Data Processing Addendum

This Data Processing Addendum forms part of the EventWorks Service Agreement. It sets out the terms on which Kick Digital Ltd processes personal data on behalf of its customers, as required by Article 28 of the UK GDPR. If you are a customer and want a signed copy, email [email protected].

1. Parties and purpose

1.1 This Data Processing Addendum ("DPA") forms part of the EventWorks Service Agreement (the "Agreement") between Kick Digital Ltd, company number 08967728, registered office Projects, Nile House, Nile Street, Brighton, BN1 1HW (the "Provider") and the customer named in the Agreement (the "Customer").

1.2 The Customer is the controller of the Customer Data and the Provider is the processor. This DPA sets out the terms on which the Provider processes Customer Data, as required by Article 28 of the UK GDPR.

1.3 If this DPA conflicts with the Agreement, this DPA prevails in relation to the processing of personal data.

2. Definitions

"Customer Data" means personal data that the Customer or its users enter into, upload to or generate within the Platform, or that the Customer instructs the Provider to process.

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and any law that replaces or supplements them.

"Sub-processor" means a third party engaged by the Provider to process Customer Data.

"Platform" means the EventWorks software and hosting service described in the Agreement.

Other capitalised terms have the meaning given in the Agreement or in Data Protection Law.

3. Details of processing

The subject matter, duration, nature and purpose of the processing, and the categories of data subject and personal data, are set out in Annex 1.

4. Provider obligations

The Provider shall:

1. process Customer Data only on the Customer's documented instructions, including in relation to transfers of personal data outside the United Kingdom, unless required to do so by law. The Agreement, this DPA and the Customer's use of the Platform are the Customer's instructions. The Provider shall inform the Customer if, in its opinion, an instruction infringes Data Protection Law;
2. ensure that every person authorised to process Customer Data is bound by an obligation of confidentiality;
3. implement the technical and organisational measures set out in Annex 2 and keep them under review;
4. engage Sub-processors only in accordance with clause 6;
5. taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Data Protection Law;
6. assist the Customer in meeting its obligations relating to security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with the Information Commissioner, taking into account the nature of the processing and the information available to the Provider;
7. at the Customer's choice, delete or return all Customer Data at the end of the provision of services, in accordance with clause 8;
8. make available to the Customer all information necessary to demonstrate compliance with Article 28 of the UK GDPR, and allow for and contribute to audits in accordance with clause 9.

5. Customer obligations

5.1 The Customer warrants that it has a lawful basis for the processing of Customer Data and that its instructions to the Provider comply with Data Protection Law.

5.2 The Customer is responsible for the accuracy and lawfulness of Customer Data and for the privacy notices given to data subjects.

5.3 Where the Customer enters special category data or criminal offence data into the Platform (for example, right-to-work documents or criminal record declarations for event staff), the Customer is responsible for ensuring that a condition under Article 9 or Article 10 of the UK GDPR applies and that any required policy document is in place.

5.4 The Customer controls which of its users have access to Customer Data through the Platform's user roles and permissions, and is responsible for deactivating users who leave its organisation.

6. Sub-processors

6.1 The Customer authorises the Provider to engage the Sub-processors listed at geteventworks.com/sub-processors as at the date of this DPA.

6.2 The Provider shall give the Customer at least 30 days' notice before engaging a new or replacement Sub-processor, by updating that page and, where the Customer has registered an address for the purpose, by email. The Customer may object in writing within that period on reasonable grounds relating to data protection. If the parties cannot resolve the objection, the Customer may terminate the affected part of the services without penalty.

6.3 The Provider shall impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and shall remain liable to the Customer for the performance of each Sub-processor's obligations.

6.4 Integrations that the Customer chooses to connect to the Platform (for example, an accounting system) are not Sub-processors. The Customer is the controller of data it sends to those services.

7. International transfers

7.1 The Provider hosts and stores Customer Data in the United Kingdom.

7.2 The Provider shall not transfer Customer Data outside the United Kingdom, or permit a Sub-processor to do so, unless the transfer is covered by an adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another mechanism valid under Data Protection Law. The Sub-processor list identifies the location of each Sub-processor and the transfer mechanism relied on.

8. Deletion and return

8.1 The Customer may export Customer Data from the Platform at any time during the term of the Agreement using the Platform's export functions, and may ask the Provider for an export at any time up to the deletion date in clause 8.2.

8.2 In accordance with clause 18.3 of the Agreement, the Provider shall irrevocably delete Customer Data from the Platform within 30 days following termination of the Agreement. Customer Data ceases to exist in backups within a further 35 days as backups expire in the normal cycle.

8.3 The Provider may retain Customer Data where required by law, as permitted by clause 18.5 of the Agreement, and shall then continue to protect it under this DPA and process it only for that purpose.

8.4 On request, the Provider shall confirm deletion in writing.

9. Audit

9.1 The Provider shall, on request and no more than once in any 12-month period, provide the Customer with written information reasonably necessary to demonstrate compliance with this DPA, including its security policies, the results of any independent assessment or certification it holds, and a summary of any relevant security incidents.

9.2 The Provider may satisfy a request under clause 9.1, and any audit under clause 9.3, by providing a report from an independent assessment or certification of the Provider's security controls carried out within the previous 12 months, where that report covers the matters in question.

9.3 Only where the information provided under clauses 9.1 and 9.2 is not sufficient to demonstrate compliance may the Customer, or an independent auditor bound by confidentiality, audit the Provider's compliance with this DPA. Any such audit shall be on at least 30 days' written notice, during business hours, no more than once in any 12-month period, limited to the scope reasonably necessary, at the Customer's cost, and conducted so as not to disrupt the Provider's business or its service to other customers. The Provider may require the audit to be carried out remotely, by written questionnaire and review of documentary evidence, where that is sufficient. The audit shall not extend to the systems or data of the Provider's other customers or to the premises of a Sub-processor.

9.4 Where the Provider receives audit requests from more than one customer in the same period, it may schedule them so that no more than one audit is in progress at a time.

10. Personal data breach

10.1 The Provider shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data.

10.2 The notification shall describe, so far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. The Provider may provide the information in phases as it becomes available.

10.3 The Provider shall cooperate with the Customer and take reasonable steps to contain, investigate and remedy the breach.

10.4 Notification under this clause is not an admission of fault or liability.

11. Liability

11.1 Each party's liability under this DPA is subject to clause 14 of the Agreement (Limitations and exclusions of liability), including the caps in clauses 14.9 and 14.10.

11.2 Nothing in this DPA limits either party's liability in any way that Data Protection Law does not permit.

12. General

12.1 This DPA lasts for as long as the Provider processes Customer Data.

12.2 The Provider may update this DPA to reflect changes in Data Protection Law or in the Platform. The Provider shall give the Customer at least 30 days' notice of a material change. A change that reduces the Customer's protection requires the Customer's agreement.

12.3 This DPA is governed by the law of England and Wales.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

The Provider maintains a written set of information security policies, owned by its Managing Director and reviewed at least annually. The measures below summarise them. Copies of the policies are available to the Customer on request.

Hosting and network. All infrastructure is cloud hosted in DigitalOcean's London region, whose data centres are independently audited (SOC 2 Type II, ISO 27001). Every server runs a host firewall with a default-deny inbound rule. Cloud firewalls restrict public traffic to the content delivery network and restrict administration to a private management network. Each Customer's instance or tenant is logically separated from other customers.

Access control. Access is granted per person, per service, on a least-privilege basis, by the Managing Director only. Administrative access to servers is only possible over an encrypted private network, tied to a named identity and an enrolled device. Multi-factor authentication is enforced on all administrative and cloud service access. Access is removed on the day a person leaves. Within the Platform, the Customer controls its own users, roles and permissions.

Encryption. Data in transit is protected by TLS between users and the Platform and between the Platform and its database. Data at rest, including backups, is encrypted by the managed database and object storage services. User passwords are stored as salted bcrypt hashes. Secrets are held in a password manager and never in source code.

Monitoring and detection. A security agent on every server provides intrusion detection, file integrity monitoring and vulnerability detection, with real-time alerting. Infrastructure and application health are monitored, and application errors are captured.

Patching. Operating system security updates are installed automatically every day. Updates that require a restart are applied by a scheduled, health-checked process inside 14 days. Application dependencies are kept on supported versions.

Backup and recovery. The database is backed up automatically every day with point-in-time recovery. Servers are defined as code and can be rebuilt from a clean image. A business continuity and disaster recovery plan is maintained and reviewed annually.

Secure development. Every change to the Platform passes automated tests, static analysis and code review before release. The running application is scanned with a dynamic application security testing tool. Changes to infrastructure are made through version-controlled code, never by hand on a server.

People. Staff are bound by confidentiality, use company-managed encrypted devices, and follow written acceptable use, password and incident reporting policies.

Incident management. Incidents are contained, investigated, remedied and reviewed under a written policy. Affected customers are notified as set out in clause 10.

AI features. Optional AI features are disabled by default, enabled only by the Customer's administrator, limited to the data types the administrator selects, and operate under the requesting user's own permissions. AI providers are used only through commercial APIs whose terms prohibit use of Customer Data for model training.

Annex 3: Sub-processors

The current list, including purpose, location and transfer mechanism, is published at geteventworks.com/sub-processors and forms part of this DPA.

Changes to this addendum

Material changes are notified in accordance with clause 12.2. The version number and "Last updated" date at the top of this page identify the current version.