPA. We’ll post changes here at least 30 days in advance; if you object on reasonable data protection grounds, you may close your account and receive a prorated refund of any prepaid, unused fees.

7. Security incidents

If we become aware of a breach of security leading to unauthorized access to, or loss of, Customer Personal Data, we’ll notify you without undue delay (and within 72 hours where possible), with the information you need to meet your own obligations, and take reasonable steps to contain it.

8. Deleting data

You can export your data at any time. When your account closes we delete Customer Personal Data within 30 days, and from backups within their normal cycle, unless the law requires us to keep it.

9. International transfers

Customer Personal Data is stored in the United States. Where the GDPR or UK GDPR applies to a transfer, the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum are incorporated into this DPA by reference.

10. Order of precedence

If this DPA conflicts with the Terms of Service about Customer Personal Data, this DPA applies. If you need a countersigned copy, email info@partner4events.com.

Partner4Events LLC · info@partner4events.com