DATA PROCESSING AGREEMENT

This Data Processing Agreement (DPA) forms part of the agreement between a customer using CheckInOS as an organizer (Customer or Organizer) and CheckInOS V.O.F (CheckInOS, we, us) for event management, attendee management, ticketing, check-in, Feedback Forms, and related services (Services). It applies where CheckInOS processes personal data on behalf of the Customer under the EU GDPR, UK GDPR, Swiss FADP, or similar laws.

This DPA sets out processor commitments aligned with GDPR Article 28(3) together with the Annex below. The governing contract is your agreement with CheckInOS (including our Terms of Service). See also the Privacy Policy, Subprocessor List, and Cookie Policy.

TABLE OF CONTENTS

1. ROLES AND SCOPE

For personal data the Customer uploads, imports, collects, or instructs us to process for events, attendees, tickets, check-in, Feedback Forms, invitations, responses, and related operations, the Customer is generally the controller and CheckInOS is the processor.

CheckInOS acts as an independent controller for its own account security, billing, terms acceptance logs, platform abuse prevention, and similar purposes described in the Privacy Policy.

2. PROCESSOR OBLIGATIONS (GDPR ARTICLE 28)

Where we act as processor, we will comply with Article 28(3) requirements, including:

• process only on documented instructions, including this DPA, the Terms, product configuration, and Customer admin actions;
• ensure persons authorized to process data are bound by confidentiality;
• implement appropriate technical and organizational measures (TOMs) per Section 6;
• use subprocessors only under written terms meeting Article 28 and remain liable for their processing obligations;
• assist the Customer with data subject requests, breach response, and DPIA/prior consultation as in Sections 7–9;
• delete or return personal data at end of services or on instruction, subject to legal retention and backup cycles;
• make available information to demonstrate compliance and allow audits per Section 11.

3. CUSTOMER RESPONSIBILITIES

The Customer is responsible for lawful basis, privacy notices to attendees, data minimization, accuracy, retention choices, workspace access controls, and responses to data subject requests for data it controls. For Feedback Forms, the Customer is also responsible for the questions, translations, selected anonymous-to-organizer or identified mode, controller/contact disclosures, campaign recipients, communications content, reminder use, and lawful outreach basis.

Before each Feedback Form campaign, the Customer must truthfully complete the applicable campaign attestation and be able to produce supporting evidence. For recipients in Italy, the Customer must assess Article 130 of Italian Legislative Decree 196/2003 and document prior consent unless qualified counsel has confirmed that Article 130(4)'s limited existing-customer exception applies. A Customer established in Italy must declare Italy for its campaigns, and unknown or mixed recipient residence must be treated as including Italy. For recipients in the Netherlands, the Customer must assess the GDPR, applicable ePrivacy rules, Dutch Telecommunicatiewet, and supervisory guidance. An attestation is an accountability record and does not itself create a lawful basis. CheckInOS does not provide legal advice or warrant the Customer's compliance; qualified Dutch and Italian counsel should review jurisdiction-specific use before launch.

The Customer must not submit or intentionally solicit special-category, criminal-offence, children's, or other high-risk data without prior written agreement, a valid legal basis, and appropriate safeguards.

4. NO SECONDARY USE

We do not use Customer-controlled attendee data for our own marketing, unrelated advertising, model training, or unrelated profiling. Permitted communications are transactional or service-related (e.g. tickets, invitations, security notices).

5. TECHNICAL AND ORGANIZATIONAL MEASURES (TOMS)

We maintain measures appropriate to risk, including:

• authentication (password hashing, OAuth, JWT sessions, session invalidation on disable);
• team-scoped access to events, Feedback Forms, attendee data, and response reports;
• encryption in transit (HTTPS) and provider-managed database security;
• signed, time-limited QR/ticket and Feedback Form tokens, atomic one-response redemption, and Stripe webhook signature verification;
• separation of invitation/delivery records from anonymous-to-organizer submissions, with no direct attendee link stored on those submissions;
• private object storage plus validation, metadata stripping, resizing, and compression for Feedback Form branding images;
• append-only terms acceptance and selected admin action logging;
• EU-oriented hosting/database configuration where deployed;
• incident response procedures (manual) and vendor due diligence for subprocessors.

No system is perfectly secure. The Customer remains responsible for credential hygiene, exports, and permissions on its side.

6. SUBPROCESSORS AND TRANSFERS

Current subprocessors are listed at /subprocessors with added dates and status. We impose data protection obligations on subprocessors. International transfers use appropriate safeguards (e.g. SCCs) where required.

We will give reasonable prior notice of intended subprocessor changes by email to organization owners/admins and/or in-product notice, and by updating /subprocessors with the effective date. The Customer may object on reasonable data protection grounds within 30 days of notice.

If the Customer objects on reasonable grounds and we cannot reasonably accommodate the objection (for example by an alternative subprocessor or configuration), the Customer may terminate the affected Services or the agreement to the extent required by law, without penalty for that portion, or we may suspend use of the new subprocessor for that Customer's data until resolved.

7A. ANNEX: PROCESSING DETAILS (ARTICLE 28)

Duration: For the term of the Customer's use of the Services and as stated in Section 10 (deletion/return).

Subject matter: Event management, attendee registration, ticketing, check-in/check-out, Feedback Form creation and distribution, response collection and reporting, communications, and related operations via CheckInOS.

Categories of data subjects: Event attendees, ticket buyers, invitees, and Customer personnel using the platform.

Types of personal data: Identity and contact data (name, email), ticket/registration data, check-in timestamps, custom fields configured by the Customer, Feedback Form answers and response language, invitation and delivery status, reminder opt-out, submission timestamps, and related operational metadata. Campaign records may include the initiating administrator, attestation version, declared recipient jurisdictions and outreach basis, and a non-sensitive evidence reference. Identified responses may include an attendee link; anonymous-to-organizer responses use a random form-specific response identifier and do not store a direct attendee link.

Nature and purpose of processing: Collection, storage, organization, transmission, ticketing, QR and Feedback Form link validation, duplicate-submission prevention, survey reporting and export for the Customer, campaign accountability, and transactional messaging on documented instructions. Supabase provides database and private branding-object storage; Resend processes recipient addresses and message content to deliver invitations and reminders.

7. DATA SUBJECT REQUESTS AND CUSTOMER ASSISTANCE

We will assist the Customer, taking into account processing nature and available information, so the Customer can fulfill data subject rights (access, rectification, erasure, restriction, portability where applicable) within reasonable timeframes.

If we receive a request about data the Customer controls, we may refer the data subject to the Customer. We generally do not delete or alter Customer attendee records without Customer instruction, except where law requires us to act.

8. PERSONAL DATA BREACHES

If we become aware of a personal data breach affecting Customer personal data we process as processor, we will notify the Customer without undue delay and provide information reasonably available to help the Customer meet its notification obligations to authorities and data subjects.

We will cooperate with the Customer's investigation and mitigation efforts, including implementing reasonable containment steps where within our control. Notice may be provided in phases as facts develop. Automated breach detection is not guaranteed.

9. DPIA AND PRIOR CONSULTATION

Where a data protection impact assessment (DPIA) or prior consultation with a supervisory authority is required in connection with the Customer's use of the Services, we will provide reasonable assistance with available documentation (processing description, subprocessors, TOMs summary) upon request, subject to confidentiality and proportionality.

10. DELETION, RETURN, AND RETENTION

On verified instruction or end of Services, we will delete or return Customer personal data we process as processor, except where retention is required by law, dispute resolution, security, or backup rotation.

Attendee retention policy: one year after an Event ends, traceable attendee identifiers (name, email, custom fields) are removed or anonymized, subject to documented Customer instructions, legal retention, disputes, and backup rotation. Non-identifying event and attendee aggregates may be retained for Organizer analytics.

Feedback Form retention policy: Feedback Forms normally close 30 days after the first campaign. No later than one year after the Event ends, we delete text answers, individual submissions, attendee-response links, invitations, reminder opt-outs, recipient-level delivery records, and other response-level data. We may preserve only non-identifying rating and choice aggregates. The Customer may instruct earlier deletion. The minimum campaign-attestation audit record may be retained longer on documented instruction or where reasonably necessary for legal claims, accountability, or compliance, with the period determined under applicable law and qualified legal advice.

11. AUDITS

On reasonable request, we provide information to demonstrate compliance. Audits are typically remote (questionnaires, security summaries, subprocessor documentation). Intrusive or on-site audits require mutual scheduling, confidentiality, and may incur reasonable fees for repetitive requests where permitted.

12. CONTACT

events@checkinos.com

CheckInOS V.O.F KvK: 42067930 Nieuwe Emmasingel 111, 5611AM Eindhoven, Netherlands