Data Processing Agreement
Effective: September 28, 2026
This Data Processing Agreement (“DPA”) forms part of the EventHub Terms of Service. It governs how EventHub processes personal data of other people that organizers add to the service.
1. Parties and scope
The organizer — an individual, a business, or another organization using EventHub — is the controller of personal data it enters or collects through EventHub about other people. Denis Fedorovici, str. Studenților 5, MD-4839 Stăuceni, mun. Chișinău, Republic of Moldova, who operates EventHub, processes that data on the organizer’s behalf as a processor within the meaning of Article 28 of the GDPR and other applicable data protection law. This DPA applies automatically whenever the organizer, as a controller, is subject to the GDPR or a similar law. An individual planning a personal celebration is generally outside the GDPR for their own use of guest data; EventHub nevertheless applies the commitments of this DPA to that data.
2. Subject matter, duration, and data
EventHub processes the data to provide the service the organizer uses — invitations, guest lists and replies, seating, programme, guest app, photos, the organization workspace, and related features — for as long as the organizer keeps the data in EventHub. Data subjects: guests and their companions, clients and leads, contractors, and the organizer’s team members. Categories of data: names, contact details, replies and preferences, menu choices and dietary requirements, messages, photos and files, and event and business details the organizer adds.
3. Instructions
EventHub processes the data only on the organizer’s documented instructions — these Terms and the organizer’s own settings and actions in the service — unless the law requires otherwise, in which case EventHub informs the organizer before processing unless the law prohibits it. EventHub tells the organizer if, in its opinion, an instruction infringes data protection law. EventHub does not sell the data and does not use it for advertising or for purposes of its own, other than keeping the service secure and working.
4. Confidentiality
Everyone authorized to access the data on EventHub’s behalf is bound by confidentiality, and access is limited to what is needed to run and support the service.
5. Security
EventHub maintains technical and organizational measures appropriate to the risk, as required by Article 32 of the GDPR, including encryption in transit (HTTPS), access control and restricted administrative access, password hashing, secure token storage on supported mobile devices, backups, and monitoring of errors and abuse. The measures are reviewed as the service changes.
6. Sub-processors
The organizer gives general authorization for the sub-processors listed in section 5 of the Privacy Policy. EventHub binds each of them by contract to data protection obligations equivalent to those of this DPA and remains responsible to the organizer for their performance. EventHub announces any intended addition or replacement of a sub-processor by updating that list before the change takes effect; the organizer may object on reasonable data protection grounds and, if no solution is found, may stop using the service and delete its data.
Privacy Policy7. International transfers
EventHub is operated from the Republic of Moldova, which has no adequacy decision of the European Commission. Where an organizer in the European Economic Area transfers personal data to EventHub, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA by reference, with the organizer as data exporter and EventHub as data importer: the optional Clause 7 does not apply; under Clause 9, option 2 (general written authorization) applies with the notice described in section 6; the optional wording of Clause 11 does not apply; for Clauses 13, 17, and 18, the competent supervisory authority, the governing law, and the courts are those of the EU Member State where the organizer is established. The annexes to the Clauses are completed by sections 2, 5, and 6 of this DPA. For organizers in the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies to the Clauses. Onward transfers to sub-processors outside the EEA rely on an adequacy decision or on Standard Contractual Clauses with the sub-processor.
8. Assistance to the organizer
Taking into account the nature of the processing, EventHub helps the organizer respond to requests from data subjects — the service lets the organizer view, correct, and delete the data — and forwards to the organizer any such request it receives directly. EventHub also provides the information the organizer reasonably needs for security, breach notifications, data protection impact assessments, and prior consultations with supervisory authorities.
9. Personal data breaches
EventHub notifies the organizer without undue delay after becoming aware of a personal data breach affecting the organizer’s data, with the information available at the time and further information as it becomes available, and takes reasonable steps to contain the breach and limit its consequences.
10. Deletion at the end of processing
When the organizer deletes data, an event, or the account, EventHub deletes the related personal data, subject to the retention periods set out in the Privacy Policy and to limited records the law requires EventHub to keep. Copies in backups are overwritten in the normal backup cycle. Before deleting, the organizer can save what the service allows to be exported or downloaded.
11. Information and audits
EventHub makes available the information necessary to demonstrate compliance with this DPA and allows for audits: first through documentation and written answers to the organizer’s questions and, where that is not sufficient, through an audit by the organizer or an independent auditor on reasonable prior notice, at the organizer’s expense and no more than once a year, unless a supervisory authority requires otherwise or a breach has occurred.
12. Menu choices and dietary requirements
Answers about menus and dietary requirements can reveal health information, such as allergies, or religious beliefs, which are special categories of data. The organizer decides whether to ask for them and is responsible for the lawful basis — as a rule, the guest’s explicit consent — and for informing guests. EventHub uses such answers only to deliver the organizer’s event.
13. Precedence and contact
If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails, and the Standard Contractual Clauses prevail over both. Questions about this DPA can be sent to privacy@geteventhub.app.