This Data Processing Agreement ("DPA") forms part of the Terms of Service between Event Star Events (Pty) Ltd, trading as Event Star ("Operator", "we"), and the organisation using Event Star ("Organiser", "you"). It meets the requirements of sections 20 and 21 of POPIA for a written contract between a responsible party and an operator. Accepting the Terms of Service accepts this DPA.
For personal information about your attendees, speakers, exhibitors and other event participants ("Event Personal Information"), you are the responsible party and we are your operator. For your own account and billing information, we are a responsible party under our Privacy Policy.
We process Event Personal Information only to provide the Service, on your documented instructions (your configuration and use of the Service are your instructions), and as required by law. We will tell you if we believe an instruction breaks POPIA. We do not use Event Personal Information for our own purposes, sell it, or combine it with other organisers' information.
We treat Event Personal Information as confidential. Our staff and contractors who can access it are bound by confidentiality obligations and access it only where needed (for example to give support you request or to fix a fault).
As section 19 of POPIA requires, we maintain appropriate, reasonable technical and organisational measures, including: per-organisation data isolation enforced in code and automated tests; encryption in transit and of sensitive credentials at rest; role-based access for your staff; one-time codes and signed links for attendees; rate limiting; audit logs of sensitive actions; regular backups; and keeping software up to date. We review these measures as risks change.
You authorise us to use the following sub-operators, each bound by written terms that protect the information at least as well as this DPA:
We will notify your account administrators before adding or replacing a sub-operator that processes Event Personal Information. You may object on reasonable grounds; if we cannot address the objection, you may close your account.
Event Personal Information is hosted on servers in Ireland (European Union) and South Africa, and some sub-operators may process it elsewhere. We only transfer it under section 72 of POPIA, to recipients subject to laws, binding rules or agreements that provide an adequate level of protection.
If we have reasonable grounds to believe Event Personal Information has been accessed or acquired by an unauthorised person, we will notify you without undue delay (and within 72 hours of becoming aware where reasonably possible), with the information reasonably available to help you notify the Information Regulator and data subjects under section 22 of POPIA. We will take reasonable steps to contain and remedy the compromise.
The Service lets you find, correct, export, anonymise and delete Event Personal Information yourself (for example in Registrations and Settings > Data Privacy). If a data subject contacts us directly, we will refer the request to you. We will give you reasonable help to meet your obligations for requests, security, breach notification and prior authorisations.
When your account closes, you may export Event Personal Information for 30 days. After that we delete or anonymise it within a further 60 days, except where the law requires us to keep it. Backups are overwritten in the normal backup cycle.
On reasonable written request, and no more than once a year (unless a supervisory authority requires it or after a security compromise), we will provide information reasonably needed to show compliance with this DPA, such as a description of our security measures.
You confirm that you have a lawful basis, and any consent needed, to collect Event Personal Information and to have us process it, including information you import from other systems or ask for in registration questions; that you give data subjects the notice POPIA requires; and that your instructions comply with the law.