Data Processing Agreement

Effective from 1 December 2026

This is an English translation. In case of any discrepancy, the Czech version prevails.

This agreement on the processing of personal data under Article 28(3) of Regulation (EU) 2016/679 (the “GDPR”) forms part of the Agreement concluded under the Terms of Service between the Organiser as the controller and TRUEAPPS a.s., Company ID: 26237661, with its registered office at Olomoucká 1189/81, Černovice, 627 00 Brno, as the processor (the “Provider”). Capitalised terms have the meaning given to them in the Terms of Service; other terms have the meaning given to them in the GDPR.

1. Subject Matter, Nature and Purpose of the Processing

1.1. The Provider processes, on behalf of the Organiser, personal data that the Organiser uploads to the Application or that are collected through the Application for the Organiser (in particular through the registration of Participants for its events), solely for the purpose of providing the Application and related services (including support, backups and security) under the Agreement.

1.2. The processing includes collection, storage, structuring, retrieval, display, disclosure to the Organiser and to Participants to the extent set by the Organiser, sending e-mails and notifications on the Organiser's instructions, backup, export and erasure.

1.3. The processing takes place for the duration of the Agreement and for the period necessary to erase the data in accordance with Article 9.

2. Categories of Data Subjects and Personal Data

2.1. Data subjects: event Participants (registered visitors, ticket holders, users of the event's mobile app), exhibitors and their contact persons, speakers, partners, staff and other persons whose data the Organiser uploads to the Application.

2.2. Categories of data:

• identification and contact data – first name, surname, e-mail, telephone, organisation, position, address;
• date of birth, if required by the Organiser;
• registration and order data – event, tickets and add-ons, price, payment reference (variable symbol), payment status, ticket QR code, check-in;
• responses in registration and other forms set up by the Organiser;
• data on activity in the event app – poll votes, ratings, questions, favourites;
• photographs and profile texts of exhibitors and speakers;
• technical data – IP address, device data and push notification token, records of e-mails sent.

2.3. The Organiser may not use the Application to process special categories of personal data under Article 9 GDPR (e.g. data concerning health) or personal data relating to criminal convictions and offences under Article 10 GDPR, unless this is necessary for holding the event (e.g. dietary restrictions, barrier-free access), the Organiser has a legal basis for it and informs the Provider of such processing in advance.

3. Obligations of the Organiser

3.1. The Organiser is responsible for having a legal basis for the processing, for having provided data subjects with information under Articles 13 and 14 GDPR (in particular in the event registration form) and for ensuring that the instructions it gives to the Provider comply with the law.

3.2. The Organiser handles requests from data subjects to exercise their rights.

4. Obligations of the Provider

4.1. The Provider processes personal data only on documented instructions from the Organiser, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case, the Provider will inform the Organiser before the processing, unless that law prohibits it. The Organiser's instructions are contained in this agreement and are given by configuring and using the Application; further instructions may be given in writing (including by e-mail).

4.2. The Provider will immediately inform the Organiser if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

4.3. The Provider does not process personal data for its own purposes, does not sell them and does not disclose them to third parties, except to sub-processors under Article 6 and in cases provided for by law.

4.4. The Provider ensures that persons authorised to process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, including after their relationship with the Provider has ended.

5. Security

5.1. The Provider adopts and maintains technical and organisational measures under Article 32 GDPR appropriate to the risk, in particular:

• encryption of data in transit (HTTPS/TLS) and storage of passwords using a strong one-way hash function;
• logical separation of the data of individual Organisers and role-based access control;
• administrator access only to the extent necessary, protected by strong authentication;
• regular backups and testing of data recovery;
• ongoing software updates and security patches, monitoring and activity logs;
• regular evaluation of the effectiveness of the measures adopted.

6. Sub-processors

6.1. The Organiser grants the Provider a general authorisation to engage sub-processors. The current list is published on the Sub-processors page.

6.2. The Provider will inform the Organiser of any intended addition or replacement of a sub-processor at least 14 days in advance, by updating the list and by e-mail to those Organisers who have requested such information at info@eventplace.cz. The Organiser may raise a reasoned objection within this period. If no agreement is reached, the Organiser may terminate the Agreement without penalty as of the date of the change.

6.3. If there is an imminent threat to the security or operation of the Application, the Provider may change a sub-processor without prior notice; it will inform the Organiser subsequently without undue delay, and the right to object remains unaffected.

6.4. The Provider will impose on sub-processors, by contract, the same data protection obligations as are set out in this agreement and is liable to the Organiser for their performance as for its own.

7. Transfers to Third Countries

7.1. The Provider transfers personal data outside the European Economic Area only to the sub-processors included in the list and only where the conditions of Chapter V GDPR are met (an adequacy decision, including the EU-U.S. Data Privacy Framework, or the European Commission's Standard Contractual Clauses).

8. Assistance

8.1. The Provider assists the Organiser by appropriate technical and organisational measures, in particular through the Application's features for finding, rectifying, exporting and erasing data, in fulfilling its obligation to respond to requests for exercising data subjects' rights. If the Provider receives such a request directly, it will forward it to the Organiser without undue delay and will not respond to it itself, unless authorised to do so by the Organiser.

8.2. Taking into account the nature of the processing and the information available to it, the Provider assists the Organiser in ensuring compliance with the obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment and prior consultation).

8.3. Personal data breach. If the Provider becomes aware of a breach of the security of personal data processed for the Organiser, it will notify the Organiser without undue delay, and no later than within 48 hours, to the Account e-mail address. The notification contains the information under Article 33(3) GDPR available to the Provider and is supplemented on an ongoing basis. The Provider will take measures to remedy the breach and mitigate its consequences without undue delay.

8.4. The Provider may charge for more extensive assistance beyond the standard features of the Application according to the costs actually incurred, unless the assistance is required as a result of a breach of the Provider's obligations.

9. End of Processing – Return and Erasure

9.1. The Organiser may export the data at any time during the term of the Agreement; upon termination of the Agreement, Article 10 of the Terms of Service (switching to another provider) also applies.

9.2. After the end of the provision of services, the Provider will, at the Organiser's choice, return or erase the personal data and delete existing copies, unless Union or Member State law requires their storage. Unless the Organiser specifies otherwise, the Account data will be deleted after the data retrieval period has expired, from backups within 45 days and from activity records (logs) within 12 months.

10. Audit and Information

10.1. The Provider will make available to the Organiser all information necessary to demonstrate compliance with the obligations under Article 28 GDPR and will allow for audits, including inspections, conducted by the Organiser or an auditor mandated by it and bound by confidentiality. An audit must be announced at least 30 days in advance, must not unreasonably disrupt the Provider's operations or endanger the data of other Organisers, and its costs are borne by the Organiser, unless the audit reveals a material breach of the Provider's obligations.

11. Final Provisions

11.1. This agreement is effective for the duration of the Agreement, and obligations which by their nature are intended to survive its termination (confidentiality, erasure) continue to apply.

11.2. In the event of a conflict between this agreement and the Terms of Service, this agreement prevails in matters of personal data protection.

11.3. This version is effective from 1 December 2026 and replaces the previous version of the Data Processing Agreement.