Data processing terms

Contents

• 1. Roles
• 2. Our commitments as processor
• 3. Sub-processors
• 4. International transfers
• 5. Retention and deletion
• 6. Self-hosted installs
• 7. Getting a signed agreement

1. Roles

For personal data about registrants, attendees and the people an Organization adds to its workspace, the Organization is the controller and EntryWick is the processor. For data about the Organization's own team members and about visitors to our website, we are the controller, as described in the Privacy policy.

2. Our commitments as processor

• Process personal data only on your documented instructions — your use of the admin, the API and integrations you connect — and for no other purpose. If we believe an instruction breaks the law we will say so.
• Ensure people with access are bound by confidentiality and have access only as their role requires.
• Apply the measures on the Security page and keep them under review.
• Help you respond to data-subject requests: export and erasure are built into the admin; anything beyond that, we assist within 30 days.
• Help with your security obligations, impact assessments and consultations with authorities, on request.
• Tell you without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting your data, with what we know and what we are doing.
• On termination, keep data available for export for 30 days and then delete it, unless the law requires us to keep it.
• Make available the information needed to show compliance, including a completed security questionnaire; any audit rights for Enterprise customers are agreed in the signed agreement.

3. Sub-processors

We use the following categories of sub-processor, each under a written contract with equivalent obligations. The current named list is provided with the signed agreement and on request.

We give at least 30 days' notice by email to Owners before adding or replacing a sub-processor; you may object on reasonable grounds, and if we cannot resolve the objection you may terminate and export.

4. International transfers

Data is stored in the United States. For Organizations in the EU/EEA, UK or Switzerland, standard contractual clauses (with the UK addendum where needed) can be included in a signed data processing agreement on request.

5. Retention and deletion

Registrant data is retained according to the Organization's plan (12, 24 or 36 months after an event, or by contract), then archived. Erasing a person removes their identifying data and voids live tickets; check-in rows (which reference a record, not a person), payment records and prior audit rows are kept as records, as documented in the admin. Deleting the organization removes everything after a 30-day hold.

6. Self-hosted installs

On a self-hosted licence the Organization hosts and processes its own data; EntryWick receives only licence heartbeat information (instance identifier, version, counts) and is not a processor of registrant data.

7. Getting a signed agreement

Pilot organizations and Enterprise prospects can request a signed data processing agreement incorporating these terms, the named sub-processor list and, where needed, standard contractual clauses: [email protected].

Contact

EntryWick (an iSmart Web product), Houston, Texas, United States · [email protected].