Data Processing Agreement

This Data Processing Agreement (“DPA“) is entered into by and between the Client and GatherUs and is incorporated by reference into the GatherUs Terms of Service to reflect the Parties’ agreement about the Processing of Personal Data in accordance with the requirements of GDPR.

I. DEFINITIONS

1. Client Personal Data means any Personal Data either (i) transmitted by Client through the App pursuant to the provision of the Services provided by GatherUs, or (ii) collected by GatherUs on behalf of Client and transmitted into the App pursuant to the Services provided by GatherUs.
2. Data Controller means the entity which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
3. Data Processor means an entity which processes Personal Data on behalf of the Controller.
4. Data Subject means the individual to whom Personal Data relates.
5. Data Sub-processor means any person appointed by or on behalf of the Processor, or by or on behalf of an existing Sub-processor, to process Personal Data on behalf of the Controller.
6. GatherUs Usage Data means Service usage data collected and processed by GatherUs in connection with the provision of the Services, including, without limitation, data used to identify the source and destination of a communication, activity logs, and data used to optimize and maintain performance of the Services, and to investigate and prevent system abuse.
7. GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
8. Incident means accidental or unlawful destruction, loss, alteration, unauthorized disclosure, access, or use of Client Personal Data.
9. Personal Data means any personal data relating to an identified or identifiable natural person; an identifiable natural person can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
10. Processing means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as (without limitation) collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
11. Restricted Transfer means where the GDPR prohibits a transfer of personal data from an origin country to a destination country outside of the origin country that is not subject to an adequacy determination, or not based on adequacy regulations, or not included on the list of adequate jurisdictions published by the origin country; and subject to any requirement to take additional steps to adequately protect the Personal Data transferred under this DPA for the transfer to be lawful under the GDPR.
12. Sensitive Personal Data means personal data revealing: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, or biometric data for uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences, and includes, without limitation, “Sensitive Personal Information”, “Special Category Data”, or any equivalent terms as defined under GDPR.

II. GENERAL

1. This DPA and its attachments apply to all Processing of Client Personal Data by GatherUs on behalf of the Client, wherever the Client is established and wherever the Data Subjects are located. The Parties adopt the standard of protection set out in this DPA, which is based on the GDPR, as their global baseline for such Processing. Where mandatory local data protection law applicable to the Processing (including the UK GDPR, the Swiss Federal Act on Data Protection, US state privacy laws such as the CCPA/CPRA and equivalent state statutes, or Japan’s Act on the Protection of Personal Information) imposes additional or different requirements, that law prevails to the extent of the conflict, and the Parties shall cooperate in good faith to implement any additional terms it requires.

III. ROLES AND RESPONSIBILITIES

1. The Client, as Data Controller, appoints GatherUs as a Data Processor to process the Client’s Personal Data on the Client’s behalf. In some circumstances, the Client may be a Data Processor, in which case the Client appoints GatherUs as the Client’s Sub-processor, which shall not change the obligations of the Parties under this DPA, as GatherUs will remain a Data Processor with respect to the Client in such event. However, the Client will notify and keep GatherUs updated on whether GatherUs acts, in relation to specific processing activities, as a Data Processor or a Data Sub-processor, and if the latter is the case, on the identity of the actual Data Controller.
2. GatherUs shall process Client Personal Data for the purposes outlined in the ToS and only in accordance with the lawful, documented instructions of Client (including about transfers of Client Personal Data to a third country), unless GatherUs is required to process Client Personal Data by the GDPR to which GatherUs is subject (in such a case, GatherUs shall inform the Client of that legal requirement before processing, unless applicable law prohibits such information). The Client’s instructions may be specific or of a general nature as set out in this DPA or as otherwise notified by the Client to GatherUs from time to time and not for GatherUs’s own purposes. GatherUs may refrain from execution of the Client’s instruction if it notifies the Client immediately that, in GatherUs’s opinion, an instruction for the processing of Client Personal Data given by the Client infringes GDPR.
3. GatherUs shall ensure that its relevant employees, agents, and contractors receive appropriate training regarding their responsibilities and obligations with respect to the processing, protection, and confidentiality of Client Personal Data.
4. Client remains responsible for ensuring that its instructions comply with GDPR and that GatherUs is authorized to process Client Personal Data in accordance with this DPA.
5. For the avoidance of doubt, this DPA does not apply to Processing in respect of which GatherUs is an independent Data Controller, including (i) GatherUs Usage Data, (ii) End User account data and platform usage data Processed to provide End Users with access to the platform,to secure, maintain and improve the platform, to analyse how users use the platform, to provide End Users with networking suggestions and to send End Users event and community communications, as described in the GatherUs Privacy Policy, and (iii) Personal Data shared between the Parties as independent controllers, which is governed by the Data Sharing Agreement. In respect of such Processing, GatherUs is an independent Data Controller and not a joint Data Controller with the Client.

IV. COMPLIANCE

1. Client, irrespective of the Client’s role as a Data Controller or a Data Processor, shall be responsible for ensuring that, in connection with its content, Client Personal Data and the Services:
   • it has complied, and will continue to comply with GDPR;
   • it has, and will continue to have, the right to transfer, or provide access to, the Client Personal Data to GatherUs for processing in accordance with the ToS and this DPA.
2. Client shall provide all required notices and appropriate disclosures to all Data Subjects regarding Client and GatherUs’s processing and transfer of Personal Data, and shall obtain all necessary rights and lawful consents from Data Subjects to permit processing by the Client for the purposes of fulfilling Client’s purposes under the ToS.
3. If Client uses the Services to process any categories of Personal Data not expressly covered by this DPA, Client acts at its own risk, and GatherUs shall not be responsible for any potential compliance deficits related to such use.
4. The Services do not require Sensitive Personal Data and GatherUs does not request it. The Client defines its own registration questions and other data fields; the Client shall not collect Sensitive Personal Data through the App unless the Client, as Data Controller, has established a valid legal basis and an applicable condition under Article 9 GDPR (or the equivalent under other applicable law, including opt-in consent for “special care-required personal information” under Japan’s APPI), and the Client is solely responsible for any Sensitive Personal Data it chooses to collect.
5. Where GatherUs discloses GatherUs employees’/contractors’ Personal Data to the Client or a GatherUs employee/contractor provides Personal Data directly to the Client, which the Client processes to manage its use of the Services, Client shall process that Personal Data in accordance with its privacy policies and applicable privacy laws, particularly GDPR. Such disclosures shall be made by GatherUs only where lawful for the purposes of contract management, service management, or security purposes.
6. The Client grants GatherUs general written authorization, within the meaning of Article 28(2) GDPR, to engage Data Sub-processors to carry out specific processing activities on the Client’s behalf in connection with the provision of the App.
7. GatherUs will maintain an up-to-date list of Data Sub-processor. Data Sub-processors are listed here:
   • Google LLC — provider of Google Cloud Platform used for hosting, infrastructure, data storage, backups and related cloud services necessary for the operation of the App, as well as provider of authentication and Single Sign-On (SSO) services enabling secure user access to the App, with primary processing locations in the EU and incidental access globally.
   • Twilio Inc. — provider of SendGrid used for email delivery, transactional email infrastructure and related communication services for sending system notifications and service-related messages, with processing locations in the USA.
   • Stripe Inc. — provider of payment processing services used for billing, subscription management and related payment operations in connection with the provision of the App, with processing locations in the USA.
   • Roomzilla Technologies Inc. — provider of Roomzilla used for workspace management, coordination of operational resources and support services related to the provision of the App, with processing potentially occurring in the USA or other locations depending on Roomzilla Technologies Inc.’s operational setup.
   • LinkedIn Ireland Unlimited Company — provider of authentication and Single Sign-On (SSO) services enabling secure user access to the App, with primary processing locations in the EU and incidental access globally.
   • Microsoft Corporation — provider of authentication and Single Sign-On (SSO) services enabling secure user access to the App, with primary processing locations in the EU and incidental access globally.
   • Atlassian Pty Ltd — provider of Jira used for issue tracking, bug reporting and technical support coordination related to the operation and maintenance of the App, including processing personal data contained in support tickets and related attachments, with processing locations depending on the configured data residency settings and Atlassian’s hosting and support arrangements.
   • Functional Software, Inc. d/b/a Sentry — provider of Sentry used for application error tracking, diagnostic logging and performance monitoring necessary to identify and resolve technical issues affecting the App, with primary data storage in the USA or the EU depending on the configured hosting region, and additional processing in locations used for service operations and support.
8. Where the Client enables third-party applications or integrations built on the platform by external developers, such developers receive access to Client Personal Data on the Client’s authorization and act as the Client’s own recipients or processors, not as GatherUs Data Sub-processors, unless they are expressly included in the list above. [Scope of third-party developer access to be confirmed by the GatherUs technical team.]
9. Where the Client exports Client Personal Data through the tools made available by GatherUs (including CSV export, webhooks, Zapier or similar integrations configured by the Client), such export is Processing on the Client’s documented instruction, and the recipients or endpoints designated by the Client are the Client’s own recipients or processors and not GatherUs Data Sub-processors. The Client is responsible for the lawfulness of such exports, including any resulting international transfer, and for the recipients it designates.
10. Client Personal Data that is cached, printed or logged on devices operated by the Client or its staff through the GatherUs desktop application (including check-in devices and badge printers) is Processed by the Client on its own systems and is outside the scope of GatherUs’s Processing under this DPA, including the Technical and Organisational Measures section and Annex 2. The Client is responsible for securing such devices and for removing cached Client Personal Data from them after the relevant Event.
11. GatherUs will inform the Client of any intended addition or replacement of a Data Sub-processor at least thirty (30) days before the new Data Sub-processor begins processing Personal Data, thereby giving the Client the opportunity to object. The Client may object on reasonable grounds relating to data protection within fourteen (14) days of being so informed. The Parties will work together in good faith to resolve the objection. If the objection cannot be resolved, the Client may suspend or terminate the affected part of the Services (and, to that extent, this DPA) without penalty, without prejudice to fees accrued before termination.
12. Where GatherUs engages a Data Sub-processor, it will do so by way of a written contract imposing on that Data Sub-processor data-protection obligations that are no less protective than those set out in this DPA, in particular the obligations referred to in Article 28(3) GDPR to the extent applicable to the nature of the services provided by the Data Sub-processor, including the obligation to provide sufficient guarantees to implement appropriate technical and organisational measures.

V. TECHNICAL AND ORGANISATIONAL MEASURES

1. GatherUs shall implement appropriate technical and organizational measures designed to protect the Client Personal Data from an Incident, in accordance with Article 32 of the GDPR. The technical and organisational measures currently implemented by GatherUs are described in Annex 2 (Security Measures), which forms part of this DPA. GatherUs may update the measures from time to time, provided the overall level of security is not materially reduced.
2. GatherUs will also, considering the nature of processing and the information available to GatherUs, assist the Client in ensuring its compliance with the obligations pursuant to Article 32 of the GDPR.
3. GatherUs shall ensure that any person whom it authorizes to process the Client Personal Data (including its staff, agents, and subcontractors) shall be subject to a duty of confidentiality (whether a contractual or a statutory duty) and shall remain bound by that duty for so long as the relevant Client Personal Data remains confidential.
4. Upon becoming aware of a confirmed Incident, GatherUs shall notify Client without undue delay and shall provide such timely information as Client may reasonably require, enabling Client to fulfil any data breach reporting obligations under GDPR. GatherUs will take steps to identify and remediate the cause of such an Incident and to minimize its possible harm. For the avoidance of doubt, Incidents will not include unsuccessful attempts to, or activities that do not, compromise the security of Client Personal Data, including, without limitation, unsuccessful log-in attempts, denial of service attacks, and other attacks on firewalls or networked systems.

VI. DATA TRANSFERS

1. GatherUs may transfer Personal Data outside the European Economic Area (“EEA”) solely to the extent necessary for the provision of the Services. Such transfers may be made to the following categories of recipients:
   • Cloud service providers supporting the operation of the Services (e.g.Google LLC);
   • Payment processors to facilitate billing and subscription management (e.g. Stripe Inc.);
   • Email and communication service providers (e.g. Twilio Inc.);
   • Workspace and operational support service providers (e.g. Roomzilla Technologies Inc.);
   • Authentication and Single Sign-On (SSO) providers (e.g. LinkedIn Ireland Unlimited Company, Microsoft Corporation).
2. Where the GatherUs contracting entity is established outside the EEA, the provision of Client Personal Data by the Client to that entity is itself a Restricted Transfer and is carried out on the basis of the SCCs in the configuration corresponding to the parties’ respective roles, as set out below.
3. In situations where the European Commission has not issued an adequacy decision for a given third country, GatherUs shall ensure that any transfer is carried out with appropriate safeguards in place, including the use of the Standard Contractual Clauses (the “SCCs“), supplemented by any additional safeguards identified as necessary following a transfer impact assessment, and that data subjects continue to benefit from enforceable rights and effective legal remedies.
4. The SCCs apply as follows:
   • in the configuration corresponding to the respective roles of the parties to the relevant transfer, consistent with the role notified by the Client under the Roles and Responsibilities section of this DPA;
   • as completed and amended, for transfers subject to United Kingdom data protection law, by the addendum issued by the competent United Kingdom supervisory authority, which forms part of and modifies the SCCs accordingly;
   • as adjusted, for transfers subject to Swiss data protection law, in accordance with the requirements of the competent Swiss supervisory authority, including so that the SCCs also protect the Personal Data of legal entities to the extent required under that law;
   • for transfers subject to the data protection law of any other jurisdiction, as completed, amended or supplemented to the extent required by, and in accordance with, that applicable law.
5. Where a recipient benefits from another valid transfer mechanism recognised under applicable data protection law, including certification under an applicable adequacy framework, the transfer may instead be carried out on the basis of that mechanism, with the SCCs serving as the fallback safeguard.

VII. DATA SUBJECTS’ RIGHTS

1. GatherUs shall provide commercially reasonable assistance, including by appropriate technical and organizational measures as reasonably practicable, to enable Client to respond to any inquiry, communication, or request from a Data Subject seeking to exercise his or her rights under GDPR, including rights of access, correction, restriction, objection, erasure, or data portability, as applicable. For the avoidance of doubt, Client is responsible for responding to Data Subject requests for access, correction, restriction, objection, erasure, or data portability of that Data Subject’s Personal Data. GatherUs will not respond to any Data Subject request other than to direct such request to the Client unless expressly authorized by Client. Upon Client’s written request, GatherUs will be responsible for responding to Data Subject’s request for access, correction, restriction, objection, erasure or data portability or any other request from a Data Subject seeking to exercise his or her rights under GDPR to the extent the Client itself does not have the ability, with the available standard functionalities of the Services, to respond to such request. To the extent legally permitted, Client may be responsible for the reasonable cost of any time, expenditures, or fees arising from such assistance provided to the Client.
2. GatherUs shall, to the extent required by GDPR, provide Client with reasonable assistance with data protection impact assessments or prior consultations with data protection authorities that Client is required to carry out under GDPR.

VIII. AUDITS

1. GatherUs will allow for and contribute to audits, including inspections, conducted by the Client in accordance with the Client’s rights under this DPA.
2. GatherUs and the Client will discuss and agree in advance on the reasonable start date, scope, and duration of and security and confidentiality controls applicable to any audit; and GatherUs reserves the right to charge a reasonable fee (based on GatherUs’s reasonable costs) for any such audit. GatherUs will provide further details of any applicable fee and the basis of its calculation to the Client in advance of such audit. The purpose of an audit pursuant to this clause will be strictly limited to verifying whether GatherUs is processing Client Personal Data in accordance with the obligations hereunder and GDPR.
3. Notwithstanding the above, GatherUs will, subject to the confidentiality arrangements that will satisfy both Parties, make available to the Client all information held by GatherUs necessary to demonstrate its compliance with the obligations laid down in the GDPR. If the Client wishes to receive such further information as which it is entitled under GDPR, the Client shall submit a request for additional information to GatherUs in writing for that additional information. Where the Client has such information, and subject to the confidentiality arrangements, GatherUs shall supply this information to the Client as soon as reasonably practicable.

IX. DELETION OR RETURN OF CLIENT PERSONAL DATA

1. Upon termination or expiration of the ToS, GatherUs shall, in accordance with the terms of the ToS, delete or make available to the Client for retrieval all relevant Client Personal Data (including copies) in GatherUs’s possession, save to the extent that GatherUs is required by any applicable law or a governmental or regulatory order to retain some or all of the Client Personal Data, or if it is otherwise subject to liability for not retaining some or all of the Client Personal Data. In such an event, GatherUs shall extend the protection of the ToS and this DPA to such Client Personal Data and limit any further processing of such Client Personal Data to only those limited purposes that require the retention for so long as GatherUs maintains the Client Personal Data.

X. MISCELLANEOUS

1. If GatherUs, any of its Data Sub-processors, or the Client receives any regulatory request, order, or other binding decision or recommendation from the competent authority that requires amendments to the provisions hereof or any changes to the processing of the Client Personal Data hereunder (“Regulatory Request“), GatherUs and the Client as well as, to the extent necessary and/or reasonably practicable, representatives of a respective Data Sub-processor, shall, within a reasonable time after receiving and reviewing the Regulatory Request, discuss and work in good faith towards agreeing on a plan (“Compliance Review Plan”) to determine the details of how the Regulatory Request can be addressed. A timeframe for reviewing the Regulatory Request and preparing the Compliance Review Plan will be agreed between the Parties, taking into account the requirements of GDPR and the urgency of the matter, as well as doing everything commercially reasonable given the circumstances and nature of the Services to meet specific time frames set by the relevant authority in connection with the Regulatory Request. If GatherUs, any of its Data Sub-processors, or the Client believes that it is not possible to meet a specific time frame set by the relevant authority in connection with the Regulatory Request, GatherUs and/or its Data Sub-processor will assist the Client to explain this to the relevant authority, including by providing details of the reasons why the timeframes cannot be met.
2. If there is a conflict between the ToS and this DPA, the terms of this DPA will control.

XI. GATHERUS CONTACT DETAILS

hello@gatherus.today

ANNEX 1 — DETAILS OF PROCESSING

This Annex 1 forms part of the DPA and sets out the particulars of the Processing of Client Personal Data required under Article 28(3) GDPR. Where indicated, the particulars are further specified in, or completed by, the applicable Order Form.

1. Subject matter of the Processing

Processing of Client Personal Data in connection with GatherUs’s provision of the App and the Services (event management and hosting) to the Client under the ToS.

2. Duration of the Processing

For the duration of the Subscription Term set out in the applicable Order Form, and thereafter for any retention period required by applicable law or permitted under the Deletion or Return of Client Personal Data section of this DPA. Billing and invoicing data may be retained for the statutory retention period applicable to accounting and tax records ([seven (7) years — exact period to be confirmed against the applicable tax law]) notwithstanding termination or account deletion. Following the end of the Subscription Term and any statutory retention period, GatherUs may retain data solely in irreversibly anonymized, aggregated form (which is no longer Personal Data and falls outside this DPA), as set out in the Aggregate Data clause of the ToS.

3. Nature and purpose of the Processing

The nature of the Processing comprises hosting, storage, transmission, organisation, retrieval, consultation, use and erasure of Client Personal Data by means of the App. The Processing is carried out for the following purposes:

• providing and operating the App and the Services;
• user authentication and Single Sign-On (SSO);
• system and service-related notifications to the Client’s authorised users (communications to End Users, including registration confirmations, Event reminders, surveys and community newsletters, are sent by GatherUs as independent Data Controller under the GatherUs Privacy Policy);
• billing and subscription management;
• providing technical and support services;
• Event registration and check-in of End Users, including the import of participant lists uploaded by the Client and the invitation of the individuals concerned;
• badge design and generation, and transmission of badge content to the Client’s devices for printing;
• attendance analytics for the Client’s Events, including aggregated statistics, per-participant recurrence metrics, segmentation (e.g. new, returning, less active) and the identification of participants at risk of disengaging, each computed solely from data relating to the Client’s own Events;
• post-Event surveys and the reporting of responses to the Client;
• the live event space, including the display of in-Event presence and activity to the Client’s participants;
• management of collaborator roles (speakers, session and event managers) and of Event content, including uploaded images;
• export of Client Personal Data through the tools made available by GatherUs.

Networking suggestions to End Users are not Processed on the Client’s behalf under this Annex; they are GatherUs’s own Processing, governed by the Data Sharing Agreement and the GatherUs Privacy Policy.

4. Types of Client Personal Data

• identification and contact data (e.g. name, email address, telephone number, organisation);
• account credentials and authentication data;
• event registration, participation and attendance data, including any additional registration fields configured by the Client, for which the Client is solely responsible as Data Controller;
• usage, activity and log data;
• billing and payment-related data;
• Sensitive Personal Data is not required by the Services and is in scope only where the Client chooses to collect it through Client-configured fields, in which case the Client is solely responsible for compliance with Article 9 GDPR and equivalent laws (see the Compliance section of this DPA);
• survey responses;
• attendance metrics, segments and classifications derived for the Client from data relating to its own Events;
• badge content;
• images and headshots of collaborators uploaded by or for the Client.

5. Categories of Data Subjects

• the Client’s authorised users and staff;
• event attendees and registrants;
• the Client’s contacts;
• individuals on participant lists uploaded by the Client who have not (yet) created a GatherUs account;
• speakers, session and program managers, program partners, exhibitors, and event managers and organisers; and
• third-party app developers building on the platform (as regards their own account and contact data; where such developers access Client Personal Data, they are addressed in the Compliance section of this DPA).

6. Variation per Order Form

Where the Processing carried out for a particular Client differs from the particulars set out above (e.g. a narrower or broader set of data types or categories of Data Subjects), those variations are set out in the applicable Order Form, which completes this Annex 1 accordingly.

ANNEX 2 — SECURITY MEASURES

1. Access control and confidentiality

Application superadministrator access is restricted to authorised members of the technical team. Access is revoked when the relevant working relationship ends. Personnel authorised to process Client Personal Data are bound by confidentiality obligations and receive practical guidance on security and data handling.

2. Hosting, encryption and secrets

Application data and backups are hosted in cloud infrastructure. HTTPS protects data transmitted between users and the App, and stored application data and backups are encrypted using the cloud platform’s encryption mechanisms. Application secrets, including passwords and API keys, are held outside source code in protected configuration or secret storage. Physical protection of the hosting infrastructure is provided by the cloud infrastructure provider.

3. Backups and recovery

Automated backups are used for production application data through the hosting platform’s backup functionality, to support recovery following data loss or disruption.

4. Development and change management

Production is separated from development and test environments. Code changes undergo review and testing before deployment.

5. Monitoring and vulnerability handling

Application and cloud monitoring generate logs and alerts which are reviewed by the technical team. Findings are assessed to determine whether immediate action or a scheduled remediation task is appropriate. Software libraries are updated in light of relevant recommendations, with targeted checks when significant vulnerabilities become known.

6. Incident handling

The technical team assesses detected issues and takes action to investigate and address incidents affecting Client Personal Data. GatherUs shall notify and assist the Client in accordance with the incident provisions of the DPA.

7. Changes to implementation

GatherUs may update or replace the tools, technologies and implementation methods used to deliver these measures, provided that the commitments in this Annex continue to be met and the overall level of protection of Client Personal Data is not reduced. Such changes do not waive any requirements under the DPA or applicable law concerning sub-processors, international transfers, information or audits.