Data Processing Agreement

1. Definitions

• GDPR: Regulation (EU) 2016/679 and the UK GDPR as retained by the Data Protection Act 2018.
• Personal Data: any information relating to an identified or identifiable natural person that the Controller enters into the Service — for example the Controller's clients, suppliers, employees, and event attendees.
• Processing: as defined in GDPR Article 4(2).
• Sub-processor: a third party engaged by the Processor to carry out Processing on behalf of the Controller.

2. Roles and scope

The Controller determines the purposes and means of the Processing of Personal Data uploaded to the Service. The Processor processes that data solely on the Controller's documented instructions — meaning: to provide the Service in the manner described in the Terms, and for no other purpose.

3. Subject-matter, duration, nature, categories

• Subject-matter: hosting and processing of the Controller's business data (events, clients, suppliers, quotes, invoices, contracts, employees, uploaded documents) to enable the Controller to run their event / property / DJ / hospitality operation.
• Duration: for as long as the Controller's account is active or in the 12-month paused retention window — see Privacy Policy §6.
• Nature and purpose: SaaS delivery — storage, retrieval, indexing, PDF generation, email/WhatsApp sending on behalf of the Controller, backup, restore.
• Categories of data subjects: Controller's clients, suppliers, employees, event attendees, and any third parties whose data the Controller enters.
• Categories of Personal Data: contact details (name, address, email, phone), fiscal identifiers (VAT, codice fiscale, IBAN), event details, transaction records, uploaded documents (which may contain identity data if the Controller uploads them).

4. Processor's obligations (GDPR Article 28)

• Process Personal Data only on the Controller's documented instructions — including for transfers to a third country — unless required to do so by EU or Member-State law. If so required, the Processor will inform the Controller before processing, unless the law prohibits such notice on public-interest grounds.
• Ensure persons authorised to process the Personal Data are bound by confidentiality.
• Implement appropriate technical and organisational measures — see §7.
• Engage Sub-processors only under §5.
• Assist the Controller in fulfilling data-subject requests (access, rectification, erasure, portability, restriction, objection) via the Service's built-in export and deletion tools.
• Assist the Controller with security notifications, DPIAs, and prior consultations under GDPR Articles 32–36.
• At the Controller's choice, delete or return all Personal Data at the end of the Service, unless retention is required by law. The Controller's built-in "Delete my account" flow triggers deletion at any time; otherwise deletion happens automatically 12 months after the account becomes paused.
• Make available to the Controller all information necessary to demonstrate compliance with Article 28 and allow for audits (see §9).

5. Sub-processors

The Controller grants a general authorisation for the Processor to engage Sub-processors. The current list is:

• Railway (railway.com): application hosting, database hosting, backups. EU / US regions depending on Controller location.
• Stripe (stripe.com): payment processing, subscription lifecycle. Bound by their own DPA and Standard Contractual Clauses.
• Stripe Tax: tax calculation on subscription invoices.
• SMTP provider configured by the Processor (or by the Controller in their own settings): transactional email delivery.
• WhatsApp / Meta Cloud API: WhatsApp messaging on the Controller's behalf, when the Controller has connected their own WhatsApp Business account.
• HERE Technologies: geocoding and route distance calculation for departure-base pricing.
• Google Fonts: typography on the marketing website only. Serves the Processor, not customer data.
• Google Gemini: AI generation for blog posts, campaign copy, ID-scan extraction — only invoked on Controller-initiated requests, output returned to the Controller, no long-term storage of Personal Data by the model.

The Processor will notify the Controller by email at least 30 days before adding or replacing a Sub-processor. The Controller may object on reasonable data-protection grounds; if the parties cannot agree, the Controller may terminate the Service and receive a pro-rata refund of any prepaid, unused subscription fees.

6. International transfers

Where a Sub-processor is located outside the UK / EEA, transfers are covered by:

• The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum, incorporated by reference; or
• An adequacy decision of the European Commission or the UK Government.

7. Security (GDPR Article 32)

The Processor implements appropriate technical and organisational measures including:

• TLS in transit; encrypted-at-rest storage for identity-document scans (ID_ENCRYPTION_KEY, AES-256-GCM).
• bcrypt password hashing with per-user salt.
• JWT session tokens with server-side revocation.
• Role-based access control (Creator, Admin, User, Client, Supplier) and per-row ACLs.
• Rate limiting, anti-spam guards on public endpoints, Turnstile / CAPTCHA on forms.
• Tamper-evident audit-log hash chain for financial and access-control events.
• Automated daily backups with 30-day retention; backups are gzipped and stored in a separate region from the primary DB.
• Sub-processor security posture is reviewed on onboarding and annually thereafter.

8. Personal-data breach notification

The Processor will notify the Controller without undue delay and no later than 72 hours after becoming aware of a Personal Data breach affecting the Controller's data. The notification will include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.

9. Audit rights

Once per calendar year, on 30 days' written notice, the Controller may audit (or appoint an independent third-party auditor to audit) the Processor's compliance with this DPA. Audits take place during business hours, do not unreasonably disrupt the Service, and are subject to the Processor's confidentiality requirements. The Processor's up-to-date security documentation, and any third-party attestation reports (ISO 27001, SOC 2) if held, satisfy the audit obligation in the first instance.

10. Return / deletion at end of Service

On termination of the Service, or on demand from the Controller, the Processor will (at the Controller's choice) return or delete all Personal Data. See the retention schedule in Privacy Policy §6. Records that the Processor is legally required to retain (invoices, audit logs, backups within the pruning window) are kept in a segregated form until the retention obligation expires and are then deleted.

11. Liability

Liability under this DPA is subject to the aggregate liability cap in the Terms of Service. Nothing in this DPA excludes or limits liability that cannot be excluded or limited under applicable data-protection law.

12. Governing law

This DPA is governed by the law of England and Wales, without prejudice to the mandatory application of the GDPR of the Controller's establishment.

13. Contact

Data-protection enquiries and audit requests: info@fx2events.com.

This baseline DPA takes effect automatically on subscription. Commercial customers requiring a countersigned version — for procurement, insurance, or public-sector tender purposes — can email info@fx2events.com to arrange one.