Data processing agreement

1. Subject and duration

The processor hosts and processes the personal data the organization puts into Galla, for as long as the organization uses the service and until its data is deleted.

2. What is processed

• People: the organization’s staff, guests and the groups they are invited with, vendor and sponsor contacts, ticket buyers and people on waitlists.
• Data: names, contact details, replies, meal choices, dietary and allergy notes (which can reveal health or religion), seats, tickets and payments, photos, messages, files and the audit log.
• Purpose: planning and running the organization’s events with Galla.

3. The processor’s duties

• Process the data only on the organization’s documented instructions: its use of Galla and these terms.
• Make sure everyone with access is bound to confidentiality.
• Protect the data: each organization’s rows are kept apart by the database itself, dietary notes and secrets are encrypted, staff sign in with two steps, and access is logged.
• Use only the subprocessors on the subprocessors page, tell owners 30 days before adding one, and bind each to the same duties.
• Help the organization answer its people’s requests: guest export and erasure, the guest request form, and the organization export.
• Tell the organization without undue delay, and within 48 hours, after becoming aware of a breach affecting its data.
• Help with impact assessments and consultations where needed.
• At the end, delete the data (the organization can download it first) and keep only what the law requires.
• Give the organization the information needed to show compliance, and allow reasonable audits.

4. The organization’s duties

The organization has a lawful basis for the data it collects, informs the people concerned, and decides who on its staff may see sensitive notes.

5. Transfers

Data is hosted in the European Union. A transfer outside it happens only under the standard contractual clauses or another safeguard of the GDPR.