Data processing agreement

1. Subject and duration

The processor hosts and processes the personal data the organization puts into Galla, for as long as the organization uses the service and until its data is deleted.

2. What is processed

• People: the organization’s staff, guests and the groups they are invited with, vendor and sponsor contacts, ticket buyers and people on waitlists.
• Data: names, contact details, replies, meal choices, dietary and allergy notes (which can reveal health or religion), seats, tickets and payments, photos, messages, files, support requests and the audit log.
• Purpose: planning and running the organization’s events with Galla, and supporting the organization when it asks.

3. The processor’s duties

• Process the data only on the organization’s documented instructions (its use of Galla and these terms), including for transfers, unless European Union or member state law requires otherwise, in which case it tells the organization first unless that law forbids it; and tell the organization if an instruction seems to infringe data protection law.
• Make sure everyone with access is bound to confidentiality, and that Galla staff open an organization only to support it, giving a reason the owners can read in the access log.
• Protect the data with the measures in section 6.
• Use only the subprocessors on the subprocessors page, which the organization authorizes in general. Announce an addition or replacement to owners in the back office and on that page 30 days ahead. The organization may object on reasonable data protection grounds; if no solution is found, it may end the service before the change takes effect, after downloading its data. Bind each subprocessor to the same duties and remain responsible for it.
• Help the organization answer its people’s requests: guest export and erasure, the “Your data” forms for guests, vendors and sponsors, and the organization export.
• Tell the organization without undue delay, and within 48 hours, after becoming aware of a breach affecting its data, with what is known (nature, people and records concerned, likely consequences, measures taken, a contact), and add to it as more is learned.
• Help with impact assessments and prior consultations where needed, and keep a record of the processing done for the organization.
• At the end, delete the data (the organization can download it first): it is deleted 14 days after the owner asks, and leaves the backups within 37 days more. Only what the law requires is kept, such as invoices.
• Give the organization the information needed to show compliance, and allow reasonable audits.

4. The organization’s duties

The organization has a lawful basis for the data it collects (and, for dietary and allergy notes, a condition of Article 9 such as the person’s explicit consent), informs the people concerned, decides who on its staff may see sensitive notes, and answers its people’s requests.

5. Transfers

Data is hosted in the European Union. A subprocessor may process some of it outside the EU only under a safeguard of Chapter V of the GDPR: an adequacy decision, such as the one for the EU-US Data Privacy Framework for a certified provider, or the European Commission’s standard contractual clauses. The subprocessors page names the safeguard for each.

6. Security measures

• Each organization’s rows are kept apart by the database’s row-level security; the application’s database role cannot bypass it.
• Encryption in transit (HTTPS only) and at rest; dietary and allergy notes and tenant secrets are encrypted again by the application.
• Staff sign in with a second step; roles limit who sees what; guest links are random, stored only as hashes, and never written to logs.
• Changes to guests, replies, seats and payments are written to an audit log; support access is logged for the owners.
• Daily backups kept in a second EU region, point-in-time recovery, and a restore test every week.
• Monitoring and alerts, and a written incident procedure.