Data Processing Agreement

DATA PROCESSING AGREEMENT (ART. 28 GDPR) - VENUED
Version: 1.0

Effective Date: 19.09.2026

Status: Standalone execution copy of § 20A of the Venued Terms & Conditions (v2.4). Offered so that an Organizer whose procurement or data protection function requires a separate signed instrument can obtain one without negotiating bespoke terms.

PLAIN-LANGUAGE SUMMARY (NO LEGAL EFFECT)

When you run an event on Venued, the personal data of the people who buy tickets or RSVP to that event is yours, not ours. You decide what happens to it; we hold and process it for you. This document is the agreement that says so, in the form Article 28 of the GDPR requires. It is identical in substance to § 20A of our Terms & Conditions, which already binds us. Signing it adds nothing and takes nothing away. It exists so that you have a separate piece of paper to file.

0. RELATIONSHIP TO THE TERMS & CONDITIONS

0.1 Identical substance. This Agreement reproduces § 20A and Appendix 1 of the Venued Terms & Conditions (the "Terms"), together with two further annexes that describe measures and sub-processors already referred to there. It creates no obligation that does not already exist under the Terms, and removes none.

0.2 No conflict. Where this Agreement and § 20A of the Terms are both in force between the same parties, they are to be read as one and the same set of obligations. In the event of any inconsistency in wording, the interpretation that gives the Controller the greater protection prevails.

0.3 Not required. An Organizer that does not execute this Agreement is not thereby in a worse position: § 20A of the Terms applies to every Organizer automatically, whether or not this document is signed.

0.4 Term. This Agreement takes effect when the Organizer relationship begins or on signature, whichever is later, and ends when the Organizer relationship ends, subject to § 9 below.

1. PARTIES, ROLES & SCOPE

1.1 Parties. This Agreement is between the Organizer (the "Controller") and Venued UG (haftungsbeschränkt), registered with the commercial register of the Munich Local Court (Amtsgericht München) under HRB 314371 (the "Processor").

1.2 Roles. For Attendee Data, the Controller is the controller and the Processor is the processor within the meaning of Art. 4 Nos. 7 and 8 GDPR.

1.3 Attendee Data. "Attendee Data" means personal data of buyers and attendees that the Processor processes on the Controller's behalf in connection with the Controller's events. Annex 1 sets out the categories.

1.4 Out of scope. This Agreement does not apply to:
(a) personal data the Processor processes as its own controller in order to operate the Venued platform, its recommendation system, its security, and its own compliance duties, including its reporting duty under the Plattformen-Steuertransparenzgesetz. That processing is governed by the Venued Privacy Policy;
(b) Attendee Data that the Controller has exported out of the platform. On export the Controller becomes a separate controller for the exported copy and this Agreement no longer governs it (Terms § 19.5);
(c) payment data processed by Stripe, which acts as an independent controller and not as sub-processors of the Processor (see Annex 3).

2. INSTRUCTIONS

2.1 Documented instructions. The Processor processes Attendee Data only on the documented instructions of the Controller, including as regards transfers to a third country, unless required to do so by Union or Member-State law to which the Processor is subject; in that case the Processor informs the Controller of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.

2.2 What constitutes an instruction. The functionality of the platform as configured by the Controller, together with the Terms and this Agreement, constitutes the Controller's documented instructions. Further instructions must be given in text form to privacy@venued.eu.

2.3 Unlawful instructions. The Processor informs the Controller without undue delay if, in the Processor's opinion, an instruction infringes the GDPR or other data protection provisions. The Processor may suspend performance of that instruction until it is confirmed or withdrawn. The Controller remains responsible for the lawfulness of its instructions.

2.4 No own purposes. The Processor does not sell Attendee Data, does not make it available to third parties except as permitted by this Agreement, and does not use it for its own purposes, including the training of models, except where the data has first been aggregated or anonymised such that it is no longer personal data.

3. CONFIDENTIALITY

Persons authorised by the Processor to process Attendee Data are informed of its confidential nature, are subject to a contractual obligation of confidentiality that survives the end of their engagement, and are granted access only to the extent their task requires.

4. SECURITY OF PROCESSING (ART. 32 GDPR)

4.1 Measures. The Processor implements appropriate technical and organisational measures under Art. 32 GDPR, having regard to the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risk to the rights and freedoms of natural persons. The measures in force are set out in Annex 2.

4.2 Changes. The Processor may change the measures, provided the level of protection is not reduced. Material changes are reflected in an updated Annex 2.

5. SUB-PROCESSORS

5.1 General authorisation. The Controller grants the Processor general written authorisation to engage sub-processors, within the meaning of Art. 28 (2) GDPR. The sub-processors engaged at the date of this Agreement are listed in Annex 3.

5.2 Flow-down. The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those in this Agreement, and remains fully liable to the Controller for the performance of that sub-processor's obligations.

5.3 Notice and objection. The Processor gives the Controller at least 30 days' notice before adding or replacing a sub-processor, by email to the Organizer's registered address and in the venued-dashboard. Within that period the Controller may object on reasonable grounds relating to data protection. The parties will seek a solution in good faith. Where no solution is found, the Controller may terminate the affected part of the service with effect from the date the change takes effect, without penalty.

5.4 Emergency replacement. Where a sub-processor must be replaced at short notice to maintain security or continuity of the service, the Processor may do so before the notice period expires, and informs the Controller without undue delay. The Controller's right to object under § 5.3 applies retrospectively.

6. INTERNATIONAL TRANSFERS

6.1 Primary location. Attendee Data is processed primarily within the European Economic Area.

6.2 Safeguards. Where a sub-processor processes Attendee Data outside the EU or EEA, the Processor ensures an appropriate safeguard under Chapter V GDPR, in particular an adequacy decision under Art. 45 GDPR or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, accompanied by a transfer impact assessment in line with CJEU judgment C-311/18 (Schrems II) and EDPB Recommendations 01/2020.

6.3 Authority to conclude. The Controller authorises the Processor to conclude the Standard Contractual Clauses with sub-processors on the Controller's behalf, in the Controller's name, for the purpose of the processing described in Annex 1.

7. ASSISTANCE TO THE CONTROLLER

7.1 Data subject rights. Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests for exercising a data subject's rights under Chapter III GDPR.

7.2 Requests received directly. Where the Processor receives a request from a data subject that relates to Attendee Data, it forwards the request to the Controller without undue delay and does not respond to it itself, unless legally required to do so. Where the Processor is able to identify the Controller concerned, it tells the data subject who the controller is.

7.3 Arts. 32 to 36 GDPR. The Processor assists the Controller in ensuring compliance with the obligations under Arts. 32 to 36 GDPR, taking into account the nature of the processing and the information available to the Processor, in particular with data protection impact assessments and prior consultation of the supervisory authority.

7.4 Cost. Assistance under this section is provided free of charge where it can be delivered through the platform's standard functionality. Where a request requires substantial bespoke effort, the Processor may charge its reasonable costs, notified in advance and subject to the Controller's agreement.

8. PERSONAL DATA BREACH

8.1 Notification. The Processor notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Attendee Data.

8.2 Content. The notification describes, as far as known: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point. Where the information cannot be provided at once, it is provided in phases without undue further delay.

8.3 Cooperation. The Processor assists the Controller in meeting the Controller's own obligations under Arts. 33 and 34 GDPR. The Processor does not notify the supervisory authority or data subjects on the Controller's behalf unless instructed to do so in text form.

9. DELETION AND RETURN

9.1 On termination. On termination of the Organizer relationship, the Processor deletes Attendee Data or, at the Controller's choice notified before termination takes effect, returns it in a structured, commonly used, machine-readable format, unless Union or Member-State law requires continued storage.

9.2 Timing. Deletion from live systems takes place within 30 days of termination. Deletion from backups follows the backup cycle and takes no longer than a further 90 days, during which the data is not actively processed.

9.3 Export before termination. The Controller is responsible for exporting any Attendee Data it wishes to retain before termination takes effect. Export functionality is available in the venued-dashboard throughout the Organizer relationship.

9.4 Confirmation. The Processor confirms deletion in text form on request.

10. RECORDS, AUDIT AND EVIDENCE

10.1 Information. The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR.

10.2 Audit. The Processor allows for and contributes to audits, including inspections, conducted by the Controller or by an independent auditor mandated by the Controller and not in competition with the Processor.

10.3 Conduct of audits. Audits take place once in any period of twelve months, on at least 30 days' written notice, during normal business hours, without disproportionate disruption to the Processor's operations, and subject to confidentiality undertakings. The Controller bears its own costs and the Processor's reasonable costs of supporting the audit.

10.4 Substitute evidence. A current certification, audit report, or report of an independent expert concerning the Processor or a sub-processor satisfies §§ 10.1 to 10.3 to the extent that it covers the subject matter of the intended audit.

10.5 Additional audits. An additional audit may be conducted, outside the twelve-month cycle and at shorter notice, where a personal data breach affecting the Controller has occurred or where a supervisory authority requires it.

10.6 Records of processing. The Processor maintains a record of processing activities carried out on behalf of the Controller in accordance with Art. 30 (2) GDPR.

11. LIABILITY AND FINAL PROVISIONS

11.1 Liability. Liability between the parties is governed by § 22.4 and § 27 of the Terms. Art. 82 GDPR is unaffected. Where the Processor has paid compensation to a data subject in full under Art. 82 (4) GDPR, it is entitled under Art. 82 (5) GDPR to claim back from the Controller that part of the compensation corresponding to the Controller's share of responsibility for the damage; the Controller will reimburse it within thirty (30) days of an itemised demand in text form.

11.2 Governing law. This Agreement is governed by the law of the Federal Republic of Germany.

11.3 Form. Amendments must be made in text form. This includes any amendment of this provision.

11.4 Severability. If a provision of this Agreement is or becomes invalid, the remainder is unaffected. The invalid provision is replaced by the lawful provision that comes closest to its economic and data protection purpose.

11.5 Contact. Data protection matters: privacy@venued.eu. Security incidents: security@venued.eu. Organizer matters: organizers@venued.eu.

ANNEX 1 - PROCESSING SCHEDULE

Subject matter. The hosting and processing of personal data of buyers and attendees to the extent necessary to provide the service to the Controller, in particular the sale and issuance of tickets, the management of orders and attendee lists, admission control by scanning, and event-related communication.

Duration. For the duration of the Organizer relationship, plus the retention periods in § 9 and any longer period required by Union or Member-State law, in particular retention duties under the German Commercial Code (HGB) and the Fiscal Code (AO), and the reporting duty under the Plattformen-Steuertransparenzgesetz.

Nature and purpose. Collection, recording, organisation, structuring, storage, retrieval, use, transmission to the Controller and to sub-processors, restriction, and erasure, for the purpose of providing the ticketing, attendee-management, and event-communication functions of the platform to the Controller.

Categories of personal data.
- Identity: name; email address; telephone number where supplied by the buyer.
- Order data: ticket type, quantity, price, plus-one details, discount code used, order and payment status, payment-descriptor reference.
- Ticket data: ticket identifier, QR token, scan status, scan time, scanning device.
- Attendee-supplied data: answers to questions the Controller configured at checkout.
- Visibility state: whether the person appears on the public attendee list.
- Communication: event-related messages sent through the platform.

Payment card data is not processed by the Processor. It is processed by the payment provider under PCI DSS; the Processor receives only tokenised references and transaction metadata.

Special categories of personal data. Not processed by default. Where the Controller configures a checkout question that elicits data within Art. 9 GDPR (for example an accessibility requirement, or a dietary requirement that reveals a religious belief), the Controller is responsible for establishing a condition under Art. 9 (2) GDPR and must not collect more than is necessary for the event.

Categories of data subjects. Buyers of tickets to the Controller's events; persons who RSVP to those events; plus-ones named by a buyer; attendees admitted at the door.

Frequency of transfer. Continuous, for the duration of the Organizer relationship.

ANNEX 2 - TECHNICAL AND ORGANISATIONAL MEASURES (ART. 32 GDPR)

The measures below are those in force at the effective date of this Agreement. They are reviewed periodically and may be changed provided the level of protection is not reduced (§ 4.2).

A. Pseudonymisation and encryption (Art. 32 (1) (a))
- Transport encryption (TLS) for all connections between clients, the platform, and its sub-processors.
- Encryption at rest for databases and object storage (AES-256), provided by the cloud platform.
- Telephone numbers are retained only as a one-way cryptographic hash after verification; the clear-text number is processed only by the SMS provider for the purpose of delivering the message.
- Payment card data never enters the Processor's systems.

B. Confidentiality (Art. 32 (1) (b))
- Role-based access control. Access to production data is restricted to personnel whose task requires it.
- Authentication of end users through the platform's identity provider; administrative access requires multi-factor authentication.
- Server-side authorisation rules enforced at the data layer, so that a client cannot read records it is not entitled to, independently of the user interface.
- Client attestation (App Check) on API traffic, and rate limiting, to constrain automated and unauthorised access.
- Separation of the Controller's attendee data from that of other Organizers by tenancy scoping in the data model and in the authorisation rules.
- Confidentiality undertakings for all personnel with access (§ 3).

C. Integrity (Art. 32 (1) (b))
- Server-side validation of writes; security rules prevent clients from writing fields they do not own.
- Audit logging of administrative actions and of access to production data.
- Change control for code reaching production, including review before merge and automated tests.

D. Availability and resilience (Art. 32 (1) (b))
- Managed, redundant cloud infrastructure with data held in European regions.
- Automated backups with a defined retention cycle (see § 9.2).
- Monitoring and error reporting, with alerting on failure conditions.

E. Restoration of availability (Art. 32 (1) (c))
- Documented procedures for restoring data and service from backup following a physical or technical incident.

F. Evaluation (Art. 32 (1) (d))
- Periodic review of the measures in this Annex and of the cloud configuration against current standards.
- Vulnerability assessment of dependencies, with remediation of findings according to severity.

G. Organisational measures
- A defined route for reporting security incidents (security@venued.eu) and for data protection matters (privacy@venued.eu).
- Sub-processor management under § 5, with a published list (Annex 3).
- A record of processing activities under Art. 30 (2) GDPR.

Note on scope. This Annex describes measures, not certifications. The Processor does not currently hold an ISO 27001 or comparable certification and makes no such claim. Where a Controller's own risk assessment requires evidence beyond this Annex, § 10 (audit) applies.

ANNEX 3 - SUB-PROCESSORS

Sub-processors engaged at the effective date of this Agreement:

1. Google Cloud EMEA Limited / Google Ireland Limited - cloud hosting, database, object storage, authentication, push notification delivery (FCM), SMS delivery for one-time passwords. Primary processing region: European Union. Art. 28 terms: Google Cloud Data Processing Addendum.

2. Apple Distribution International Ltd. - delivery of push notifications to Apple devices (APNs). Processing limited to the device token and message payload.

3. Error-monitoring provider (Sentry or equivalent) - receipt of crash and error reports for fault diagnosis. Reports may contain technical device data and application state. Art. 28 terms in place.

4. Cloudflare, Inc. / Cloudflare Germany GmbH - content delivery and network security in front of parts of the service, where enabled. Processes connection metadata such as IP address and request headers.

Not a sub-processor. Stripe Payments Europe Ltd. (Ireland) acts as an independent controller in respect of payment data, not as a sub-processor of the Processor. It determines the purposes and means of its own processing for payment execution, fraud prevention, and its regulatory duties. That processing is governed by Stripe's own terms and privacy notice, directly with the Organizer.

Changes to this Annex are notified in accordance with § 5.3.

SIGNATURE

This Agreement may be executed in counterparts and in text form, including by electronic signature.

The Controller (Organizer)

Legal entity: ......................................................
Registered address: ................................................
Represented by: ....................................................
Place, date: .......................................................
Signature: .........................................................

The Processor

Venued UG (haftungsbeschränkt), HRB 314371, Amtsgericht München
Represented by: ....................................................
Place, date: .......................................................
Signature: .........................................................