Data processing agreement

Effective 2026-10-13

This Agreement forms part of the Organizer Agreement between Entase ("Processor") and the Organizer ("Controller"). The Processor is the single Entase company identified in the Controller's Home Annex and recorded in its Account Record; no other Entase company is a party. Terms defined in the Organizer Agreement have the same meaning here.

1. Roles

1.1 For the sale of Tickets for the Controller's Events, the Controller determines the purposes and means of processing Buyer personal data, and Entase processes it on the Controller's behalf.

1.2 For Entase's own purposes — operating and securing the Platform, the events catalogue, fraud prevention, accounting and marketing — Entase is an independent controller, and this Agreement does not apply to that processing. Entase's Privacy Policy covers it.

1.3 The parties are not joint controllers in respect of Ticket sales.

2. Subject matter, duration, nature and purpose

Subject matter — personal data of Buyers, collected through the Platform when Tickets are bought for the Controller's Events.

Duration — the term of the Organizer Agreement, plus the retention periods in clause 11.

Nature and purpose — collecting, recording, storing, organising, retrieving, transmitting, disclosing to the Controller, and erasing personal data, in order to sell and deliver Tickets, collect any further information the Controller asks Buyers for, admit Buyers, notify them of changes, process refunds, and prevent fraud.

Types of personal data — first and last name; email address; telephone number; purchase details including event, seats, ticket type and price; payment method and, where provided, card type and last four digits; concession category where a reduced-price Ticket was bought; correspondence with support; and any further information the Controller configures the Platform to collect from Buyers in connection with its Events, such as business or invoicing details.

Categories of data subject — Buyers, and people they buy Tickets for.

Special category data — none is requested. Entase records only the concession category selected, never any underlying document.

3. Entase's obligations

3.1 Instructions. Entase processes personal data only on the Controller's documented instructions, including on transfers, unless required otherwise by law applicable to Entase — in which case Entase will tell the Controller before processing unless the law forbids it. The Organizer Agreement, this Agreement, and the Controller's use of the Platform are the Controller's documented instructions.

3.2 Entase will tell the Controller if, in Entase's opinion, an instruction infringes data protection law.

3.3 Confidentiality. Entase ensures that people authorised to process the data are bound by confidentiality.

3.4 Security. Entase implements appropriate technical and organisational measures, including:

Encryption of personal data in transit and at rest.
Deployment in private network segments with no direct public access to application or database layers; administrative access restricted by IP and requiring individual authentication.
Role-based access control; access limited to personnel whose role requires it; access reviewed periodically and revoked on role change or departure.
Individual credentials; no shared accounts for administrative access.
Bot and abuse protection at the perimeter.
Logging of administrative access and of changes to personal data.
Regular backups, held encrypted, with restoration tested.
Multi-region deployment for resilience.
Segregation of production from development and test environments; personal data is not used in test environments.
Confidentiality obligations and data protection training for personnel.
Documented breach response procedure with a defined notification path to Controllers.
Secure deletion of personal data at the end of the retention period.

3.5 Assistance. Taking into account the nature of processing, Entase will assist the Controller:

to respond to data subject requests (clause 5);
to meet its obligations on security, breach notification, data protection impact assessment and prior consultation (Arts 32–36 GDPR).

3.6 Deletion or return. On termination, Entase will make the data available for export for 90 days, then delete it, except where law applicable to Entase requires retention and except what is needed to deliver Events already on sale under clause 17.4 of the Organizer Agreement.

3.7 Audit. Entase will make available the information needed to demonstrate compliance with Article 28 and allow audits, including inspections, by the Controller or an auditor it mandates. Entase answers an audit request in writing — with the relevant documentation, any certifications or reports Entase holds, and answers to a security questionnaire of reasonable scope — no more than once a year unless a supervisory authority requires more or a breach has occurred. Everything Entase provides under this clause is Entase's confidential information. An inspection takes place only where the written answer is not enough to show compliance, or where a supervisory authority requires it; it is at the Controller's cost, on 30 days' notice, by an auditor bound by confidentiality who is not a competitor of Entase.

4. Controller's obligations

4.1 The Controller warrants it has a lawful basis for the processing it instructs, and has given data subjects the information data protection law requires.

4.2 The Controller will not instruct Entase to process special category data through the Platform.

4.3 The Controller is responsible for the accuracy of the data it enters and for the lawfulness of any onward use once it exports data.

5. Data subject requests

5.1 Entase will promptly notify the Controller of a request Entase receives directly from a data subject relating to the Controller's processing, and will not respond substantively unless the Controller instructs Entase to.

5.2 Entase provides self-service tools in the Platform for access, correction, export and erasure. Where those are sufficient, using them is Entase's assistance under clause 3.5.

6. Personal data breach

6.1 Entase will notify the Controller without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the Controller's data.

6.2 The notification will describe the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point — to the extent known, with further information as it becomes available.

6.3 Notifying supervisory authorities and data subjects is the Controller's responsibility. Entase does so only where the law requires it of Entase, or where Entase agrees to do so at the Controller's request.

7. Sub-processors

7.1 The Controller gives general authorisation for Entase to engage sub-processors.

7.2 Entase's sub-processors are listed in our sub-processor list.

7.3 Entase will notify the Controller at least 10 days before adding or replacing a sub-processor, by email and in the dashboard. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve an objection, the Controller may terminate the Organizer Agreement without penalty in respect of the affected processing.

7.4 Emergencies. Where Entase must add or replace a sub-processor urgently to keep the Platform running or secure — for example because a sub-processor fails or a security incident requires it — Entase may do so without the notice in clause 7.3, and will notify the Controller as soon as possible afterwards. The Controller may then object within 10 days, with the same effect as under clause 7.3.

7.5 Entase uses only sub-processors that are bound to Entase by written data protection terms protecting the data at least as well as this Agreement, and remains fully liable to the Controller for their performance.

8. Transfers

8.1 Entase may transfer personal data outside the EEA or the United Kingdom only where Chapter V GDPR or the equivalent UK rules permit.

8.2 Standard contractual clauses are the primary mechanism. The Commission's standard contractual clauses (Decision (EU) 2021/914), Module Two (controller to processor) — or Module Three where a sub-processor is involved — are incorporated into this Agreement by reference and completed as set out in clause 8.6. For the United Kingdom, the UK International Data Transfer Addendum applies.

8.3 Entase documents a transfer impact assessment for each transfer and makes it available to a competent supervisory authority on request.

8.4 Where an adequacy decision covers a recipient, Entase may rely on it in addition to, but not instead of, clause 8.2.

8.5 Our sub-processor list states where data is hosted.

8.6 How the clauses are completed. Module Two (controller to processor) of the clauses annexed to Commission Implementing Decision (EU) 2021/914 is completed as follows:

Clause 7 (docking): applies.
Clause 9 (sub-processors): Option 2, general written authorisation, with the notice period in clause 7.3 and the exception in clause 7.4.
Clause 11 (redress): the optional independent dispute resolution paragraph does not apply.
Clause 17 (governing law): the law identified in the Controller's Home Annex, or where that is not the law of an EU member state, the law of Ireland.
Clause 18 (forum): the courts identified in the Controller's Home Annex, or where those are not the courts of an EU member state, the courts of Ireland.
Annex I.A (parties): the Controller is the Organizer named in the Account Record; the data importer is the Entase company identified in the Controller's Home Annex. Where that company is established in the EEA, no restricted transfer arises between the parties and these clauses are not engaged as between them — they continue to apply to onward transfers to sub-processors outside the EEA.
Annex I.B (description of transfer): as set out in clause 2. Frequency: continuous. Retention: as clause 11.
Annex I.C (competent supervisory authority): the authority of the Controller's member state, or where the Controller is not established in the EEA, the authority of the member state in which Entase's Article 27 representative is established.
Annex II (technical and organisational measures): clause 3.4.
Annex III (sub-processors): our sub-processor list.
UK Addendum (clause 8.2): version B1.0, with Table 4 completed as "neither party".

9. Liability

Clause 15 of the Organizer Agreement applies to this Agreement, except that nothing in it limits liability that cannot lawfully be limited, including liability to a data subject under Article 82 GDPR.

10. Order of precedence

If this Agreement conflicts with the Organizer Agreement, this Agreement prevails on data protection. If the standard contractual clauses conflict with this Agreement, the clauses prevail.

11. Retention

As set out in Entase's Privacy Policy and clause 3.6.

12. Term

This Agreement runs for as long as Entase processes personal data on the Controller's behalf.

13. United States state privacy laws

13.1 Where a United States state privacy law applies, Entase acts as the Controller's service provider, contractor or processor as that law defines it. Clauses 2 to 7 apply to that processing, read with the corresponding provisions of that law; there, "personal data" means personal information and "data subject" means consumer. This clause does not cover personal information Entase collects in its own right, such as a Buyer's sign-up to Entase's own marketing, which Entase's Privacy Policy covers.

13.2 Business purposes. The Controller discloses personal information to Entase only for the business purposes in clause 2: to sell and deliver Tickets for the Controller's Events, collect any further information the Controller asks Buyers for, admit Buyers, notify them of changes, process refunds, and prevent fraud.

13.3 Restrictions. Entase will not sell or share the personal information or use it for targeted advertising; will not retain, use or disclose it for any purpose, commercial or otherwise, other than those business purposes or as that law permits; will not retain, use or disclose it outside the direct business relationship between Entase and the Controller; and will not combine it with personal information from other sources, or from Entase's own interactions with consumers, except as that law permits.

13.4 Entase complies with the obligations that law places on a service provider, contractor or processor, and gives the personal information the same level of privacy protection that law requires of the Controller.

13.5 The Controller may take reasonable and appropriate steps to ensure that Entase uses the personal information consistently with the Controller's obligations under that law, including through clause 3.7, and, on notice to Entase, to stop and remediate any unauthorised use.

13.6 Entase will tell the Controller promptly if Entase determines that Entase can no longer meet the obligations in this clause.

13.7 The Controller will tell Entase of any consumer request Entase must act on, with the information needed to act on it. Clause 5 applies to Entase's help with consumer requests.

13.8 Entase understands the restrictions in this clause, will comply with them, and so certifies.