Data processing addendum
For business customers and ticketing partners: roles for guest and ticket-buyer data, processing instructions, sub-processors, security measures and breach notice.
The legal documents
Parties and scope
This addendum forms part of the agreement between [Company legal name] ("processor", "we") and the business customer or ticketing partner that accepts it ("controller", "you"). It applies when we process personal data on your behalf in the service, under the Kenya Data Protection Act, 2019 and, where it applies, the EU or UK GDPR.
Roles
| Data | Who it is about | Controller | Processor |
|---|---|---|---|
| Guest lists and seating charts | your guests | you (the organiser or planner) | us |
| Ticket buyers' name, phone, email, seats and ticket codes | buyers | you (the organiser or ticketing partner) | us |
| Client responses to proposals | your client's contacts | you | us |
| Your own account and profile | you and your team | us (see the privacy policy) | – |
When a ticketing partner embeds the seat map, the partner is the controller for buyer data, keeps payments and the master inventory, and passes only the buyer details needed to issue tickets.
Our commitments
We will:
- process the data only on your documented instructions (these terms and your use of the product), unless the law requires otherwise, and tell you if an instruction appears to break the law;
- make sure our people with access are bound by confidentiality;
- apply the security measures below;
- use sub-processors only as listed below, with written terms at least as protective, and give you 30 days' notice of a new one so you can object;
- help you answer data subjects' requests and carry out impact assessments where needed;
- notify you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with what we know and what we are doing;
- delete or return your data at the end of the service, unless the law requires us to keep it;
- give you the information needed to show compliance, and allow a reasonable audit once a year on notice.
Where the data is today
In the current demo version, guest lists, holds and sales are stored in the user's own browser and are not transferred to us. The commitments above apply in full once server storage launches; before that we will publish the final list of sub-processors and hosting locations.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | hosting the pages | United States, global edge |
| [Sub-processor list] | database, authentication, email | [to be listed before launch] |
Security measures
- Encryption in transit (HTTPS) for every page and message.
- Access limited to named staff who need it, with individual accounts.
- Passwords stored only as salted hashes.
- Origin allow-list for the seat-map embed, so it talks only to registered partner sites (enforced with the server version).
- Planned with server storage: encryption at rest, audit logs, backups and tested restore. See the security overview.
International transfers
Where data leaves Kenya we will rely on section 48 of the Act and standard contractual protections, and tell you where the data goes.
Liability and order of precedence
Liability is as set out in the terms of service. If this addendum conflicts with the terms on personal data, this addendum wins.
Signatures
For business customers who need a signed copy: [Company legal name], signed by [name, title]; controller signed by [name, title]. Contact [Privacy contact email].