Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Evie Software Ltd (“Processor”, “we”) and the Business (“Controller”, “you”). It applies where we process personal data about your Attendees on your behalf, and reflects Article 28 of the UK GDPR.

1. Roles

You are the controller and we are the processor of the Attendee personal data processed through the Service. You are responsible for the lawfulness of the collection and sharing of that data with us and for providing your Attendees with the required privacy information.

2. Scope of processing

Subject matter	Provision of the EvieBooking booking and payment Service.
Duration	For the term of the Terms of Service and any agreed retention period thereafter.
Nature and purpose	Hosting, storing, organising, transmitting and otherwise processing Attendee data to operate bookings, payments, communications and reporting.
Types of personal data	Names, contact details, booking details, custom form answers, attendance records, marketing preferences and transaction references.
Categories of data subjects	Your Attendees and end customers.

3. Our obligations as processor

We will:

• process personal data only on your documented instructions (including as set out in the Terms and your use of the Service), unless required by law;
• ensure persons authorised to process the data are bound by confidentiality;
• implement appropriate technical and organisational security measures;
• engage sub-processors only under section 4;
• taking into account the nature of processing, assist you with responding to data subject rights requests through the features of the Service (such as data export and erasure);
• assist you with security, breach notification and data protection impact assessments, taking into account the information available to us;
• notify you without undue delay after becoming aware of a personal data breach affecting your data; and
• on termination, delete or return the personal data at your choice, save where retention is required by law.

4. Sub-processors

You give general authorisation for us to engage sub-processors to provide the Service (for example our payment, email delivery and hosting providers). We impose data protection obligations on our sub-processors that are no less protective than this DPA, and we remain responsible for their performance. A current list of sub-processors is available on request, and we will give you a reasonable opportunity to object to a new sub-processor.

5. International transfers

We will not transfer your Attendee data outside the UK/EU except where an appropriate transfer mechanism is in place (such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses).

6. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, subject to reasonable notice, confidentiality and frequency limits.

7. Liability and precedence

The limitations of liability in the Terms of Service apply to this DPA. If there is a conflict between this DPA and the rest of the Terms in relation to the processing of Attendee personal data, this DPA prevails.

8. Contact

Data protection enquiries: [email protected], Evie Software Ltd, [REGISTERED OFFICE ADDRESS].