Legal

Eventonite Terms of Service

Effective date: 10 November 2026 · Version 1.1

These Terms of Service ("Terms") govern the use of the Eventonite ticketing software ("Eventonite" or the "Service") by organizers of events. Please read them carefully. By registering you accept them.

Service provider ("we", "us", "Eventonite"):
Tokolics Attila ev. (Hungarian sole proprietor)

Registered seat: 8481 Somlóvásárhely, Vásár u. 12., Hungary

Sole proprietor registration number: 26437683

Tax number: 65724473-1-39 · EU VAT number: HU65724473

Email: support@eventonite.com

Further details: Imprint (https://eventonite.com/imprint).

Important points at a glance

  • Eventonite is for businesses only. Consumer withdrawal rights do not apply to your subscription (section 2).
  • You are the seller of your tickets. Ticket money goes to your own Stripe account. You are responsible for your events, your buyers, refunds and complaints (section 9).
  • Refunded tickets still count toward your ticket allowance and overage (section 6.4).
  • Cancellation and downgrades take effect at the end of the billing period, without refund (section 7).
  • Our liability is limited (section 14).
  • You indemnify us against third-party claims arising from your events, ticket sales, content and data processing (section 15).
  • We may suspend your access or ticket sales in the cases listed in section 7.5, and may change these Terms, Plans and prices with 30 days' notice (section 18).
  • If we ever shut down the Service, every Event you have already published runs to the end, including ticket sales and door check-in (section 7.8).
  • If you connect your own tracking pixels to your Event pages, you are the controller for them (section 9.9).
  • The Data Processing Agreement in Annex 1 applies to the data of your ticket buyers and guests (section 8).

1. Definitions

  • Organizer, you: the business that registers for Eventonite and holds a workspace, including clubs, promoters, venues, festivals and other event organizers, whether a company or a sole trader.
  • Workspace: your organizer account in Eventonite, with its events, venues, settings, team members and data.
  • Owner: the user who created the workspace or to whom ownership was transferred. The Owner's email address is the address for notices (section 17).
  • Team member: a person the Owner invites to the workspace, including door staff who use the scanner app with a scanner access code.
  • Buyer: a person who buys a ticket for, or is put on the guest list of, your event.
  • Event page: your public organizer pages on {your-subdomain}.eventonite.com, where Buyers see and buy tickets.
  • Subscription: your paid Eventonite plan, billed monthly or yearly.
  • Plan: one of the subscription plans listed in section 6.1.
  • Ticket allowance: the number of paid tickets included in your Plan for a billing period.
  • Overage: paid tickets sold above your Ticket allowance.
  • Trial: the free period described in section 5.
  • Stripe: Stripe, the payment provider. Stripe Billing is used by us to charge your Subscription. Stripe Connect links your own Stripe account to Eventonite so that Buyers pay you directly.
  • DPA: the Data Processing Agreement in Annex 1, which is part of these Terms.

2. Who may use Eventonite

2.1 Eventonite is a service for businesses. You may register only for the purposes of your trade, business or profession, for example to sell tickets to events you organize. Companies and sole traders may register; private individuals acting as consumers may not. By registering, you confirm that you act as a business and not as a consumer. Before you can add a payment method or publish an Event, you must enter your business details (legal name, billing address and tax number) on the Billing page in the app. We use them for your invoices and to confirm that you act as a business.

2.2 Because Eventonite is provided only to businesses, the consumer protection rules on distance contracts, including the right of withdrawal under Directive 2011/83/EU and Hungarian Government Decree 45/2014. (II. 26.), do not apply to the contract between you and us.

2.3 The person who registers must be at least 18 years old and authorised to accept these Terms on behalf of the business.

2.4 Each company may use the Trial once (section 5.5).

3. How the contract is formed (Ptk. 6:77-6:84, Ekertv. 5-6. §)

3.1 Technical steps. You register at app.eventonite.com by entering your name, email address and password, confirming that you register as a business, ticking the box to accept these Terms and the Privacy Policy, and submitting the form. We then send a registration confirmation email to the address you gave. When you confirm your email address, your workspace is created and the contract between you and us is concluded under these Terms. Your Subscription starts with the Trial (section 5).

3.2 Acknowledgement. The registration confirmation email acknowledges receipt of your registration without delay, as required by Section 6(2) of the Hungarian E-Commerce Act (Ekertv.) and Section 6:84 of the Hungarian Civil Code (Ptk.).

3.3 Correcting input errors. Before you submit the registration form, you can check and correct everything you entered in the form fields. After registration, you can change your name, email address (with confirmation) and password in your account settings, your workspace and public page details in the workspace settings, and your billing details on the Billing page.

3.4 Language. The contract is concluded in English only.

3.5 Not a written contract. The contract is not a contract put in writing ("írásba foglalt szerződés") and is not filed by us as a separate document. These Terms are available at https://eventonite.com/terms at any time, and you can download, save and print them. Earlier versions are available on request at support@eventonite.com.

3.6 Code of conduct. We do not subscribe to any code of conduct.

3.7 Standard terms. These Terms are general terms and conditions (általános szerződési feltételek) within the meaning of Ptk. 6:77. If we agree individual terms with you in writing (for example for the Enterprise plan), those individual terms prevail over these Terms (Ptk. 6:80). Your own general terms and conditions do not apply to the Service.

4. Your account and security

4.1 You must give accurate information and keep it up to date, including your workspace details, your legal name, registered address and support email on your Event pages, and your billing details.

4.2 Your email address is your username. Keep your password, API keys and scanner access codes confidential and do not share login details. Each Team member must use their own login, and each scanner access code should be used by one person or device.

4.3 You are responsible for everything done in your workspace by you, your Team members and anyone using your login details, API keys or scanner access codes, and for the roles you give Team members.

4.4 Tell us without delay at support@eventonite.com if you suspect unauthorised access to your workspace. You can revoke a scanner access code at any time in the app.

5. Free trial

5.1 Every new workspace starts with a free Trial. The Trial lasts 30 days or until you have sold 500 paid tickets, whichever comes first. Complimentary and guest-list tickets do not count toward the 500 tickets.

5.2 You do not need a payment method to start the Trial or to sell paid tickets during the Trial.

5.3 We warn you in the app and by email when you have sold 400 paid tickets in the Trial. The app shows the Trial status throughout.

5.4 When the Trial ends:

  • If you have added a payment method, your Subscription continues and we start charging it under section 6. Every Trial starts on the monthly Starter Plan. If you have not switched to another Plan during the Trial, your Subscription continues on the monthly Starter Plan (USD 29 per month).
  • If you have not added a payment method, sales of paid tickets on your Event pages stop when the Trial ends. There is no grace period. Sales restart immediately once you add a payment method. Your events, settings and data are kept.

5.5 The Trial is available once per company. We may identify a company by its tax number or its Stripe account and may refuse a second Trial.

5.6 You can switch Plans during the Trial at any time, free of charge.

6. Plans, fees, billing and invoicing

6.1 Plans. The Plans at launch are:

Plan
Starter
Monthly price
USD 29
Yearly price
USD 290
Paid tickets included
300 per month
Plan
Growth
Monthly price
USD 79
Yearly price
USD 790
Paid tickets included
1,200 per month
Plan
Pro
Monthly price
USD 189
Yearly price
USD 1,890
Paid tickets included
5,000 per month
Plan
Scale
Monthly price
USD 499
Yearly price
USD 4,990
Paid tickets included
20,000 per month
Plan
Enterprise
Monthly price
Individual offer
Yearly price
Individual offer
Paid tickets included
Individual

On yearly Plans the Ticket allowance is a single yearly pool of 12 times the monthly allowance. It is available for the whole billing year and is not reset monthly. The current Plans and prices are always shown on our pricing page and on the Billing page in the app. Enterprise is provided under an individual agreement.

6.2 Prices and taxes. All prices are in US dollars. We are a Hungarian small business exempt from VAT (alanyi adómentes), so our invoices carry no Hungarian VAT. If your business is established in another EU Member State, the reverse charge applies: you account for VAT in your own country under your own VAT number, which you must give us on the Billing page, and the invoice says so. If your business is established outside the EU, Hungarian VAT does not apply. Where the law requires us to charge VAT in the future, it is shown on your invoice.

6.3 No commission. We take no percentage or fee from your ticket sales. Stripe charges its own payment processing fees to your Stripe account under your agreement with Stripe; these are not our fees.

6.4 Ticket allowance and overage. Each paid ticket sold during a billing period counts toward your Ticket allowance. For every paid ticket above your Ticket allowance we charge USD 0.12 (overage). Ticket sales do not stop when you exceed your allowance. Refunded tickets still count toward your Ticket allowance and toward overage. Complimentary and guest-list tickets do not count. On yearly Plans the yearly pool applies, and paid tickets above it are charged at the same overage price of USD 0.12 per ticket. Overage is charged in arrears: it is added as a separate line to the invoice at the end of each billing period (on yearly Plans, at the end of the billing year). If you change Plan, the new Plan's allowance applies to the whole billing period and overage is recalculated accordingly.

6.5 Billing. Your Subscription is charged in advance for each billing period (one month or one year) to the payment method you add on the Billing page, through Stripe Billing. By adding a payment method you authorise us to charge the Subscription fees and overage to it. The Subscription renews automatically for the same billing period until you cancel or pause it (section 7).

6.6 Changing your Plan.

  • Upgrade: takes effect immediately, once you have paid the full price difference between the two Plans for the current billing period. There is no pro-rata calculation.
  • Downgrade: takes effect at the end of the current billing period, without refund.
  • Switching between monthly and yearly billing: takes effect at the end of the current billing period. The new Plan is charged when its first period starts. Nothing is prorated or refunded for the current period.
  • During the Trial, any Plan change takes effect immediately and nothing is charged until the Trial ends.

6.7 Invoices. We issue invoices through our invoicing provider Billingo, which reports invoice data to the Hungarian tax authority (NAV) as required by Hungarian law, and send them by email to your billing email address.

6.8 Refunds of fees. Fees already paid are not refunded, including on downgrade, cancellation or pause, unless the law requires otherwise or we agree otherwise in writing.

6.9 Failed payments. If a charge to your existing payment method fails, your ticket sales continue, we show a warning in the app, and Stripe retries the charge automatically up to 8 times within 2 weeks (Stripe Smart Retries). Please update your payment method on the Billing page. If all retries fail, the Subscription becomes unpaid and sales of paid tickets on your Event pages stop until the open invoice is paid. When you add or update your payment method, we charge the open invoice immediately, and sales restart once it is paid. Unpaid amounts remain due.

7. Cancellation, pause and termination

7.1 No minimum term. There is no minimum contract term.

7.2 Cancellation by you. You can cancel your Subscription at any time on the Billing page. Cancellation takes effect at the end of the current billing period, without refund. Until then everything works as before, and you can withdraw the cancellation. After that, no fees are charged and no new tickets can be sold, but your events, venues, settings and sold tickets are kept, and you can restart a Subscription at any time.

7.3 Pause. You can pause your Subscription, for example off-season. The pause takes effect at the end of the current billing period, without refund. During the pause no fees are charged and no new tickets can be sold, and your data is kept. Overage for the active period before the pause is still charged. You can withdraw the pause until the end of the period and resume at any time afterwards; resuming starts a new billing period immediately.

7.4 Closing your workspace (ending the contract). If you want to end the contract entirely and have your workspace and account deleted, email support@eventonite.com from the Owner's email address. On request we first send you an export of your events, orders and attendee data; we then close the workspace and delete its data within 30 days of your request, except data we must keep under the law (see section 7 of the Privacy Policy). The contract ends when your workspace is closed.

7.5 Suspension by us. We may suspend your access, your Event pages or ticket sales, in whole or in part, with immediate effect and with notice to you by email, if:

  • (a) you seriously breach these Terms, in particular sections 9, 10 or 12;
  • (b) your use of the Service is unlawful, or we receive a substantiated notice that your content or event is unlawful;
  • (c) your use endangers the security or operation of the Service or other users;
  • (d) Stripe restricts or closes your Stripe account; or
  • (e) the Subscription remains unpaid (section 6.9).

We will lift the suspension once the reason no longer exists.

7.6 Termination by us. We may terminate the contract:

  • with immediate effect, by email, if you seriously breach these Terms and do not remedy the breach within a reasonable deadline we set, or if the breach cannot be remedied; or
  • with 30 days' notice by email, without giving reasons. In that case we refund the part of any yearly fee that relates to the period after termination. If we terminate because we shut down the Service, section 7.8 applies and the contract does not end before your last published Event has taken place.

7.7 Effect of termination. When the contract ends, your access ends and your Event pages stop selling tickets. Amounts already due remain payable. Sections 9 (for sales made before termination), 11, 13-16 and 19 survive termination.

7.8 If we shut down the Service. We will not shut down the Service while you have Events on sale or still to take place. If we decide to shut down the Service, we will tell you by email. From then on you can no longer create new Events, but every Event you have already published keeps working until it has taken place, including ticket sales on its Event page and check-in at the door with the scanner app. Your Subscription continues on its current terms until then. This does not limit section 7.5, termination for a serious breach under section 7.6, or section 16 (force majeure).

8. Your data and data protection

8.1 Your data. You keep all rights to the content and data you enter or upload (events, images, logos, texts, venue details, Buyer data).

8.2 Data processing agreement. For the personal data of Buyers and guests, you are the controller and we are your processor. The DPA in Annex 1 forms part of these Terms and applies automatically when you accept these Terms (GDPR Article 28(3)).

8.3 Our own processing. We process the personal data of you and your Team members as controller, as described in our Privacy Policy (https://eventonite.com/privacy).

8.4 Data after the contract ends. Ticket payment and payout data is held in your own Stripe account and remains available to you there under your agreement with Stripe. For data held by Eventonite, see section 7.4 and section 11 of the DPA.

9. Your responsibilities as organizer

9.1 You are the seller. You sell tickets for your events in your own name to Buyers. The contract for the ticket is between you and the Buyer. We provide only the software and are not a party to that contract. We never receive or hold ticket money: Buyers pay through Stripe directly into your own Stripe account (Stripe Connect, direct charges).

9.2 Your events. You are solely responsible for your events and for everything you publish on your Event pages, including that each event is lawful, takes place as advertised, and has the permits, licences and safety measures it needs.

9.3 Your terms and information for Buyers. Before you can sell tickets, you must provide on your Event pages your legal name, registered address, your terms of sale and your privacy policy. You must keep them accurate and lawful and provide all information that the law requires sellers to give to Buyers before purchase.

9.4 Consumer law, refunds and complaints. You are responsible to Buyers under the consumer protection and other laws that apply to your ticket sales, including withdrawal rights and their exceptions, cancellation or postponement of events, refunds, chargebacks and disputes, and complaints. You handle Buyer questions and complaints through your support contact shown on your Event pages, tickets and ticket emails. We give Buyers only technical help with the Service and forward other Buyer requests to you.

9.5 Taxes on tickets. You are responsible for setting your ticket prices and any fees you charge Buyers, and for the VAT and other taxes and invoicing obligations on your ticket sales.

9.6 Stripe. To sell paid tickets, you need your own Stripe account, which you open and verify directly with Stripe. You must comply with your agreement with Stripe, including the Stripe Services Agreement (https://stripe.com/legal/ssa), the Stripe Connected Account Agreement (https://stripe.com/legal/connect-account) and Stripe's list of Restricted Businesses (https://stripe.com/legal/restricted-businesses). Stripe, not Eventonite, decides on opening, verifying, restricting or closing your Stripe account. We are not responsible for Stripe's services, fees, payouts or decisions.

9.7 Buyer data. You must have a legal basis for the processing of Buyer data, inform Buyers in your privacy policy, and handle their data protection requests, as set out in the DPA. Do not enter special categories of personal data (for example health data) in free-text fields such as guest notes.

9.8 Door staff and offline scanning. You are responsible for the devices your door staff use with the scanner app and for the ticket data stored on them. While a device is offline, it only knows its own scans, so two offline devices could both admit the same ticket; you accept this limitation when you scan offline. Offline scans must be uploaded within 24 hours.

9.9 Your own tracking pixels on Event pages. You may connect your own Google Analytics 4 property, Meta Pixel and TikTok Pixel to your Event pages by entering their ids in your workspace settings. We then load the providers' official scripts on your Event pages, only after the Buyer has accepted them in the cookie banner we show there, and send them page views, the event viewed, the tickets selected and completed purchases (ticket types, quantities, amount, currency and order reference). We never send the Buyer's name or email address to them, and we do not accept custom scripts. For this processing you are the controller: the data goes from the Buyer's browser directly to Google, Meta or TikTok under your own accounts, and we receive none of it. You are responsible for having a legal basis for it, for describing it in the privacy policy you publish on your Event pages, for your agreements with the providers (including Meta's Business Tools Terms, Google's Analytics Terms of Service and TikTok's Business Products Terms), and for any joint-controller arrangement they require. We provide the consent banner, record the Buyer's choice in their browser and load nothing before consent; we do not guarantee that this alone satisfies every law that applies to you. If you do not enter any id, your Event pages load no third-party analytics, tracking or advertising tool.

9.10 Compliance. You must comply with all laws that apply to you and your events, and with these Terms.

10. Acceptable use

You must not, and must not allow others to:

  • (a) use the Service for unlawful events or sales, fraud, or events or products that Stripe does not permit;
  • (b) publish content that is unlawful, infringes the rights of others (including copyright, trademarks or personal rights), or is misleading about an event, its date, location, line-up or price;
  • (c) send spam or unsolicited messages through the Service;
  • (d) access the Service other than through its interfaces and the API keys we provide, or circumvent access limits, the Trial limits or the Ticket allowance;
  • (e) attack, overload, scan for vulnerabilities in, or interfere with the Service, or upload malicious code;
  • (f) copy, resell, sublicense or provide the Service to third parties as a service of your own, except selling tickets for your own events; or
  • (g) reverse engineer the Service, except as the law expressly allows.

To report unlawful content on an Event page, email support@eventonite.com with the URL and the reason. This address is also our point of contact for authorities and for notices about illegal content.

11. Intellectual property and licence

11.1 Our rights. The Service, its software, design and documentation, and the Eventonite name and logo, belong to us or our licensors. You get no rights in them except the licence below.

11.2 Your licence. For the duration of the contract, we grant you a non-exclusive, non-transferable right to use the Service, including the scanner app and the API with the API keys we issue to you, for your own business purposes under these Terms.

11.3 Your content. You grant us a non-exclusive, worldwide, royalty-free right, for the duration of the contract, to host, store, copy, display and transmit the content you upload (such as logos, cover images and event texts) only as needed to provide the Service, including showing it on your Event pages, tickets and ticket emails. You confirm that you have the rights needed to grant this.

11.4 Feedback. If you send us ideas or feedback, we may use them freely, without obligation to you.

12. Availability and changes to the Service

12.1 We provide the Service through hosting in the European Union (Amazon Web Services, region eu-central-1, Frankfurt). We aim to keep the Service available and secure, but we do not guarantee uninterrupted or error-free operation and we offer no service level agreement (SLA) outside an individual Enterprise agreement.

12.2 We may carry out maintenance and updates. Where we can, we will do planned maintenance at times of low use and tell you in advance about maintenance that affects ticket sales.

12.3 We may develop and change the Service. If a change materially reduces the core functions of your Plan, we will tell you at least 30 days in advance, and you may cancel before the change takes effect.

12.4 We are not responsible for services we do not control, including Stripe, your email provider, internet connections and Buyers' devices.

13. Confidentiality

Each party will keep confidential the non-public information it receives from the other party in connection with the Service, and use it only to perform the contract, unless it is publicly available or must be disclosed by law. This obligation survives the end of the contract.

14. Liability

14.1 We are liable for damage caused by our breach of contract under the rules of the Hungarian Civil Code (Ptk. 6:142 and following), subject to the limits below.

14.2 To the extent permitted by law, we are not liable for:

  • (a) loss of profit, loss of ticket revenue, loss of data that you could have exported or backed up, or loss of goodwill;
  • (b) indirect or consequential damage;
  • (c) damage caused by Stripe, other third-party services, or the information and settings you provide; and
  • (d) damage arising from your events, your relationship with Buyers, or your breach of section 9.

14.3 To the extent permitted by law, our total liability for all claims arising out of or in connection with the contract is limited to the total fees you paid us in the 12 months before the event giving rise to the claim.

14.4 No limitation where the law prohibits it. Nothing in these Terms excludes or limits our liability for a breach of contract caused intentionally, or for a breach that causes damage to human life, physical integrity or health (Ptk. 6:152). Any limitation applies only to the extent it does not violate mandatory law, including Ptk. 6:102 on unfair standard terms.

15. Indemnity

You will indemnify us and hold us harmless against all claims, damages, fines and reasonable costs (including legal fees) that third parties, including Buyers, Stripe and authorities, raise against us because of your events, your ticket sales, your content, your processing of Buyer data, or your breach of these Terms or of the law.

16. Force majeure

Neither party is liable for delay or failure to perform caused by circumstances beyond its reasonable control, including outages of hosting, payment or network providers, natural disasters, epidemics, war, strikes and acts of authorities. Payment obligations for periods already used are not affected.

17. Notices and communication

17.1 We send notices to the Owner's email address and, where relevant, show them in the app. A notice sent by email counts as received when it becomes accessible in the recipient's mailbox. Keep the Owner's email address up to date.

17.2 You can send notices to us at support@eventonite.com.

17.3 We send you service emails needed to provide the Service, for example about your account, the Trial, billing, security and changes to these Terms.

18. Changes to these Terms

18.1 We may change these Terms, including Plans and prices. We will email the Owner about the change at least 30 days before it takes effect and publish the new version with its effective date. Price changes apply from your next billing period after the change takes effect.

18.2 If you do not agree with a change, you may cancel your Subscription or close your workspace before the change takes effect. If you keep using the Service after the effective date, you accept the changed Terms.

18.3 We may make changes with shorter notice, or with immediate effect, where the law or an authority requires it, or where a change is needed to address an unforeseen security risk. We will tell you as soon as possible.

19. Governing law and disputes

19.1 These Terms and the contract are governed by Hungarian law, excluding its conflict-of-law rules and excluding the UN Convention on Contracts for the International Sale of Goods.

19.2 We will try to settle disputes amicably first; please contact us at support@eventonite.com.

19.3 For disputes that cannot be settled amicably, the parties agree on the exclusive jurisdiction of the Ajka District Court (Ajkai Járásbíróság) or, depending on the value of the claim, the Veszprém Regional Court (Veszprémi Törvényszék), the courts competent for our registered seat, to the extent the law allows such a choice.

20. Final provisions

20.1 Whole agreement. These Terms, the DPA, the Privacy Policy and any individual written agreement form the entire agreement between you and us about the Service.

20.2 Assignment. You may not transfer the contract to another party without our prior consent. We may transfer the contract to a successor of the Eventonite business, with notice to you.

20.3 Severability. If any provision is invalid, the rest of the Terms remain in force, and the invalid provision is replaced by a valid provision closest to its purpose.

20.4 No waiver. If we do not enforce a right, we do not waive it.

Annex 1: Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms and is concluded between you, the Organizer, as controller, and Eventonite as processor, under Article 28 of the GDPR. Terms defined in the Terms have the same meaning here.

1. Subject matter and duration

We process personal data of Buyers and guests on your behalf to provide the Service: selling and issuing tickets, managing orders, the guest list and refunds, sending ticket emails, and checking tickets at the door with the scanner app. The DPA applies for as long as the contract is in force and until the data has been deleted or returned under section 11.

2. Nature and purpose of the processing

Collection, storage, organisation, transmission (ticket emails, scanner devices, and, if you enable your own tracking pixels under section 9.9 of the Terms, the sending of order data without name or email address from the Buyer's browser to your Google, Meta or TikTok accounts), display to you and your Team members, and deletion of the data, solely to provide the Service to you.

3. Categories of data subjects

Buyers of tickets for your events, persons you put on the guest list, and the persons named on tickets.

4. Categories of personal data

Name and email address; order details (ticket types, quantities, amounts, order reference, payment status); ticket identifiers and QR codes; check-in status, time and the scanner device used; guest-list notes you enter (such as "Guest of"); refund and cancellation records. Card and payment data is processed by Stripe under your own Stripe account and is not covered by this DPA. No special categories of data (Article 9 GDPR) are to be entered; you must not enter such data in free-text fields.

5. Your obligations as controller

You are responsible for the lawfulness of the processing, including a valid legal basis, informing Buyers in your privacy policy, and answering their requests. Your instructions to us are the Terms, this DPA and the settings and actions you perform in the Service (for example adding a guest, issuing a refund, revoking a scanner, or entering a tracking pixel id).

6. Our obligations as processor (Article 28(3) GDPR)

We will:

  • (a) process the data only on your documented instructions, as described in section 5, unless EU or Member State law requires otherwise, in which case we inform you before processing, unless the law prohibits this;
  • (b) ensure that the persons authorised to process the data are bound by confidentiality;
  • (c) take the security measures described in section 8;
  • (d) engage subprocessors only under section 9;
  • (e) help you, as far as possible and taking the nature of the processing into account, to respond to data subject requests under Articles 15-22 GDPR; we forward requests from Buyers to you and do not answer them ourselves;
  • (f) help you meet your obligations under Articles 32-36 GDPR (security, breach notification, data protection impact assessment and prior consultation), taking into account the information available to us;
  • (g) delete or return the data at the end of the contract under section 11;
  • (h) make available the information needed to demonstrate compliance with Article 28 and allow and contribute to audits under section 10; and
  • (i) inform you immediately if we consider that an instruction infringes the GDPR or other data protection law.

7. Personal data breaches

We will notify you without undue delay, and at the latest within 48 hours of becoming aware of it, of a personal data breach affecting your Buyers' data, by email to the Owner's email address, with the information available to us at that time, and provide further information as it becomes available. You are responsible for notifying the supervisory authority and the data subjects where required.

8. Security measures (Article 32 GDPR)

We apply at least the following measures: encrypted connections (HTTPS) for every service; hosting in the EU (Amazon Web Services, Frankfurt) with access restricted to us; passwords stored only as argon2 hashes; scanner access codes stored only as HMAC hashes; signed QR codes on tickets so that forged tickets are rejected; role-based access within workspaces (Supervisors cannot see revenue or order amounts); database backups; server logs kept for 30 days; and the data of each workspace kept separate from other workspaces.

9. Subprocessors

You give us general authorisation to use the following subprocessors: Amazon Web Services EMEA SARL (hosting, database, file storage, job queue, email sending; region eu-central-1, Frankfurt, Germany). Stripe acts as your own payment provider under your agreement with Stripe and is not our subprocessor. Google, Meta and TikTok, where you enable your own pixels under section 9.9 of the Terms, are your own providers under your agreements with them and are not our subprocessors. We will inform you by email to the Owner's email address at least 30 days before adding or replacing a subprocessor. You may object on reasonable data protection grounds within that period; if we cannot offer a solution, you may terminate the contract before the change takes effect. We impose on every subprocessor the same data protection obligations as in this DPA and remain liable to you for its performance.

10. Audits

On request, at most once a year, we provide you with the information needed to show that we comply with this DPA. Where that is not sufficient, you or an independent auditor bound by confidentiality may audit our processing, with at least 30 days' notice, during business hours and without disrupting the Service; you bear the costs of the audit.

11. Return and deletion

During the contract you can export your orders and attendee data from the Service. When the contract ends (section 7.4 of the Terms), we send you an export on request and then delete the Buyer data within 30 days, unless EU or Member State law requires us to keep it. Backups containing the data are deleted within a further 30 days by rotation.

12. Transfers outside the EEA

We process the data in the EU. A transfer outside the EEA takes place only under section 6 of our Privacy Policy (the EU-U.S. Data Privacy Framework certification of Amazon.com, Inc., which covers Amazon Web Services, Inc.) or another safeguard under Chapter V of the GDPR.

13. Liability and precedence

Section 14 of the Terms applies to liability under this DPA. If this DPA conflicts with the Terms, this DPA prevails for the processing of Buyer data.