EVENTBOOST — DATA PROCESSING ADDENDUM (DPA)

under Article 28 GDPR

Version: 2026.02.02 — Effective Date: June 25th 2026

1. Parties, incorporation, precedence

1.1 Parties.

This Data Processing Addendum (“DPA”) is entered into between:

(a) the customer/organizer using the Services (“Customer” or “Controller”); and

(b) the Eventboost group company acting as the contracting entity identified in the Order and/or invoice (“Eventboost” or “Processor”).

1.2 Incorporation.

This DPA is incorporated by reference into the Agreement (Master Terms + Order).

1.3 Precedence.

In the event of a conflict, this DPA prevails solely with respect to the processing of personal data.

2. Definitions

GDPR terms have the meaning set out in the GDPR. “Customer Data” means data and content submitted to the Services by or on behalf of Customer, including Attendee personal data processed by Eventboost on Customer’s behalf.

3. Roles

4. Article 28(3) details

4.1 Subject matter: provision of Eventboost Services and related support.

4.2 Duration: the term of the Agreement, plus the period required for return/export and deletion per Section 11.

4.3 Nature and purpose: hosting, storage, event registration management, check-in, badge, transactional event communications, reporting/analytics features configured by Customer, integrations requested by Customer, and support operations.

4.4 Categories of data subjects and personal data: see Annex A.

5. Documented instructions

5.1 Eventboost processes Customer Data only on documented instructions from Customer, including platform configurations and written requests.

5.2 If Eventboost believes an instruction infringes applicable data protection law, it will inform Customer.

5.3 No independent use. Eventboost will not use Attendee personal data processed on Customer’s behalf for its own marketing purposes, unless required by law or Customer provides a lawful written instruction.

5.4 Special categories / criminal data. Customer should not submit special categories of data (Art. 9 GDPR) or criminal data (Art. 10 GDPR) unless strictly necessary, and Customer has a valid legal basis and provides required notices/consents.

6. Confidentiality

Eventboost ensures that persons authorized to process Customer Data are bound by confidentiality obligations.

7. Security (Art. 32 GDPR)

Eventboost implements appropriate technical and organizational measures. A minimum summary is provided in Annex B. Eventboost may update security measures to reflect technical evolution while maintaining an appropriate level of security.

8. Subprocessors

8.1 Customer grants Eventboost a general authorization to appoint subprocessors.

8.2 The up-to-date list of sub-processors is available on request and is provided/attached to the DPA upon the Controller’s request. Eventboost will notify the Controller of any change (addition/replacement) with at least 30 days’ prior notice, with the right to object on reasonable grounds and to terminate where no solution can be found.

8.3 Eventboost will impose data protection obligations on subprocessors no less protective than those in this DPA.

8.4 Objection. The customer may object on reasonable grounds of data protection; the parties will work in good faith to reach a solution. If no solution is reasonably available, Customer may terminate the affected Services in accordance with the Agreement.

9. Assistance

Eventboost will provide reasonable assistance for data subject requests (Arts. 15–22 GDPR) and for DPIAs/consultations (Arts. 35–36 GDPR), as appropriate and subject to the nature of the Services.

10. Personal data breaches

Eventboost will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data and will share available information to support the Customer’s compliance with the Arts. 33–34 GDPR.

11. Return and deletion

Upon termination, Eventboost will make Customer Data available for export via standard features for a limited period, and then delete or anonymize Customer Data, subject to applicable legal obligations and routine backups, as described in the Agreement/Privacy documentation.

12. Audits and compliance (Art. 28(3)(h))

Eventboost will make available information reasonably necessary to demonstrate compliance. Audits will be primarily document-based. On-site audits are permitted only with reasonable prior notice, no more than once per year, during business hours, under confidentiality and security constraints, and at Customer’s cost, unless legally required. Eventboost may provide independent reports/certifications as an alternative where reasonable.

13. International transfers

13.1 For transfers outside the EEA to non-adequate countries, Eventboost will use appropriate safeguards under Chapter V GDPR, including the EU SCCs (Commission Implementing Decision (EU) 2021/914).

13.2 UK. Where UK GDPR applies, Eventboost will use the UK Addendum to the EU SCCs or the IDTA, as applicable.

13.3 Switzerland. Where Swiss law applies (nFADP/FADP), SCCs will be supplemented with Swiss-required adaptations.

13.4 The minimum measures are described in Annex D.

14. Liability

Liability and limitations are governed by the Agreement and mandatory law. This DPA does not expand Eventboost’s liability beyond what is required by law.

---

---

---

---