Data Processing Addendum.

1Definitions

We've kept these to the ones the rest of the document actually relies on. Terms like controller, processor, service provider, business, data subject, personal data, process, sell and share carry the meaning given to them by the applicable Data Protection Laws.

• Agreement — our Terms of Service, or another written agreement covering your use of CalGet.
• Customer Personal Data — personal data you upload, submit or otherwise make available to CalGet, which we process on your behalf under the Agreement.
• Data Protection Laws — the privacy and data security laws that apply to the processing, including the CCPA and other US state privacy laws; the GDPR, UK GDPR and Swiss FADP; Canadian federal and provincial privacy laws such as PIPEDA and Quebec's Law 25; Brazil's LGPD; and Australia's Privacy Act 1988.
• Europe — the European Economic Area, Switzerland and the United Kingdom.
• SCCs — the European Commission's Standard Contractual Clauses (Decision 2021/914, Module Two: controller to processor), together with the UK International Data Transfer Addendum where UK data is involved.
• Services — the CalGet event pages, calendar and RSVP features and everything else we provide under the Agreement.
• Subprocessor — a third party we engage to process Customer Personal Data on our behalf.

2Roles and responsibilities

For Customer Personal Data, you are the controller (or business) and we are the processor (or service provider). Annex A sets out what we process, why, for how long and about whom. Each of us is responsible for meeting the obligations that Data Protection Laws place on our own role.

You're responsible for how you collected the data in the first place: having a lawful basis, giving the notices and obtaining the consents that apply to you, and making sure your instructions to us are lawful. Please don't send us sensitive categories of personal data — health, biometric, financial account, government ID and similar — as the Services aren't designed to handle them.

This DPA doesn't cover situations where CalGet acts as a controller in its own right, such as managing our own account holders, billing records and website analytics. Our Privacy Policy covers that.

3Your instructions

We process Customer Personal Data only on your documented instructions. By entering into this DPA, you instruct us to process it to provide, secure and support the Services, as described in the Agreement and Annex A, as set out in any further written instructions you give us, and as otherwise permitted by Data Protection Laws.

If we think an instruction would break Data Protection Laws, we'll tell you promptly rather than carry it out. If a law requires us to process data beyond your instructions, we'll let you know first unless that law forbids it.

4Confidentiality

Access to Customer Personal Data is limited to the people who need it to run or support the Services. Everyone with access is bound by a duty of confidentiality and is trained on handling personal data appropriately.

5Subprocessors

You give us general authorization to engage subprocessors. Our current list is published on our Subprocessors page. Before a subprocessor handles Customer Personal Data, we put a written contract in place that holds them to data protection obligations at least as protective as those in this DPA. We stay responsible to you for their performance.

We'll update that page before adding or replacing a subprocessor; updating it counts as notice to you. If you have a reasonable, data-protection-related objection, tell us within 15 days of the change and we'll work with you in good faith to find a solution. If we can't, you may stop using the affected part of the Services and terminate the affected subscription under the Agreement.

6Security

We maintain appropriate technical and organizational measures to protect Customer Personal Data against unauthorized access, disclosure, alteration, loss and destruction. Annex B describes the measures currently in place. We may change them as technology and threats change, but not in a way that materially reduces the overall level of protection.

Your side matters too: keeping account credentials safe, managing who on your team has access, and deciding what personal data you upload in the first place are your responsibility.

7Data incidents

A data incident is a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data on systems we control. Unsuccessful attempts that don't compromise data — blocked login attempts, port scans, pings and similar — aren't data incidents.

If a data incident happens, we'll notify you without undue delay after becoming aware of it, and no later than 72 hours where the GDPR applies. Our notice will describe what we know, what we're doing about it, and what we recommend you do. We'll take reasonable steps to contain the incident and limit harm, and we'll assist you with your own notification duties.

Notifying you isn't an admission of fault. Deciding whether you need to notify regulators or individuals, and doing so, is your call as the controller.

8Individual rights requests

The Services give you tools to access, correct, export and delete the personal data in your account, so in most cases you can handle a request yourself. Where you can't, we'll give you reasonable assistance, taking into account the nature of the processing and what's available to us.

If someone contacts us directly about data we hold on your behalf, we won't respond substantively. We'll point them to you and let you know, unless the law says otherwise.

9Assessments and audits

On reasonable request, we'll give you the information you need to show that we're meeting our obligations under this DPA, and reasonable help with data protection impact assessments and any consultation with a supervisory authority that you're required to undertake.

You may audit our compliance no more than once a year, and additionally after a data incident that affected your data or where a supervisory authority requires it. Audits happen during business hours, on at least 30 days' notice, under confidentiality, and in a way that doesn't disrupt the Services or expose another customer's data. We may satisfy an audit request by providing a current third-party assessment or security documentation covering the same ground.

10International transfers

CalGet operates from the United States, and Customer Personal Data may be processed there and in any other country where we or our subprocessors operate. We make those transfers in line with Data Protection Laws.

Europe, the UK and Switzerland

Where we receive personal data protected by European Data Protection Laws and no adequacy decision covers the transfer, the SCCs apply and are incorporated into this DPA. Module Two applies, with the docking clause (Clause 7) and general authorization for subprocessors under Clause 9(a) — the notice period being the 15 days set out in section 5. Annex A completes Annex I of the SCCs and Annex B completes Annex II. For UK data, the UK Addendum applies alongside the SCCs. For Swiss data, references to the GDPR are read as references to the Swiss FADP, and the Swiss Federal Data Protection and Information Commissioner is the supervisory authority.

Other regions

For Canadian, Brazilian and Australian personal data, the jurisdiction-specific terms in Annex C apply. If a transfer mechanism we rely on stops being valid, we'll adopt a lawful alternative rather than continue the transfer without one.

11Return and deletion of data

You can export or delete your data at any time while your account is active. When the Agreement ends, we delete Customer Personal Data from our production systems within 90 days, and from backups as those backups age out on their normal schedule. We'll delete it sooner on your written request, and we'll confirm deletion if you ask.

We may keep data for longer where the law requires it, in which case we keep it only for that purpose and continue to protect it under this DPA.

12Deidentified data

We may create aggregated or deidentified data — usage counts, performance metrics and similar — and use it to operate and improve the Services. Where we do, we maintain it in deidentified form, don't attempt to reidentify it, and don't publish or share anything that identifies you, your guests or your events.

13Additional CCPA terms

Where the CCPA applies, we act as your service provider and we:

• don't sell or share Customer Personal Data, as those terms are defined by the CCPA;
• don't retain, use or disclose it except to provide the Services and for the business purposes set out in the Agreement and this DPA, or as the CCPA otherwise permits;
• don't use it outside our direct business relationship with you;
• don't combine it with personal information from other sources, except as the CCPA permits for service providers;
• provide the level of privacy protection the CCPA requires, and tell you promptly if we determine we can no longer do so; and
• let you take reasonable steps to confirm we're using the data consistently with your obligations, and to stop and remediate unauthorized use.

14Liability

Each party's liability under this DPA, including under the SCCs, is subject to the exclusions and limits on liability in the Agreement. Nothing here limits any individual's rights under Data Protection Laws.

15Term and relationship with the Agreement

This DPA takes effect when you accept the Agreement and continues for as long as we process Customer Personal Data on your behalf. It replaces any earlier data processing agreement between us for the Services.

If there's a conflict, the order of precedence is: the SCCs, then this DPA, then the rest of the Agreement. We may update this DPA to reflect changes in law or our practices; if a change materially affects your rights, we'll give you reasonable notice before it takes effect.

16Governing law

This DPA is governed by the law and jurisdiction set out in the Agreement, except where Data Protection Laws require the law of another jurisdiction to apply.