Data processing agreement

Draft for review. This text has not been checked by a lawyer yet; replace the parts in [brackets] before publishing.

This summary describes how [COMPANY NAME] (“processor”) handles personal data for the venue (“controller”) under Article 28 GDPR. The full agreement is [linked here / sent on request].

What we process

Guest names, notes, invitations, confirmations and check-ins.
Staff names, emails and roles; team chat messages.

How

Only to run GuestlistX for the venue, on the venue’s instructions.
Names, notes and chat are encrypted before storage; keys are held in Google Cloud KMS.
Stored in the EU (Frankfurt). Sub-processors: Google Cloud (hosting), Apple (push notifications), [payment provider].
Staff with access to production data are bound by confidentiality.

Deletion and help

Data is deleted when the venue deletes it, after the retention period it sets, or within [30] days after the account ends. We help the venue answer data subject requests and tell it without undue delay about any personal data breach.