Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the customer that accepts the Who Attends terms or an order ("Customer") and Nikolaus Redl, trading as Who Attends, Kleistgasse 18/41, 1030 Vienna, Austria ("Who Attends"). It starts when Customer accepts the agreement or first submits Customer Personal Data.

"Data Protection Law" means the GDPR, applicable national laws that implement or add to it, and the UK GDPR or Swiss Federal Act on Data Protection when applicable. GDPR terms such as controller, processor, personal data, processing, and personal data breach have their legal meanings.

Customer is the controller of Customer Personal Data, or a processor for another controller. Who Attends is Customer's processor or subprocessor. Who Attends remains an independent controller for its account, security, payment, legal, and website data as stated in the privacy policy.

Who Attends will process Customer Personal Data only on Customer's documented instructions and as needed to provide, secure, support, and administer the service, unless Union or Member State law requires other processing. The agreement, this DPA, the order, and Customer's conference request are documented instructions.

If law requires processing outside those instructions, Who Attends will tell Customer before processing unless the law prohibits notice. Who Attends will tell Customer without delay if it believes an instruction breaches Data Protection Law. It can pause the affected processing while the parties resolve the issue.

Customer is responsible for the lawfulness, fairness, accuracy, and transparency of its instructions. Customer must have a lawful basis to access, use, combine, disclose, or contact people from conference data. Customer must not intentionally submit special-category data, criminal-offence data, children's data, health data, card data, or government identifiers unless the parties first agree written safeguards.

Who Attends will limit Customer Personal Data access to personnel who need it to provide or secure the service. Authorized personnel are bound by legal or contract confidentiality duties and receive suitable privacy and security instructions.

Who Attends will keep suitable technical and organizational measures under Article 32 GDPR. It will consider the state of the art, cost, processing nature, scope, context, purposes, and risks. Annex II lists the current measures. Who Attends can update them if the update does not materially reduce overall service security.

Customer gives general written authorization for the subprocessors in Annex III. Who Attends will impose data protection duties that give at least the protection required by Article 28 GDPR for their processing. Who Attends remains responsible for their performance to the extent required by law.

Who Attends will give at least 30 days' notice by email or in the service before a new or replacement subprocessor starts to process Customer Personal Data. Customer can object during that period on reasonable data protection grounds. The parties will try to find a reasonable alternative. If none is available, Customer can terminate the affected service before the change starts.

Who Attends will give reasonable help so Customer can respond to requests for access, correction, deletion, restriction, portability, objection, and recipient information. If Who Attends receives a request about Customer Personal Data, it will not respond for Customer unless Customer authorizes it or law requires it. It will forward the request when it can identify the relevant Customer.

Who Attends will also give reasonable information and help for Customer's duties under Articles 32 to 36 GDPR. This includes security reviews, breach notices, data protection impact assessments, and prior consultation, based on the processing and information available.

Who Attends will notify Customer without undue delay after it becomes aware of a personal data breach that affects Customer Personal Data. As information becomes available, the notice will state the breach nature, affected data and people, likely effects, measures taken or planned, and a contact. Who Attends will take reasonable steps to contain, investigate, and reduce the breach. Notice is not an admission of fault or liability.

This DPA continues while Who Attends processes Customer Personal Data. At the end of the service or after a verified written request, Who Attends will return available Customer Personal Data or delete it and existing copies, at Customer's choice, unless law requires storage. Customer must export needed results before the service ends.

Active systems are normally cleared within 30 days. Deletion from encrypted backups follows the normal overwrite cycle. During that cycle, the data stays protected and is restored only for disaster recovery.

Who Attends will give information reasonably needed to show compliance with Article 28 GDPR. Customer can audit compliance once each year and after a substantiated incident. Audits normally start with current policies, questionnaires, and available reports.

An additional remote or on-site audit needs reasonable notice. It must protect other customers and confidential information and must not unreasonably disrupt operations. Customer pays its audit costs unless the audit finds a material breach by Who Attends.

Who Attends is established in Austria. If Customer Personal Data goes to a country without an adequacy decision, Who Attends will use a lawful transfer method and suitable supplementary measures. This includes requiring eligible subprocessors to use the European Commission Standard Contractual Clauses or another valid safeguard.

If the parties' direct transfer needs the Standard Contractual Clauses from Commission Implementing Decision (EU) 2021/914, they are included by reference. Module Two applies when Customer is controller. Module Three applies when Customer is processor. The docking clause applies. Clause 9 option 2 uses general authorization and the notice period in section 5. Optional clause 11 does not apply. Austria is the governing Member State. Vienna courts are selected for clauses 17 and 18. The UK Addendum or Swiss changes apply when required.

Each party's liability under this DPA is subject to the lawful limits in the agreement. This DPA controls if it conflicts with the agreement about protection of Customer Personal Data. The Standard Contractual Clauses control over conflicting terms. Austrian law governs this DPA unless mandatory Data Protection Law or the Standard Contractual Clauses require another result.

Data exporter

Customer, using the contact and establishment details in its account or order. Customer is controller or processor as applicable.

Data importer

Nikolaus Redl, trading as Who Attends, at the address above. Privacy contact: security@supercenter.app. Who Attends is processor or subprocessor as applicable.

Purpose

Access the conference source that Customer identifies. Collect, clean, match, and deliver the requested attendee CSV. Provide security, troubleshooting, and support.

Nature and frequency

Collection, access, transmission, structuring, matching, storage, consultation, disclosure to Customer, and deletion. Processing occurs when Customer submits a request and during delivery and support.

Data subjects

Customer users and personnel, conference attendees, speakers, exhibitors, sponsors, event staff, and people whose public professional profiles Customer asks us to match.

Personal data

Customer identifiers and instructions; conference access details; attendee names, employers, roles, locations, conference status, professional profile URLs, and source records; output CSV; request, security, and delivery records. No sensitive category is required.

Duration

The service term and the deletion period in section 8, subject to documented legal retention duties.

Supervisory authority

The Austrian Data Protection Authority, without prejudice to another competent authority under Data Protection Law.

• TLS for data in transit and provider-managed encryption at rest for the production database and hosting systems.
• Server-side secret handling and password hashing. Conference access details use AES-256-GCM authenticated encryption and are limited to the requested work.
• Authenticated sessions, secure cookies in production, and server-side authorization on protected routes.
• Input validation, limited production access, dependency management, backups, restoration procedures, and incident response.
• Provider review, confidentiality duties, subprocessor management, and return or deletion procedures.

Electronic acceptance of the terms, an order that refers to this DPA, or use of the service to process Customer Personal Data is a signature where electronic acceptance is legally effective. Send signature copies or privacy questions to security@supercenter.app.