Data processing agreement

1. Parties and roles

• The controller: the business or organization that uses EventOS ("you").
• The processor: Codiix, Kamstraat 6, 1670 Pepingen, Belgium, enterprise number BE0791.723.106 ("Codiix").

Terms such as "personal data", "processing", "controller", "processor", "sub-processor" and "personal data breach" have the meaning given in the General Data Protection Regulation (EU) 2016/679 ("GDPR").

2. Subject matter and duration

Codiix processes personal data for you to provide EventOS as described in the terms of service. This agreement applies for as long as Codiix processes personal data for you, including the period after the end of the subscription until the data is deleted.

3. Nature, purpose and data

Nature and purpose: hosting and showing booking pages, receiving and managing reservations, managing capacity, sending transactional emails, check-in, exports and support.

Data subjects: your guests and your team members.

Categories of personal data:

• guests: first and last name, email address, phone number (if the event asks for it), group size, preferred language, booking reference, reservation status and check-in times, notes you add yourself, and the emails sent to them;
• team members: name, email address and role;
• technical data: IP addresses, kept temporarily (at most 1 day) to prevent abuse.

EventOS is not designed for special categories of personal data (such as health data). You will not enter them.

4. Your instructions

Codiix only processes personal data on your documented instructions. The terms of service, this agreement and the way you configure and use EventOS are your complete instructions. Codiix does not use the data for its own purposes.

If Codiix believes an instruction breaks the GDPR or other data protection law, it tells you. If the law obliges Codiix to process data in another way, it tells you beforehand, unless the law forbids that.

5. Confidentiality

Codiix ensures that everyone who has access to the personal data is bound by confidentiality and only accesses the data as far as needed for the service, support or maintenance.

6. Security

Codiix takes appropriate technical and organizational measures to protect the personal data, taking into account the state of the art, the costs and the risks. The current measures are listed in Annex 1. Codiix may improve them, as long as the level of protection does not decrease.

7. Sub-processors

You give Codiix general permission to use sub-processors. The current sub-processors are listed in Annex 2.

Codiix informs you by email at least 30 days before adding or replacing a sub-processor. You can object on reasonable data protection grounds. If we cannot find a solution together, you can end your subscription before the change takes effect.

Codiix imposes the same data protection obligations on its sub-processors as in this agreement and remains responsible towards you for them.

8. Transfers outside the EEA

Codiix only transfers personal data outside the European Economic Area, or allows a sub-processor to do so, if appropriate safeguards are in place as required by chapter V of the GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

9. Assistance

EventOS lets you view, correct, export and delete guest data yourself, so you can answer requests from data subjects. If a data subject contacts Codiix directly, Codiix forwards the request to you without delay and does not answer it itself unless you ask.

Where reasonable, Codiix also helps you with data protection impact assessments, prior consultations with a supervisory authority and your security obligations, taking into account the information available to Codiix.

10. Personal data breaches

Codiix informs you without undue delay, and at the latest within 48 hours after becoming aware of it, of a personal data breach that affects your data. Codiix gives you the information it has so you can meet your own obligations to report it, and takes reasonable measures to limit the consequences.

11. Deletion and return

You can export your reservations at any time. At the end of the service, or on your request, Codiix deletes the personal data within 30 days, unless the law requires it to be kept. Copies in backups are removed in the regular backup cycle, at most 30 days later.

12. Audits

Codiix gives you the information needed to show that it complies with this agreement. If that is not enough, you can have an audit carried out at most once a year, with at least 30 days' notice, during business hours, at your own cost and by an auditor bound by confidentiality. The audit may not affect the security of other customers.

13. Liability and precedence

The limits of liability in the terms of service also apply to this agreement, as far as the GDPR allows. If this agreement and the terms of service conflict on the protection of personal data, this agreement prevails.

Annex 1 · Technical and organizational measures

• Encrypted connections (HTTPS/TLS) for all traffic; storage encrypted at rest by the hosting provider.
• Strict separation of organizations enforced in the database (row-level security), covered by automated tests.
• Guests have no direct access to tables: they can only use limited functions that never show other guests' data, capacity or occupancy.
• Role-based access within an organization (owner, admin, check-in staff); billing and plan fields cannot be changed by members.
• Passwords stored only as secure hashes by the authentication provider.
• Rate limiting and protection against duplicate bookings.
• Secret keys only on the server, never in the browser.
• A log of important actions per organization.
• Daily backups by the hosting provider.
• Access by Codiix staff limited to what is needed for support and maintenance.

Annex 2 · Sub-processors

• Supabase Inc.: database, authentication and file storage. Location of data: EU.
• Hostinger International Ltd.: hosting of the application. Location: EU.
• Resend (Plus Five Five, Inc.): delivery of transactional emails. United States, with Standard Contractual Clauses.
• Stripe Payments Europe Ltd.: subscription payments of the controller (only billing data of the business, no guest data). Ireland, with transfers to the United States under the safeguards of section 8.